Owner: Security officer Effective date: 2026-07-19 Review cadence: Annually, or after any regulatory change affecting retention obligations
Defines how long WealthY retains each category of data, how it is deleted at end of retention, and how customer-initiated deletion requests are handled. Maps to SOC 2 TSC C1 (Confidentiality) and P4 (Retention + Disposal). Governs compliance with PIPEDA §4.5 (retention limits) and CIRO NI 31-103 s.11.5 (7-year regulated-record retention).
WealthY's retention posture is driven by three competing forces:
When rules conflict, regulatory retention wins over PIPEDA minimization (i.e. we retain records for the 7-year minimum even after a customer asks us to delete them, if CIRO requires them).
| Category | Examples | Retention | Deletion trigger | Notes |
|---|---|---|---|---|
| Client PII (contact, DOB, SIN) | clients, client_kyc |
Until customer relationship ends + 7 years | Firm/dealer requests deletion, AND 7 years elapsed | CIRO NI 31-103 s.11.5 |
| KYC + suitability records | client_kyc, client_kyc_history |
Same as above | Same | Must include all revisions |
| Meeting transcripts + notes | meeting_intelligence, meeting_kyc_proposals |
Same as above | Same | Regulatory record of advice given |
| Contact log entries | contact_log |
Same as above | Same | Includes emails, calls, meetings |
| Portfolio holdings + accounts | accounts, holdings, account_value_history |
Same as above | Same | Regulatory holding record |
| Advisor notes + tasks | advisor_notes, advisor_tasks |
Same as above | Same | Documentation of advisor activity |
| Compliance records (audit log) | admin_audit_log, audit_log |
7 years from creation | Automated purge at 7 years | Immutable while in retention |
| Support tickets + comms with WealthY | Zendesk / email inbox | 3 years from resolution | Automated (manual today) | Not regulated, sensible business norm |
| Marketing consent + broadcast log | broadcasts, consent flags on clients |
3 years or until consent withdrawn | Consent withdrawal | CASL requires proof of consent |
| Prospect data (Apollo enrichment) | prospects |
2 years from last contact OR until requested deletion | Business-not-required + PIPEDA | Not regulated; minimize |
| Deleted-client tombstones | clients_deleted_marker |
Indefinite (metadata only, no PII) | Never | Prevents ID re-use |
| User authentication data | Supabase Auth auth.users |
Until account deletion + 1 year | User deletes account | 1-year grace for reactivation |
| Session tokens + refresh tokens | Supabase JWT + refresh | Access token 1 hour (Supabase default); refresh token until the session ends: sign-out, 30 minutes idle in an open tab, or the nightly sweep (29 days of age or 1 hour unused), which reports only until it is switched on | Sign-out, idle lock, nightly sweep | Deleted when the session ends |
| OAuth grants (Gmail/Outlook) | Encrypted OAuth tokens | Until user revokes | User revokes in-app or at provider | Deleted immediately on revoke |
| Firm/dealer settings | firms.branding, firms.integrations |
Duration of contract + 90 days | Contract termination + grace | For contract disputes |
| System backups (PITR) | Supabase automated backups | 30 days (Pro tier PITR window) | Automatic rollover | Cannot be selectively purged |
| Cold-storage backups | S3 (once implemented) | 12 months rolling | Automatic rollover | For DR |
| Application logs (Vercel) | Function invocation logs | 24 hours (Vercel default) | Automatic | Not archived long-term |
| Vendor communication + procurement docs | Internal | 7 years from contract end | Manual | Business record norm |
| HR records (employees + contractors) | Signed policies, offboarding logs | 7 years from departure | Automated | Provincial employment law |
| Regulator communication | Any correspondence with CIRO, OPC, provincial | Indefinite | Never | Legal necessity |
| Public marketing content | Blog posts, published policies | Indefinite (versioned) | Never | Historical record |
Automated purges (built; report only until switched on):
- One rules table says, for each kind of data, the table, the date that starts the clock, the period, and the legal holds that keep a row (an open KYC, an active client, an email linked to a client, an open deal, an unsubscribe record, an account deletion request)
- A nightly job counts the rows past their period for every rule and records the counts in admin_audit_log; it deletes nothing until it is switched on, and then only for rules whose period is published in section 3
- Rules whose period is not yet decided (crash reports, trashed and departed-mailbox mail, email events, webhook logs, AI call log, sign-in events, prospects) are counted every night and stay off until the number is approved and added to section 3
- Files under a purged row are removed too, and every enforced run is logged to admin_audit_log
Manual deletion (customer request): 1. Firm admin submits deletion request via support ticket or in-app 2. WealthY confirms request from an authorized firm contact 3. Data is exported (if requested) and returned to customer 4. All records outside regulatory retention (§3) are anonymized within 30 days 5. Records inside regulatory retention are marked "customer-terminated" but retained for the 7-year period 6. Confirmation sent to customer with a deletion report
Data subject rights (individual PIPEDA request): 1. Individual submits access, correction, or deletion request 2. Request is routed via the individual's firm (WealthY does not process directly except at customer direction) 3. Firm handles the request within PIPEDA's 30-day window 4. WealthY provides tooling and support (data export, targeted deletion) 5. Where regulatory retention prevents deletion, individual is informed of the reason and the anticipated deletion date
Backups cannot be selectively purged. When customer data is deleted per §4, the underlying backups still contain the data until they roll off (30 days for PITR, 12 months for cold backups).
If a data subject specifically requests deletion from backups:
- WealthY notes the request in admin_audit_log
- Data becomes inaccessible via normal query paths immediately
- Backup data is not restored to production after that point
- Customer / individual is informed that full backup rollover completes within 12 months
Every deletion generates:
- An entry in admin_audit_log with actor, subject, and timestamp
- A deletion certificate returned to the requesting customer
- Confirmation email to the individual (if applicable and permitted)
Deletion certificates are retained for 7 years as evidence.
I have read and understood this Data Retention Policy.
Signed: ___ Date: _
1001536620 Ontario Corp., carrying on business as WealthY · Ownership and legal information