Profile and account
User account, display identity, avatar metadata, privacy choices, and public profile history.
Data Retention
Retention follows the product domains.
Tradesera retains records based on purpose: public profiles, private portal analytics, simulated trading history, rankings, agreements, support, billing, security, and provider operations.
Retention periods align with provider, payment, tax, support, privacy, and security requirements.
RecordsAuditProvider ops
Retention domains.
This keeps data policy aligned to architecture.
Simulated trading and rankings
Practice sessions, stats, rankings, digital comparisons, event history, and review records.
Agreements and support
Consent versions, billing events, support tickets, provider operations, security logs, and audit trails.
Retention guardrails.
Retention does not become a quiet privacy risk.
Purpose-based storage
Keep data only for product, legal, provider, support, security, or operational reasons.
Access control
Limit admin access and log sensitive operational actions.
Policy updates
Update retention periods when product domains, providers, or legal requirements change.
Finance data lifecycle.
Connected-finance data has its own clear disconnect and deletion boundary.
Encrypted provider access
Tradesera does not store bank usernames or passwords. Read-only provider tokens are encrypted in the secured backend and are destroyed when the institution is disconnected.
No raw statement retention
CSV, OFX, and QFX files are safety-checked and parsed in an ephemeral quarantine. Raw statement files are discarded; normalized transactions and a duplicate-detection fingerprint may be retained.
Member-controlled deletion
Disconnecting stops provider access while leaving normalized history available. A separate confirmed deletion permanently removes that institution's accounts, transactions, and sync jobs. Tradesera retains only a minimal append-only deletion tombstone for security and audit evidence, without provider credentials or transaction details.
AI connection records.
The assistant keeps authorization records long enough to operate connections, detect replay, investigate abuse, and support revocation.
Requests, codes, and expired tokens
Expired authorization-code and access-token hashes, and incomplete expired connection requests, are removed after one day. Completed connection requests are removed after 30 days. Consumed refresh-token hashes remain through their original expiry so replay can revoke the related grant.
Revoked and expired grants
Revoked or expired connection grants are removed after 180 days once their dependent authorization records have cleared. Active grants remain available so members can view and revoke their connections.
No assistant response archive
The assistant reads current Tradesera records and does not create a separate assistant database archive of report responses. A connected AI provider may retain the response in conversation history under that provider's terms and user controls.
Retention belongs in the trust center.
It supports privacy, security, provider operations, and audits.