Secure Storage
GDPR Compliant
Clear Timelines

Data Retention Policy

Transparency in how we store, manage, and protect your information

Last Updated: January 2025

1. Purpose and Scope

1.1 Purpose

Ovr Finance™ (operated by JRM Creative Ventures LLC) retains personal data only for as long as necessary to:

  • Fulfill the purposes for which it was collected
  • Meet legal, contractual, and regulatory obligations
  • Support legitimate business requirements (security, fraud prevention, dispute resolution)
  • Provide Services you've requested

1.2 Principles

We adhere to data minimization and storage limitation principles:

Collect only what's necessary
Keep only as long as needed
Delete when no longer required
Secure during entire lifecycle

1.3 Scope

This Data Retention Policy applies to:

  • All personal data collected through Ovr Finance™ Services
  • Data processed on behalf of users
  • Data stored by third-party processors (Plaid, Stripe, etc.)
  • Data in production systems, backups, and archives

3. Types of Data We Collect and Retain

3.1 Account Information

  • Full name
  • Email address
  • Password (encrypted hash)
  • Phone number (if provided)
  • Profile photo (if uploaded)
  • Account creation date and status

Purpose: Provide access to Services, communicate with you, verify identity, fraud prevention

3.2 Financial Data

  • Linked bank account identifiers (tokenized via Plaid)
  • Credit card account identifiers (last 4 digits)
  • Account balances and credit limits
  • Transaction history and payment records
  • Debt payoff goals and projections
  • Payment authorizations and consent records

Purpose: Calculate debt payoff strategies, process ACH payments, maintain payment authorization records

Important: We do NOT store: Full credit card numbers, CVV codes, bank login credentials, or Social Security Numbers

3.3 Technical Data

  • Device type, model, and operating system
  • IP address and general location
  • Browser type and version
  • App version and installation date
  • Unique device identifiers

Purpose: Provide and optimize Services, detect fraud, debug technical issues, security monitoring

3.4 Usage Data

  • Pages/screens viewed and features used
  • Time spent in app and frequency
  • Interaction patterns
  • Error logs and crash reports
  • Performance metrics

Purpose: Improve user experience, develop features, identify bugs, optimize performance

3.5 Support Communications

  • Support tickets and messages
  • Screenshots or attachments
  • Feedback and survey responses
  • Resolution notes and timestamps

Purpose: Provide customer support, track issue resolution, improve Services, legal defense

3.6 Payment Transaction Records

  • Payment amount, date, and destination
  • Payment authorization records
  • Transaction status
  • Processing fees
  • Stripe transaction IDs
  • User consent records

Purpose: NACHA compliance (2-year), tax reporting (IRS 7-year), dispute resolution, fraud prevention

4. Retention Periods by Data Type

Data TypeRetention PeriodLegal/Business Reason
Account & Profile DataActive + 30 daysAccount continuity, support
Financial Transaction Records7 yearsIRS requirements (26 U.S.C. §6001)
Payment Authorization Records2 yearsNACHA Operating Rules
Add-On Purchase Records7 yearsIRS requirements (26 U.S.C. §6001)
AI Recalibration Usage Logs3 yearsFeature improvement, abuse detection
Autopay Authorization Records2 yearsNACHA Operating Rules
Overage Charge Records7 yearsIRS requirements, dispute resolution
Subscription/Billing Data7 yearsTax and accounting compliance
Support Communications3 yearsLegal defense, quality improvement
Usage & Analytics Data18 monthsProduct optimization
Technical/Device Data12 monthsSecurity monitoring
System Backups (Encrypted)90 daysDisaster recovery
Audit Logs2 yearsSecurity compliance
Marketing Consent Records3 yearsCAN-SPAM, GDPR compliance
Anonymized DataIndefiniteNon-identifiable

5. Data Deletion Process

5.1 How to Request Deletion

⚠IMPORTANT: Active Autopay Transactions

If you have autopay enabled, scheduled payments within the next 7 days may still process even after deletion request.

We recommend disabling autopay in Settings before requesting account deletion to avoid unintended transactions.

In-App

  1. 1. Navigate to Settings → Account → Privacy & Security
  2. 2. Select "Delete My Account"
  3. 3. Confirm deletion and verify identity
  4. 4. Receive confirmation email

By Email

  1. 1. Send email to: support@ovrfinance.io
  2. 2. Subject: "Account Deletion Request"
  3. 3. Include: Full name, email, account details
  4. 4. Deletion processed within 30 days

5.2 Deletion Timeline

Day 0-1

Request received and verified

Identity verification completed, deletion queued, confirmation email sent

Day 1-7

Account deactivation

Account status changed to 'pending deletion', login access disabled, 30-day grace period begins

Day 8-30

Grace period

Data flagged for deletion but still recoverable, user can reactivate by contacting support

Day 31-60

Permanent deletion

Personal data erased from production databases, account cannot be recovered

Day 61-90

Backup purging

Data removed from encrypted backups, system logs scrubbed of personal identifiers

After Day 90

Complete erasure

All traces of personal data removed, only anonymized analytics remain

7. Third-Party Storage and Processing

Ovr Finance™ uses trusted third-party processors. Each has its own retention schedule consistent with GDPR, CCPA, and industry standards.

Service ProviderPurposeDPA
Plaid Inc.Financial account linkingYes
Stripe, Inc.Payment processingYes
Google Cloud / FirebaseCloud hosting, authenticationYes
Amazon Web ServicesCloud hosting, backupsYes
Apple Inc.App distribution, subscriptionsStandard
Google LLCApp distribution, subscriptionsStandard

Third-Party Deletion Requests

When you request deletion, we instruct all processors to delete your data. You may also contact them directly:

  • • Plaid: https://my.plaid.com
  • • Stripe: privacy@stripe.com
  • • Google: https://support.google.com/accounts/answer/3024190
  • • Apple: https://privacy.apple.com

8. Data Security During Retention

Encryption

  • AES-256 encryption for all stored data
  • TLS 1.3 for all data transmission
  • Encrypted backups with separate keys
  • Keys rotated quarterly

Access Controls

  • Principle of least privilege
  • Multi-factor authentication required
  • Role-based access controls
  • Quarterly access reviews

Security Monitoring

  • Intrusion detection systems
  • Anomaly detection for unusual access
  • All data access logged
  • 2-year audit trail retention

Secure Deletion

  • Cryptographic erasure (keys destroyed)
  • DoD 5220.22-M overwriting standard
  • Physical destruction of drives
  • Backup deletion on schedule

9. Your Rights

Right to Information

Know what data we retain, how long, why, and when it will be deleted

privacy@ovrfinance.io

Right to Deletion

Request deletion of your personal data (subject to legal exceptions)

support@ovrfinance.io

Right to Restrict Processing

Request that we stop processing your data while retaining it

privacy@ovrfinance.io

Right to Data Portability

Request a copy of your data in a portable format (CSV, JSON)

privacy@ovrfinance.io

Right to Object

Object to retention for certain purposes (marketing, legitimate interests)

privacy@ovrfinance.io

Right to Lodge Complaint

File complaint with supervisory authority (ICO, California AG, state AG)

10. International Compliance

GDPR (EU/EEA)

  • Storage limitation (Article 5(1)(e))
  • Right to erasure (Article 17)
  • Periodic review of retention necessity
  • Automated deletion where possible

UK GDPR

  • Similar to EU GDPR with UK-specific adaptations
  • ICO guidance followed
  • UK data protection laws supersede where stricter

CCPA/CPRA (California)

  • Right to Delete (§1798.105)
  • 45-day response time
  • Maintain records of deletion requests
  • Annual metrics published

Canada (PIPEDA)

  • Retain only as long as necessary (Principle 5)
  • Secure destruction when no longer needed
  • User may request deletion

11. Automated Deletion

We use automated systems to ensure timely deletion:

Daily
  • Delete accounts past 30-day grace period
  • Remove expired session tokens
  • Purge old error logs
Weekly
  • Delete old usage analytics (18+ months)
  • Remove expired support tickets (3+ years)
  • Scrub personal identifiers from anonymized data
Monthly
  • Delete old system logs (12+ months)
  • Purge encrypted backups (90+ days)
  • Archive financial records to long-term storage
Quarterly
  • Comprehensive retention audit
  • Deletion of inactive accounts (2+ years)
  • Encryption key rotation

12. Data Retention Audits

Quarterly Audits (Every 90 days)

  1. 1Data inventory: Catalog all data in production and backups
  2. 2Age analysis: Identify data exceeding retention periods
  3. 3Legal review: Confirm no legal holds prevent deletion
  4. 4Deletion execution: Purge data eligible for deletion
  5. 5Documentation: Record audit findings and actions taken
  6. 6Reporting: Report to management and compliance team

Independent Audits

  • SOC 2 Type II audits (annually)
  • Security assessments (penetration testing)
  • Privacy compliance reviews (as needed)

13. Policy Updates

We may update this Data Retention Policy to reflect changes in legal requirements, new features, or improvements to retention practices.

Material Changes

  • • Email notification to all active users
  • • In-app notification upon next login
  • • Prominent notice on website
  • • At least 30 days' advance notice

Minor Changes

  • • Updated "Last Updated" date
  • • Notice on website
  • • No individual notification required

14. Contact Us

Data Retention Questions

Email: privacy@ovrfinance.io

Subject: "Data Retention Inquiry"

Response: 5 business days

Deletion Requests

Email: support@ovrfinance.io

Subject: "Account Deletion Request"

Response: 30 days maximum

Data Retention Reports

Email: privacy@ovrfinance.io

Subject: "Data Retention Report Request"

Response: 30 days

Legal and Compliance

Email: legal@ovrfinance.io

Subject: "Legal/Compliance Inquiry"

Mailing Address

JRM Creative Ventures LLC
Attn: Data Protection Officer
111 Town Square Pl Ste 1238 PMB 877216
Jersey City, NJ 07310-1810
United States

Quick Reference Summary

Data TypeHow LongWhy
Active account dataWhile activeProvide Services
After deletion30 daysAllow reactivation
Financial transactions7 yearsTax law (IRS)
Payment authorizations2 yearsNACHA rules
Support tickets3 yearsQuality & legal
Usage analytics18 monthsProduct improvement
Backups (encrypted)90 daysDisaster recovery
Anonymized dataIndefiniteNon-identifiable

How to Delete Your Data

  1. 1. In-app: Settings → Account → Delete Account
  2. 2. Email: support@ovrfinance.io
  3. 3. Wait: 30-day grace period (can reactivate)
  4. 4. Confirmed: Permanent deletion after 30 days

Last Updated: January 2025 | Effective Date: January 2025

© 2025 JRM Creative Ventures LLC. All rights reserved.

Ovr Finance™ is a trademark of JRM Creative Ventures LLC.