DRAFT — not approved

Retention and deletion (for review)

Not in force. Not a lawyer-approved retention policy. The controller is UNKNOWN.

What is kept

Private receipt originals for an invited Pro account: a six-year period after the relevant tax-year end is prepared in the application. Counsel has not approved that period.
Income, expense and CIS rows stay in the private database of the invited account until a deletion path is approved.
Mileage and fuel notes stay on the device until the owner confirms deletion. Closing the application does not remove them.
The sign-in session ends after 15 minutes. Ending the session does not delete the records.
Security logs are kept for the private host. Their retention period is UNKNOWN.

The owner can remove a mileage or fuel note on the device after a second confirmation.
Another account cannot read or delete the owner’s original.
There is no public button that deletes a live account, and this draft does not delete one.
A future customer deletion request will need the named controller, the UNKNOWN support contact, and a checked procedure for Supabase, the private host and Stripe Sandbox. That procedure is not activated here.