HAVEN LEGAL
Data Retention & Deletion Policy
Purpose
Haven retains only the data reasonably needed to provide its budgeting service, protect accounts, meet applicable obligations, resolve disputes, and enforce its agreements. This policy applies to Haven’s application, database, financial-data connections, authentication records, notifications, logs, and service providers.
Retention schedule
Active account data. Budgets, bills, goals, manually entered transactions, connected-account information, and imported financial data are retained while a consumer maintains an active Haven account.
Financial connections. Encrypted Plaid access tokens, imported financial data, and connection records are retained only while the related connection and Haven account remain active. Disconnecting or deleting an account removes Haven’s local connection records and requests removal of the related Plaid Item.
Authentication and security records. Sign-in, password-reset, and account-verification codes expire after ten minutes and are deleted after successful use. Security records and non-identifying account-deletion audit records may be retained for up to two years for abuse prevention, security investigation, and deletion-verification purposes.
Backups and vendor records. Haven reviews managed-service backup, log, and email retention settings quarterly. Deletion from managed backups follows each provider’s documented backup lifecycle.
Deleting an account
Consumers can delete their account in Haven’s Account & Security screen. Haven requests removal of connected Plaid Items, deletes the user record and connected application data, ends active sessions, and retains only a non-identifying deletion-audit entry for up to two years.
Review and exceptions
The Haven owner reviews this policy and its implementation quarterly, and reviews the policy itself annually or after a material change. Any retention exception must be documented with its purpose, owner, review date, and expiration date.
Contact
For questions or a privacy request, email [email protected]. Read Haven’s Privacy Policy for more detail.
This policy describes Haven’s operating controls and is not legal advice. Compliance with applicable privacy law depends on Haven’s jurisdiction, data practices, vendor settings, and legal obligations.