Data Retention Schedule
Last updated: September 26, 2026
These are operational targets, subject to legal holds, fraud/security investigations, disputes, contract obligations, and applicable law. Deletion includes primary records and queued object deletion; provider backup removal follows the provider's documented cycle.
| Record | Target period | Disposition |
|---|---|---|
| Public contact request | Pending legal and operations approval | Lifecycle fields support a future deletion schedule; legal holds and verified privacy requests still apply |
| Incomplete legacy eligibility session/events with no submitted lead | 90 days | Delete or aggregate without a direct identifier |
| Unfunded, withdrawn, or declined lead/application records | 25 months after closure or decision | Delete PII and raw documents; retain de-identified compliance/portfolio aggregates where permitted |
| Funded deal, agreement, payment, servicing, and disclosure records | Agreement term plus 7 years | Delete or irreversibly de-identify when no hold applies |
| Signed agreements, signing records, and signing evidence | Same as the related funded-deal or application record | Includes the signed original, signers' copies, the signing record, consent and code-check times, encrypted signatures and typed answers, the IP address and browser user agent recorded at signing, file fingerprints, and encrypted copies of signing emails and staff alerts; deleted or de-identified with that record unless a legal hold applies |
| Temporary upload not attached to an application | 7 days | Automated object expiration |
| Raw bank transactions and application documents | Same as related application/deal record | Delete from D1/R2 and downstream processing queues |
| Linked bank data from Stripe Financial Connections | Same as the related application or deal record | Includes the bank's name and the last four digits of each account, balances, account owner names and mailing addresses, transactions, and anything Stelo builds from them, such as bank summaries, monitoring figures, and alerts; kept with the deal record and deleted or de-identified with it unless a legal hold applies; not deleted when the business disconnects an account or when monitoring stops; records of the consent given when linking are kept for as long as Stripe's terms require |
| Funding call recordings, their transcripts and AI summaries | Same as related application/deal record | Delete from D1/R2; unfinished recording uploads are cleared after about a day |
| Security and administrative audit events | At least 12 months; longer if attached to an incident or legal hold | Delete after review period |
Requests: privacy@updates.stelopartners.com. Stelo verifies completion through deletion-job audit records rather than representing a record as deleted when an object or provider copy remains active.