Data Retention and Disposal Policy

This Data Retention and Disposal Policy ("Policy") establishes guidelines for the retention, storage, deletion, de-identification, anonymization, and secure disposal of data collected by Phirise, Inc. ("Company", "we", "us", or "our") through our Service. This Policy supports compliance with: - General Data Protection Regulation (GDPR) for EU residents - California Consumer Privacy Act (CCPA/CPRA) - State and federal data privacy laws - Contractual security and privacy commitments - Industry best practices for data minimization and security This Policy applies to data collected through the Service, including personal information, financial data, user content, proof records, optional contribution data, and system logs.

We classify data into the following categories for retention purposes: Category A - Account and Identity Data: User profiles, authentication credentials, contact information, and account settings. Category B - Financial Data: Bank account information, transaction history, account balances, and financial metrics collected via Plaid or other financial data providers. Category C - Transaction and Billing Records: Payment history, invoices, subscription records, credit purchases, and usage logs. Category D - User Content: Documents, prompts, messages, files, AI-generated outputs, and business data created or uploaded by users. Category E - System and Audit Logs: Access logs, security events, error logs, API calls, and system diagnostics. Category F - Marketing and Analytics: Aggregated usage statistics, de-identified analytics, and marketing communications preferences.

Category A - Account and Identity Data: - Active accounts: retained for the duration of the account relationship - Closed accounts: retained only as reasonably necessary for legal compliance, tax/accounting records, fraud prevention, dispute resolution, security, audit, and enforcement purposes Category B - Connected Financial Data: - Active integrations: retained while needed to provide connected financial, operating-review, proof, or account-management features - Disconnected integrations or account deletion: deleted or de-identified according to product deletion workflows, subject to recovery windows, backups, legal holds, audit needs, dispute resolution, tax/accounting duties, and other lawful retention requirements - We do not retain connected financial data indefinitely for shared model training, external datasets, resale, or licensing without explicit opt-in Category C - Transaction and Billing Records: - Payment records and invoices: generally retained up to 7 years for tax, accounting, audit, and dispute purposes - Subscription history: retained as needed for billing, support, tax/accounting, and dispute purposes - Credit usage logs: retained as needed for billing disputes, abuse prevention, product reliability, and audit support Category D - User Content: - Active content: retained until user deletion or account closure - Deleted content: subject to a 30-day recovery period where available, then removed from active systems - Account deletion: content deleted, de-identified, or anonymized according to deletion workflows, subject to legal holds, backups, audit records, and lawful retention requirements Category E - System, Security, and Audit Logs: - Security and access logs: retained as needed for security investigations, compliance audits, abuse prevention, and legal obligations, and may be retained up to 7 years depending on log category - Error and diagnostic logs: retained according to operational need and minimization schedules - API, integration, and AI runtime logs: retained according to internal retention schedules, with raw payloads minimized where practical Category F - Marketing, Analytics, and De-Identified Data: - Marketing preferences: retained until opt-out, account deletion, or as needed to honor suppression lists - Aggregated or de-identified analytics: retained while useful for operational, security, product, and compliance purposes, maintained in de-identified form where required by law - Optional contribution records: retained according to the specific consent, reward, dataset-card, or program terms presented at opt-in

When retention periods expire or upon user request where applicable, we dispose of data using methods appropriate to the data type, system, and processor involved: Electronic Data Disposal: - Logical Deletion: removal from active application views and production workflows - Database Purging: deletion from production databases with appropriate cascade handling where supported - Cryptographic Erasure: destruction or revocation of encryption keys where supported, rendering encrypted data inaccessible - Backup Expiration: scheduled removal from backup systems according to backup retention and lifecycle schedules - De-Identification or Anonymization: removal or transformation of identifiers where deletion is not required or where aggregate records are retained lawfully Cloud and Managed Infrastructure: - Many systems run on cloud-managed infrastructure. Disposal may rely on provider-supported deletion, lifecycle expiration, encryption-key controls, and contractual processor obligations rather than physical media access by Phirise. - We do not claim direct multi-pass overwriting or physical destruction for cloud-managed storage unless a provider specifically supports and documents that process. Third-Party Data: - Service Provider Coordination: where applicable, we instruct processors to delete or return data in accordance with our agreements, retention schedules, and lawful user requests - Verification: we seek confirmation of deletion where feasible and appropriate, recognizing that provider systems may maintain backups or logs for limited periods under their own policies and legal obligations Anonymization and De-Identification: - For certain data types, we may anonymize or de-identify rather than delete where permitted by law - De-identified information is maintained in de-identified form where required by law and is not used to re-identify individuals

GDPR Compliance (for EU residents): - Data minimization: We collect only data necessary for specified purposes - Right to erasure: EU residents may request deletion subject to legal retention requirements - Data portability: Users may export their data in machine-readable format - Lawful basis: We process data based on consent, contract performance, or legitimate interests CCPA/CPRA Compliance (for California residents): - Right to know: California residents may request disclosure of collected data - Right to delete: California residents may request deletion subject to exceptions - Right to opt-out: We do not sell personal information; opt-out rights apply if practices change Other Jurisdictions: - We comply with applicable state data breach notification laws - We honor data protection rights under applicable state privacy laws - International data transfers comply with applicable frameworks (e.g., Standard Contractual Clauses)

Data Protection Officer / Privacy Lead: - Oversees implementation and enforcement of this Policy - Coordinates with legal counsel on compliance matters - Manages data subject requests and privacy inquiries - Contact: support@phirise.com Engineering and Operations Teams: - Implement technical controls for data retention and disposal - Execute scheduled data purging and anonymization processes - Maintain audit logs of disposal activities - Ensure backup systems comply with retention schedules Compliance and Legal Teams: - Monitor regulatory changes affecting retention requirements - Advise on legal holds and litigation-related retention - Conduct periodic audits of retention practices - Maintain documentation for regulatory examinations All Employees: - Comply with data handling and retention procedures - Report data incidents or policy violations - Complete required privacy and security training

This Policy is reviewed and updated: - Annually, or more frequently as needed - When regulatory requirements change - Following significant changes to our data practices, AI processing, contribution programs, or sub-processors - After material data incidents or audit findings Policy updates are communicated to users through: - Email notifications for material changes where appropriate - In-app notices - Updates to this page with revision date For questions about this Policy or to request documentation for regulatory purposes, contact: Phirise, Inc. Data Protection Officer Email: support@phirise.com Address: 2261 Market Street STE 86584, San Francisco, California 94114 Telephone: (618) 591-2361 This Policy was last reviewed and approved on May 29, 2026.