Data Retention, Privacy, Consent & Secure Disposal Policy

1. Purpose & Scope

This Data Retention and Disposal Policy governs the collection, minimization, retention, and cryptographic deletion of consumer financial data accessed through the Plaid API and partner open banking aggregators by HeldAway / Black Dog Strategy (heldaway.app / getheldaway.com).

2. Consumer Consent & Data Minimization (Zero Data Retention Scrubbing)

• 2.1 Explicit Consumer Consent: Prior to surfacing Plaid Link, HeldAway obtains explicit, informed consumer consent detailing the read-only scope of data collection (account metadata, balances, and transaction history) in accordance with CFPB Section 1033 and Open Banking FAPI 1.0 guidelines.
• 2.2 Read-Only Scope & PII Minimization: HeldAway never collects, views, or stores raw consumer banking credentials (usernames or passwords), and does not request or store raw routing/account numbers for ACH origination.
• 2.3 Automated ZDR Redaction: All ingested transaction and account strings pass through an automated Zero Data Retention (ZDR) PII Redaction Engine that strips Social Security Numbers (SSNs), unmasked account/card numbers, email addresses, phone numbers, and street addresses before downstream analytics.

3. Data Retention Schedule

Consumer data retrieved from the Plaid API is retained strictly for the duration necessary to provide active financial management and cash-flow analytics requested by the consumer:

• Plaid Access Tokens (access_token & item_id): Retained in AES-encrypted vault storage (SecretsVault) only while the consumer's account connection and 90-day FAPI consent remain active. Automatically invalidated and purged immediately upon consumer revocation, connection removal, or account closure.
• Normalized Account Balances & Transaction History: Retained only for the duration of an active consumer relationship (up to 24 months / 730 days of rolling transaction history for cash-flow analysis). Purged from active production databases within 30 days of account termination or immediately upon verified consumer deletion request.
• Application & Security Audit Logs: Anonymized security and system integrity logs (containing no raw consumer PII or Plaid access_tokens) are retained in tamper-evident WORM storage for regulatory compliance and security auditing.

4. Consumer Data Deletion Rights & Revocation Workflow

Consumers may request the disconnection of their financial institution or the complete deletion of their personal and financial data at any time via:

• Self-service disconnection within the HeldAway Client Security Portal (clicking "Disconnect & Delete My Data"), OR
• Contacting support@blackdogstrategy.ai.

Upon receiving a disconnection or data deletion request, HeldAway executes the following automated disposal workflow within 24 hours (and no later than 7 days):

• Calls Plaid's /item/remove endpoint to immediately invalidate the Plaid access_token at the source.
• Permanently deletes the encrypted access_token and item_id from the aggregator_tokens database table and SecretsVault.
• Purges all associated account balances and transaction records for that user from the relational database and distributed Redis cache clusters, issuing a SHA-256 NIST SP 800-88 R1 cryptographic disposal certificate.

5. Secure Cryptographic Disposal & Annual Policy Review

Deleted records are purged from active tables, and encrypted cloud storage volumes / database backups are rendered permanently unrecoverable via cryptographic key destruction in alignment with NIST SP 800-88 R1 guidelines. This policy is reviewed and updated at least annually by the Security Officer.