Data Retention Policy

Kleer Ledger collects limited personal and financial data strictly necessary to provide the service. Data we collect and store includes:

• •Account information: your email address and authentication credentials managed by our platform provider.
• •Transaction data: merchant names, amounts, and dates retrieved via Plaid from your connected bank accounts.
• •Custom labels: personal titles, notes, and category tags you assign to transactions.
• •Credit card metadata: card nicknames and reward category configurations you manually enter (no actual card numbers).
• •Subscription records: a Stripe subscription reference used to manage your account status.
• •Usage logs: anonymized activity data used for service reliability and improvement.

All data is stored on secure, encrypted infrastructure. We do not store bank login credentials, payment card numbers, CVV codes, or any sensitive authentication data.

We retain different categories of data for different periods based on operational and legal requirements:

• •Active account data — Retained for the full duration of your active subscription and account.
• •Transaction and label data — Retained while your account is active. Deleted within 30 days of account deletion.
• •Billing records — Retained for up to 7 years to comply with financial record-keeping obligations.
• •Authentication logs — Retained for up to 90 days for security monitoring purposes.
• •Support communications — Retained for up to 2 years to assist with ongoing or future inquiries.
• •Anonymized analytics — May be retained indefinitely as they contain no personally identifiable information.

You have the right to request deletion of your personal data at any time. Kleer Ledger provides two ways to initiate deletion:

• •In-app deletion — Use the "Delete Account" option in the app settings. This immediately revokes bank access tokens and schedules all personal data for deletion within 30 days.
• •Email request — Contact us at privacy@kleerledger.com to request manual data deletion. We will process the request within 30 days.

Please note that certain data may be retained beyond this period if required by law (e.g., billing records for tax compliance) or to resolve ongoing disputes.

When data reaches the end of its retention period or a deletion request is processed, Kleer Ledger employs secure disposal practices to ensure data is unrecoverable:

• •Database records are hard-deleted (not soft-deleted) from production systems.
• •Backups containing deleted user data are purged on a rolling schedule within 30 days.
• •Plaid access tokens are immediately revoked upon account deletion or bank disconnection.
• •Encrypted storage volumes use cryptographic erasure where full data overwrite is not feasible.

Financial data retrieved from your bank via Plaid is treated with the highest level of sensitivity. Kleer Ledger applies the following controls specifically to financial data:

• •Transaction data is stored in encrypted form at rest using AES-256 encryption.
• •Financial data is never sold, shared, or used for advertising or profiling purposes.
• •Access to financial data is restricted to systems and personnel strictly necessary to deliver the service.
• •We operate in a read-only capacity — Kleer Ledger never initiates transactions or modifies bank records.
• •Plaid connections are scoped to transaction read access only, with no payment or transfer permissions.

In certain circumstances, Kleer Ledger may be required by law to retain data beyond the standard retention periods described above. These circumstances include:

• •Tax and financial record-keeping requirements (typically 7 years for billing records).
• •Compliance with court orders, subpoenas, or lawful government requests.
• •Retention necessary to resolve active or pending legal disputes.
• •Compliance with applicable data protection laws including CCPA and applicable state privacy regulations.

Where legal retention obligations apply, data will be stored in a restricted access environment and used solely for the purpose of meeting the legal requirement.

Kleer Ledger relies on the following third-party providers who may retain certain data independently under their own policies:

• •Plaid — Retains bank connection and transaction data per its own Privacy Policy. You can manage Plaid data access at my.plaid.com.
• •Stripe — Retains billing and subscription records per its own Privacy Policy. Stripe may retain financial transaction records for its own compliance obligations.

We do not integrate with advertising networks, analytics brokers, or data monetization services that would independently retain your personal information.

We may update this Data Retention Policy as our practices or legal obligations evolve. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of Kleer Ledger following any changes constitutes your acceptance of the updated policy.

For questions about this policy or to exercise your data rights, contact us at privacy@kleerledger.com.