DATA RETENTION AND DISPOSAL POLICY
Sofia Holdings LLC
Effective Date: March 24, 2026
1. Purpose
This policy defines how Sofia Holdings LLC ("Sofia," "we," "us") retains, manages, and disposes of consumer data collected through the Sofia property accounting platform in compliance with applicable data privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) and other applicable U.S. state privacy regulations.
2. Scope
This policy applies to all consumer financial data received through the Plaid API, all personal data collected through the Sofia application at app.hiresofia.ai, and all data submitted via the hiresofia.ai website. It applies to all employees, contractors, and service providers who access or process this data on behalf of Sofia Holdings LLC.
3. Data Retention Schedule
| Data Type | Retention Period | Basis |
|---|---|---|
| Account & profile data | Duration of account + 90 days post-deletion | Service provision |
| Financial transactions & accounting records | Duration of account + 90 days post-deletion | Accounting & tax requirements |
| Bank connection tokens (Plaid access tokens) | Until disconnected by user or account deleted | Service provision |
| Uploaded documents & receipts | Duration of account + 90 days post-deletion | Service provision |
| Demo request data (name, email, phone) | 2 years | Business records |
| Session & authentication data | 30 days | Security |
| Audit logs | 1 year | Security & compliance |
4. Data Deletion Procedures
Users may request full account and data deletion at any time by contacting support@hiresofia.com. Upon receiving a valid deletion request:
- Account records are immediately soft-deleted and access is revoked.
- All associated financial data, transactions, documents, and receipts are soft-deleted.
- Plaid bank connection tokens are immediately revoked via the Plaid API.
- Soft-deleted records are permanently and irreversibly purged from the database after 30 days.
- Deletion confirmation is sent to the user's registered email address within 5 business days.
5. Data Disposal Standards
All data is stored in Replit's managed PostgreSQL infrastructure. Logical deletion is performed via secure database operations. Physical media disposal is governed by Replit's infrastructure platform standards, which include industry-standard secure erasure procedures. Sofia does not maintain on-premises physical storage media.
6. Plaid Data Handling
Consumer financial data received from the Plaid API is subject to this policy. Sofia does not share or sell Plaid-sourced data to third parties. Plaid access tokens are stored securely and revoked immediately upon user disconnection or account deletion. Consumers may also manage and revoke bank connections directly through Plaid's consumer portal at my.plaid.com.
7. Legal and Regulatory Compliance
Sofia retains data only as long as necessary for the purposes described herein, consistent with applicable data privacy laws. Users in jurisdictions with specific data subject rights (e.g., right to erasure under GDPR or CCPA) may submit requests to support@hiresofia.com and will receive a response within 30 days.
8. Policy Review and Updates
This policy is reviewed at least annually and updated as needed to reflect changes in platform functionality, applicable law, or business practices. Material changes will be communicated to active users via email and posted at hiresofia.ai/privacy.
9. Contact
For questions about this policy or to submit a data deletion request:
Sofia Holdings LLC
Email: support@hiresofia.com
Website: hiresofia.ai