Data Retention Policy

1. Principle

We retain personal data only as long as necessary for the purpose collected, or as required by law (e.g. tax and accounting records).

2. Typical periods

• Account & profile: while active, then up to 30 days after closure
• Transaction, invoice & tax records: as required by law (commonly up to 8 years)
• KYC & verification: duration of the relationship plus the statutory period
• Audit logs: retained for security and compliance
• Marketing consents: until withdrawn

3. After the period

Data is securely deleted or anonymised. See the Data Deletion Policy for how erasure requests are handled.

Contact

Questions about this document can be sent to our legal team. Grievances should go to the Grievance Officer for a tracked response.

• Legal: legal@utsavos.dev
• Privacy / Data Protection Officer: privacy@utsavos.dev
• Grievance Officer: grievance@utsavos.dev
• Trust & Safety: trust@utsavos.dev