| Data class | Retention | Basis |
|---|---|---|
| Uploaded documents (completed cases) | 12 months after completion, then deleted | Customer access to completed documents |
| Uploaded documents (abandoned cases) | 30 days after last activity, then deleted | Minimization |
| Identity images (ID front/back, selfie) | 90 days after verification, then deleted | Fraud prevention; O. Reg. 431/20 session evidence |
| Session records (date, time, participants, ID method, location statements) | 7 years | Commissioner / notary record-keeping |
| Receipts and invoices | 7 years | Tax and accounting |
| Marketing consent records | Duration of consent + 3 years | CASL evidence |
| Analytics events | 25 months | Product improvement (consent-based) |
Deletion is automated by a scheduled job and each deletion is written to the audit log. You may request earlier deletion of documents you uploaded, subject to record-keeping requirements.