Data Retention and Disposal Policy
Last updated 4 September 2026
How long we keep your data, what makes us delete it, and how it is disposed of. Version 1.0.
Scope. All customer data held by PhurFriend, operated by Morris Prop AL 1 LLC: records a contractor creates or imports, account identity, uploaded receipt images, and the access tokens issued by Plaid that permit reading bank transactions.
Principle. We keep what the product needs to work and what the law requires, for as long as that is true, and no longer. Data is retained because it is being used, never because deleting it was never got round to.
1. What we hold, and for how long
| Data | Retained | Why |
|---|---|---|
| Job, cost, invoice and payroll records | For the life of the account | These are the contractor's own books. Construction records are commonly needed for years — lien periods, audits, disputes and tax. |
| Bank and card transactions imported | For the life of the account | Job cost history depends on them. |
| Receipt images | For the life of the account | Evidence for the cost it documents. Being right is not the same as being able to prove it. |
| Plaid access tokens | Until the bank is disconnected | Deleted the moment a connection is removed, and revoked with Plaid at the same time. |
| Weekly closes | For the life of the account, immutable | Write-once by database rule. A frozen historical position is only worth showing a lender if nobody can rewrite it. |
| Security and access logs | Platform retention, currently 30 days | Long enough to investigate an incident, short enough not to accumulate. |
| Newsletter subscription | Until unsubscribed | A record of the unsubscribe is kept so we do not mail someone again by accident. |
| Billing records | 7 years | Tax and accounting requirements. Held by Stripe, not by us. |
2. What triggers deletion
The customer asks. Data is removed from production within 30 days of a verified request to business@sanctifo.com. We confirm when it is done.
A bank is disconnected. The Plaid access token is deleted immediately and revoked with Plaid in the same action. Transactions already imported are kept — they are the contractor's cost records, and removing them would silently rewrite their job history.
An account is closed. Data is retained for 90 days after cancellation so a contractor who leaves and returns, or who realises they still need an export, has not lost anything. After that it is deleted on request, or on the schedule above.
Unsubscribing. Ends every marketing email immediately. The address is retained in an unsubscribed state, because forgetting it entirely would risk mailing that person again.
3. Export before deletion
Every screen that shows data can export it, in CSV, at any time, at no charge, without asking us. This is deliberate: a company that makes leaving difficult is telling you something about how it expects to keep you. Export is available whether or not a subscription is current.
4. How data is disposed of
Deletion from production removes the record from the live database and from file storage. Backups are encrypted and expire on our infrastructure provider's rolling schedule; a deleted record therefore persists in encrypted backup for a short period after production deletion, and is not restored to production except in a disaster-recovery event affecting the whole database.
We operate no physical media and no self-managed servers, so there is no hardware to sanitise or destroy. Storage decommissioning is handled by our infrastructure providers under their own certified processes.
5. What we never keep
- Bank credentials. Never transmitted to or stored by us. Authentication happens inside Plaid's own interface.
- Full payment card numbers. Handled entirely by Stripe; they never reach our systems.
- Social Security numbers. Not collected.
6. Sale and sharing
We do not sell customer data, aggregated data, or de-identified data, and we do not share it for advertising. Retention exists to serve the customer, not to build an asset out of them.
7. Review
This policy is reviewed at least annually, and whenever a new category of data is collected or a new subprocessor is added. It sits alongside our information security policy and privacy policy.
Questions, or a deletion request: business@sanctifo.com. We acknowledge within two business days.