Data Retention & Deletion Policy

01

Purpose and Scope

This policy defines how LandlordPro, LLC retains, manages, and deletes personal and financial data collected through the LandlordPro platform. It applies to all data categories including consumer financial data received via connected financial data providers, payment data processed through Stripe, tenant personal information, and landlord account data.

This policy is reviewed annually and updated whenever there is a material change to the platform's data handling practices or applicable law.

02

Retention Schedule

The following schedule defines the retention period for each data category and the legal or operational basis for that period.

Data Category	Retention Period	Basis	After Expiry
Personal account data (name, email, contact info)	Duration of account + 30 days	Service Delivery	Deleted on request or 30 days post-termination
Linked bank account tokens & metadata	Duration of active tenant relationship	Operational	Provider token revoked via API + deleted from DB within 30 days
Rent payment history & financial records	7 years	Tax / Legal Compliance	Securely deleted after 7-year period
Tenant screening reports	5 years minimum	FCRA / FACTA	Securely disposed per FACTA Disposal Rule (16 C.F.R. Part 682)
Login history & device records	12 months	Security / Fraud Prevention	Automatically purged after 12 months
Verification codes (OTP)	10 minutes (active) / 24 hours (audit)	Security	Expired codes deleted automatically
Lease documents & signed agreements	Duration of tenancy + 7 years	Legal / Contractual	Securely deleted after retention period
Anonymized usage & analytics data	Indefinite	Analytics	Retained (no PII — cannot be re-identified)

03

Connected Financial Data Handling

Consumer financial data received via connected financial data providers is handled with the following specific controls:

What LandlordPro stores from financial data providers Provider access tokens (encrypted at rest via AES-256), Stripe processor tokens, and bank account metadata (institution name, account type, last 4 digits only). Raw account numbers and routing numbers are never stored in LandlordPro's database — they are passed directly to Stripe's PCI-compliant vault via the processor token flow.

On tenant offboarding When a tenant's bank account is disconnected or their tenancy ends, the provider access token is revoked via the financial data provider's API and deleted from the LandlordPro database within 30 days. Stripe payment method references are simultaneously archived.

04

Deletion Procedures

LandlordPro enforces data deletion through the following procedures:

Account Deletion Request Upon a verified account deletion request, personal data is deleted from production databases within 30 days. Financial records required for legal compliance (tax, FCRA) are retained for their mandated period then securely deleted. Users may submit deletion requests to support@getlandlordpro.com or via account settings.

Automated Expiry Certain data categories are deleted automatically by scheduled processes: OTP verification codes expire after 10 minutes and are purged, login history older than 12 months is purged, and temporary processing tokens are cleared after use.

Secure Disposal All data is stored in Supabase PostgreSQL encrypted at rest with AES-256. Deletion operations permanently remove records from the database. Supabase's underlying infrastructure handles secure media disposal in accordance with their SOC 2 Type II certified practices.

05

Legal Basis for Retention

Retention periods are set in compliance with applicable laws and regulations:

Law / Regulation	Applicability	Retention Requirement
IRS / Tax Records	Financial transaction records	7 years
FCRA (Fair Credit Reporting Act)	Tenant screening reports	5 years minimum
FACTA Disposal Rule (16 C.F.R. Part 682)	Consumer report disposal	Secure destruction required
CCPA / State Privacy Laws	Consumer deletion rights	Delete within 45 days of verified request
Financial Data Provider Agreements	Third-party API data use restrictions	Use limited to stated purpose; delete on user revocation

06

Consumer Rights

Consumers and tenants have the following rights regarding their data:

Right to Access Request a copy of all personal data LandlordPro holds about you.

Right to Deletion Request deletion of your account and associated personal data. Requests are fulfilled within 30 days subject to legal retention obligations.

Right to Disconnect Bank Account Tenants may disconnect their linked bank account at any time. This revokes the provider access token and removes the bank account reference from the LandlordPro platform.

Right to Correction Request correction of inaccurate personal information held by LandlordPro.

To exercise any of these rights, contact: support@getlandlordpro.com

07

Policy Review Schedule

This policy is reviewed on a defined schedule and updated whenever there is a material change to the platform, applicable law, or data handling practices.

Review Frequency

Annual minimum

Last Reviewed

February 2026

Next Review Due

February 2027

Policy Owner

Joshua Hicks

Ad-hoc Review Triggers This policy is also reviewed immediately upon: a material change to the platform's data architecture, a new third-party data integration, a relevant change in applicable law, or a security incident involving retained data.