Data Retention & Disposal Policy

Offerbee Labs LLC(doing business as “OfferBee”) · Version 1.0 · Effective July 31, 2026 · Owner: Security Officer (Co-Founder & Technical Lead) · Review cadence: annual.

1. Purpose and Scope

This policy defines how Offerbee Labs LLC retains and disposes of data collected through the OfferBee application and website, including consumer data obtained via the Plaid API. It applies to all systems, employees, and contractors with access to production data, and to all environments in which such data is stored or processed.

2. Principles

We retain personal and financial data only as long as needed for the purpose it was collected, or as required by law. Data that is no longer needed is deleted or irreversibly de-identified. Retention periods are applied automatically wherever technically feasible, rather than depending on manual action.

3. Data Categories and Retention Periods

• Plaid access tokens and item identifiers.Retained while your account connection is active. When you disconnect an institution or close your account, we call Plaid’s /item/removeendpoint and delete the stored token and item identifier — in all cases within 7 days.
• Account and transaction data retrieved from Plaid. Retained while the connection is active and deleted within 30 days of disconnection or account closure.
• User account records (name, email address, and authentication credentials). Retained for the life of the account and deleted within 30 days of a verified deletion request or account closure.
• Card and benefit tracking data you create. Retained for the life of the account and deleted alongside the account record. Full card numbers are never collected or stored.
• Location data. Location fixes used for nearby searches and card recommendations are processed transiently and not retained as a location history. Detected-stop records used for nearby alerts are swept automatically after 30 days. Muted-place entries you create (label and coordinates) are retained until you remove them or your account is deleted.
• Application and access logs (including IP addresses and device identifiers). Retained for 90 days and then automatically expired.
• Support and correspondence records. Retained for 24 months from the last interaction.
• Billing and subscription records. Retained for 7 years to satisfy tax and accounting obligations, and excluded from deletion requests to the extent required by law.
• Backups and snapshots. Retained on a rolling 30-day cycle and expired automatically. Deleted records persist in backups only until the containing backup expires.

4. Disposal Methods

Records in our production database (Convex) are removed by hard delete rather than soft-delete flags once the retention period lapses. Object storage and file artifacts are deleted through provider APIs with versioning purged. Cryptographic erasure is used where a record cannot be individually deleted, by destroying the key protecting it. Physical media and end-user devices are wiped using full-disk encryption key destruction before disposal or reassignment. Third-party processors are contractually required to delete data on termination, and we confirm deletion where the provider supports it.

5. Consumer Deletion Requests

You may request deletion in-app or by contacting contact@offerbee.ai. We verify the requester’s identity, action the request within 30 days, and confirm completion in writing. Requests are honored in line with CCPA and GDPR/UK obligations, with statutory exceptions such as billing records documented in the response.

6. Enforcement and Exceptions

Retention rules are enforced through scheduled jobs and provider lifecycle rules, backed by a manual quarterly review. Any exception, such as a litigation hold or regulatory request, must be approved in writing by the Security Officer, documented with a reason and an expiry date, and removed once it is no longer required.

7. Review

This policy is reviewed at least annually, and after any material change to our data processing, vendors, or applicable law. The Security Officer is accountable for review and approval.

8. Contact

Offerbee Labs LLC
Email: contact@offerbee.ai