Tolley · Policies & information

Data Retention & Disposal Policy

This policy describes how Your KC Homes LLC retains, archives, and securely disposes of data in compliance with applicable laws and best practices.

Organization: Your KC Homes LLC

Effective Date: January 1, 2025

Last Reviewed: March 20, 2026

1. Purpose

This policy defines how Your KC Homes LLC retains, archives, and disposes of data to ensure compliance with applicable laws, minimize risk, and protect privacy.

This policy applies to all data collected, processed, or stored by the Company, including financial transaction data from bank account integrations (Plaid), invoice and payment records (Stripe), customer and vendor contact information, and system logs and backups.

Bank transaction data (Plaid): 7 years from transaction date — IRS record retention requirement.
Invoice records: 7 years from invoice date — IRS record retention requirement.
Payment records (Stripe): 7 years from payment date — IRS record retention requirement.
Customer and vendor contacts: Duration of business relationship plus 1 year.
API access tokens (Plaid, Stripe): Duration of active integration — revoked via provider API when no longer needed.
OAuth refresh tokens: Until revoked or expired — revoked via provider API, local file deletion.
System and application logs: 90 days — automated log rotation and deletion.
Database backups: 7 days rolling — automated overwrite by backup rotation.
Temporary processing files: 24 hours — automated cleanup.

Database records are deleted via standard ORM deletion, followed by storage reclamation.
Files on disk are deleted using standard OS file removal. Encrypted volumes ensure deleted data is not recoverable without encryption keys.
API tokens are revoked via the provider's API endpoint before local deletion.
Backups are automatically overwritten by the rolling backup schedule. Manual deletion is performed when data must be removed before rotation.

When a third-party integration (e.g., Plaid) is discontinued, all locally stored data from that provider is deleted within 30 days.
Provider-side data deletion is requested per the provider's data deletion process.

Storage media being decommissioned is securely wiped using full-disk overwrite before disposal or repurposing.
For encrypted drives, encryption keys are destroyed, rendering data unrecoverable.

Upon request, the Company will delete any consumer-related data within 30 days, subject to legal retention requirements.
Data subject requests can be submitted to jared@yourkchomes.com.
Note: The Company currently processes only its own business financial data. No consumer financial data is collected from third parties.

If data is subject to a legal hold, litigation, or regulatory investigation, the applicable retention period is suspended and the data is preserved until the hold is released.

IRS requirements (26 USC §6501) — 7-year retention for financial and tax records.
Missouri data protection laws — timely disposal of personal information no longer needed.
Plaid Developer Policy — data minimization and deletion upon integration termination.
Stripe Terms of Service — payment data handling requirements.

This policy is reviewed annually or upon significant changes to data processing activities, whichever comes first.

T-Agent | Real Estate Unlocked (Tolley AI)
Email: jared@yourkchomes.com
Website: https://tolley.io