Data Retention Schedule

Last updated: August 18, 2026

These are operational targets, subject to legal holds, fraud/security investigations, disputes, contract obligations, and applicable law. Deletion includes primary records and queued object deletion; provider backup removal follows the provider's documented cycle.

Record	Target period	Disposition
Incomplete eligibility session/events with no submitted lead	90 days	Delete or aggregate without a direct identifier
Unfunded, withdrawn, or declined lead/application records	25 months after closure or decision	Delete PII and raw documents; retain de-identified compliance/portfolio aggregates where permitted
Funded deal, agreement, payment, servicing, and disclosure records	Agreement term plus 7 years	Delete or irreversibly de-identify when no hold applies
Temporary upload not attached to an application	7 days	Automated object expiration
Plaid access token	Active connection plus up to 30 days for verified closure	Revoke where supported, then delete encrypted token material
Raw bank transactions and application documents	Same as related application/deal record	Delete from D1/R2 and downstream processing queues
Security and administrative audit events	At least 12 months; longer if attached to an incident or legal hold	Delete after review period

Requests: privacy@stelopartners.com. Stelo verifies completion through deletion-job audit records rather than representing a record as deleted when an object or provider copy remains active.