Data Retention & Deletion Policy

We keep personal information only as long as we need it to provide the service, meet legal duties, resolve disputes and keep the service secure. Then we delete it or remove anything that identifies you.

Some of our records are designed to hold no personal content at all: our audit log and AI records store identifiers, decisions and fingerprints (hashes), not the text of your case or documents. That is why we can keep them longer.

This policy is part of our Privacy Policy.

• Account (email, phone, display name, passkeys): while your account is open. Deleted within 30 days after you ask us to close it, except the records listed under “What we keep after deletion.”
• Sign-in codes and links: email sign-in links expire after 30 minutes, text codes after 10 minutes, and passkey challenges after 5 minutes; each can be used only once. Only a hash is stored. Expired records are removed periodically [target: within 30 days].
• Sessions: expire after 12 hours or when you sign out. Session records (a hash of the token, sign-in method and device label) are removed periodically [target: within 90 days after they expire].
• Your cases (facts, parties, deadlines, findings, tasks, notes, reminders, property-tax accounts): while your account is open. A case you finish is closed, not erased, so you can come back to it; ask us if you want it deleted.
• Uploaded documents: while your account is open, until you ask us to delete them.
• Credit reports and Credit Health data (accounts read from the report, issues, disputes, letters, collection cases and their files): until you delete the report in the app or close your account. Deleting a report deletes everything read from it; collection cases you opened, and any copy of the report you kept in a case's documents, stay until you ask us to delete them. Closing your account deletes all of your credit data. A signed Credit Health service agreement is kept as described below.
• Messages and communications (email and text delivery records, PRO emails, communication logs): while your account is open, then deleted with your account, except proof of consent (below).
• Consent records (opt-ins, opt-outs, terms acceptances): for as long as you use the service plus 5 years, to prove what you agreed to and when. They are append-only: a change adds a new record instead of editing the old one.
• Billing records (invoices, charges, refunds, subscriptions, Credit Health service agreements): 7 years after the transaction, for tax and accounting law and consumer-protection rules. Stripe keeps its own records under its policies.
• Public-record outreach data (property addresses, sale details from public notices, letters mailed to “the homeowner”): while the notice is active and [24 months] after the sale date or last activity, then deleted. This data never includes a name, phone or email.
• Do-not-contact and do-not-mail lists: kept for as long as we send letters or messages, so your request keeps being honored. They hold only the address or number and the reason.
• Letter and partner link visits (hashed IP and browser): [24 months].
• Partner and affiliate records: while the partnership is active, and payout and commission records for 7 years.
• State waitlist: until we launch in your state and tell you, or until you ask to be removed, and no more than [24 months].
• Audit log and AI run records: 7 years. They contain identifiers, event types, timestamps and hashes, never your documents or case text.
• Information on your device (browser storage): stays until you clear it or, for session storage, until you close the tab. See our Cookie & Local Storage Notice.

• A credit report: open it in Credit Health and choose Delete. The report and everything read from it are deleted right away. Collection cases you opened from it are kept until you ask us to delete them.
• Your account, a case or uploaded documents: email privacy@techoclaro.com from the email on your account (or tell us the phone number you sign in with). We confirm your identity and complete the deletion within 30 days, and no later than 45 days as state privacy laws require. We will confirm when it is done.
• Before you delete: download a copy from Account → Export (your case data and a case-file PDF). Once deleted, we cannot recover it.
• Stop messages instead: reply STOP to texts, use the unsubscribe link in emails, or see Communications Opt-Out to stop letters.

If you shared a case with someone (for example a counselor or attorney), deleting your data removes their access through Techoclaro, but it does not erase copies they downloaded.

Even after you delete your account, we keep, for the periods above:

• Billing and tax records and signed service agreements (7 years).
• Proof of consent and opt-outs, so we can show we respected your choices.
• Do-not-contact entries, so we never contact you again by mistake.
• The audit log and AI run records. These hold identifiers and hashes, not your content, and cannot be changed after they are written. After your account is deleted they no longer link to your name, email or phone.
• Anything we must keep because of a legal hold, a dispute, a law enforcement request or to prevent fraud, only as long as that reason lasts.

Our database provider keeps encrypted backups for disaster recovery. Deleted information may remain in backups until they roll off, normally within [7 days — confirm with Supabase plan], and is never restored into active use except to recover from a failure, in which case we re-apply deletions.

Our service providers (listed in the Privacy Policy) keep data only as long as needed to perform their service or as their own legal duties require. For example, email, text and mail providers keep delivery logs, Stripe keeps payment records, and our hosting providers keep short-lived server logs. [Confirm with provider terms.]

We will post changes here with a new effective date. Questions or requests: privacy@techoclaro.com, or Techoclaro LLC, 1341 W. Mockingbird Lane, Dallas, TX 75247.

In a conflict between the English and Spanish versions, the English version controls.