Data retention policy of Allied Technology Consulting Group, Corp. Defines how long we retain each information category and on what legal grounds.
1. Principles
- Minimization: we collect only what is necessary for the stated purpose
- Limited time: we delete when no longer needed and there is no legal retention obligation
- Pseudonymization: when possible, we anonymize identifiers before final deletion
- Audit trail: we log mass deletions in activity_log
2. Retention table
| Data type | Retention | Legal basis |
|---|---|---|
| Pre-flight Network Checks (IP, location, optional contact) | 12 months | Operational + legitimate interest |
| Resource leads (downloads with email capture) | 24 months | Marketing related to expressed interest |
| Companies — legal and incorporation data | 7 years | IRS Tax Records (US) + PR Hacienda + PR Department of State |
| Contacts — people associated with a company | 7 years after last engagement | FinCEN BOI rule + KYC compliance |
| Locations | 7 years | Tied to tax records |
| Account applications | 7 years | IRS + commercial audit trail |
| Activity log (polymorphic audit trail) | 5 years | Internal audit + incident investigation |
| Server HTTP logs | 12 months | Security + debugging |
| Postgres automatic backups | 30 days rolling | Disaster recovery |
| Resend transactional email logs | 90 days | Deliverability monitoring |
3. Deletion on request (right to be forgotten)
We accept deletion requests sent to [email protected]. Some exceptions where we cannot immediately delete:
- Data subject to legal retention obligation (7-year tax records IRS/PR Hacienda)
- Data needed to defend Allied against legal claims
- Data from approved account applications (tied to signed contracts)
In those cases, we may pseudonymize the data (e.g. replace name with hash) keeping only what is legally required. We respond within 30 calendar days.
4. Automatic deletion
- Network Checks > 12 months: automated monthly cron deletion
- Resource Leads > 24 months: monthly deletion
- Activity log > 5 years: annual deletion
- HTTP logs: compressed rotation at 30 days, deletion at 12 months
5. Data we do NOT retain
- Full SSN numbers — only last 4 digits for sole proprietorships
- Credit card numbers — Allied does not collect them via web
- Bank data — only collected via separate encrypted channel in post-approval onboarding
- Passports, personal IDs — not applicable to B2B web onboarding
6. Contact
[email protected] · 787.705.0555.