E1 Unico Corporation

1. Scope

This policy governs the retention and disposal of all data collected, processed, or stored by E1 Unico Corporation and the UnicoOS platform, including:

• Consumer financial data received from the Plaid API (account balances, transactions)
• Personally Identifiable Information (PII) — names, emails, phone numbers, addresses
• Business records — invoices, contracts, payment records
• Authentication data — user accounts, session tokens, access logs
• Communications data — SMS logs, email logs, call records
• System and security logs — application logs, access audit trails

2. Data Retention Schedule

3. Consumer Financial Data — Plaid-Specific Rules

Consumer financial data received from the Plaid API is subject to enhanced retention controls in compliance with Plaid's Developer Policy and GLBA:

• Access tokens: Plaid access tokens are stored encrypted (AES-256) and revoked immediately when a user disconnects their bank account via the UnicoOS dashboard or submits a deletion request
• Transaction data: Bank transaction records are retained for the duration of the active account to support the Banking & Accounting features — and purged within 90 days of account closure
• No secondary use: Financial data received from Plaid is used solely to provide the Banking & Transactions features within UnicoOS — it is never used for advertising, sold to third parties, or shared beyond what is required to operate the service
• User-initiated deletion: Users can disconnect their bank account and request deletion of all associated financial data at any time — processed within 30 days

4. Data Disposal Procedures

4.1 Secure Deletion — Database Records

• When a user account is closed or data reaches end of retention, records are permanently deleted from the Neon PostgreSQL database using hard deletes (not soft deletes)
• Associated Plaid access tokens are revoked via the Plaid API before deletion to terminate data access at the source
• Cascading deletes ensure all child records (transactions, connections, logs) are removed with the parent record

4.2 Secure Deletion — Backups

• Database backups are automatically rotated on a 30-day cycle by Neon — older backups are permanently deleted by the provider
• When a user requests immediate data deletion, the deletion is applied to the live database. Backup copies are purged at the next backup rotation cycle (within 30 days)
• Users are notified that backup purging may take up to 30 days to complete

4.3 Secure Deletion — File Storage

• Uploaded documents and files are permanently deleted from storage when the associated record is deleted
• Deletion is verified — storage provider confirms successful removal before the deletion request is marked complete

4.4 Physical Media

• E1 Unico Corporation does not operate physical servers — all data is stored in cloud infrastructure
• Physical media disposal is handled by SOC 2 certified infrastructure providers (Neon/AWS) in accordance with NIST 800-88 media sanitization guidelines

5. User Rights and Deletion Requests

• Users may request deletion of their data at any time by emailing Unico@E1Unico.com or using the account deletion feature in UnicoOS Settings
• Deletion requests are acknowledged within 5 business days and completed within 30 days
• Data subject to legal hold (e.g., tax records, legal disputes) is retained for the applicable legal period before disposal
• Users receive written confirmation upon completion of their deletion request

6. Policy Review and Enforcement

• This policy is reviewed annually by the CEO and updated to reflect changes in applicable law, Plaid Developer Policy requirements, or business operations
• Enforcement is built into the UnicoOS platform architecture — retention periods and deletion workflows are automated where possible
• Any identified non-compliance with this policy is treated as a security incident and remediated within the applicable SLA
• Policy review dates and changes are documented and maintained for audit purposes

7. Applicable Laws and Regulations