Data Retention and Deletion Policy
STATUS: DRAFT v0.9 — pending legal counsel review.
Owner: Keel — Fund Manager
Effective (pending review): to be confirmed on approval
Review cadence: Annual; next review by 2027-05-27
Applies to: All personal information, fund records, audit logs, and document artifacts maintained by the firm and its service providers.
1. Purpose
This policy specifies how long the firm retains different categories of data and the process for deleting data when retention ends or when an authorized request is made. It is the operational counterpart to § 6 of the Privacy Policy and an essential control under the firm's Information Security Policy.
2. Retention Categories
| Category | Retention period | Rationale |
|---|---|---|
| Signed subscription agreements and amendments | Life of the fund + 7 years after final wind-down | SEC investment-adviser recordkeeping + IRS partnership records |
Capital-account ledger (CapitalAccountTxn) | Indefinite | Required for K-1 reconstruction and LP statements |
K-1 statements (K1Statement) | Indefinite | IRS partnership records; LP tax filings reference these in perpetuity |
| Capital-call notices and PDFs | Life of the fund + 7 years | Audit trail of LP obligation and notice delivery |
Audit events (AuditEvent) | Indefinite | Compliance evidence; supports forensic review and LP due diligence |
| Authentication logs | 7 years | Supports incident investigation |
| Bank-transaction import data and reconciliation matches | 7 years | Supports financial audit and dispute resolution |
Prospect records (Prospect) — converted to LP | Same as the resulting LP record | Conversion preserves intake narrative |
| Prospect records — not converted | 24 months from last activity | Re-engagement window; deleted thereafter unless prospect requests retention |
| Subscription drafts and abandoned booklets | 12 months from last activity | Cleanup of incomplete intake |
Marketing decks (MarketingDeck) | Retained while the deck is active; archived for 24 months after retirement | Marketing record + future reference |
Deck view session logs (DeckViewSession) | 24 months | Engagement analytics; longer retention adds no operational value |
Document templates (DocumentTemplate) | Retained while the template is in use; archived versions indefinite | Audit trail of legal document evolution |
| Email delivery metadata (via Resend) | Vendor-default (typically 30–90 days) | Vendor controls; firm receives summary not raw recipient list |
| Application server logs | 30 days at full detail; aggregated metrics indefinite | Operational debugging |
3. Deletion Procedures
When data reaches the end of its retention period, or when an authorized deletion request is honored, deletion follows this sequence:
1. Identify in-scope records: the engineering owner runs a documented query to enumerate records eligible for deletion.
2. Confirm legal hold status: any record subject to a litigation hold, regulatory inquiry, or pending audit is excluded from deletion until the hold is released.
3. Soft-delete first for entities with cascading references (Investor, Fund, FundManager, BankAccount). The deactivatedAt flag prevents the entity from appearing in user-facing views while preserving the relational integrity needed for historical reporting.
4. Hard-delete after retention expiry: at the end of the formal retention window, records are removed from the database and their associated Blob-stored files are deleted from Vercel Blob. Audit events stamped AuditEvent.action = 'Data.delete' capture the deletion (without retaining the deleted content).
5. Vendor propagation: deletion requests are propagated to vendors that hold copies (Resend, Anvil, DocuSign) according to each vendor's data-processing terms.
4. LP-Initiated Deletion Requests
LPs may request deletion of personal information by contacting the firm at the address in the Privacy Policy. The engineering owner reviews each request against this policy and applicable law:
- Granted in full when no legal, tax, regulatory, or fund-operating obligation requires retention.
- Granted in part when some records (e.g., signed subscription agreement, K-1 statements) must be retained but other discretionary data (e.g., marketing engagement metadata, optional contact fields) can be deleted.
- Denied when applicable law requires retention. The denial is documented with a written explanation provided to the LP within 30 days.
LP deletion-request activity is included in the quarterly access-review artifact.
5. Backup Retention
Database backups are retained per the Information Security Policy § 10 business continuity controls. Backups are excluded from the deletion procedures above on the principle that selective deletion from immutable backups is impractical; deleted records will age out of the backup tier naturally as the rolling backup window advances.
Backup retention windows:
- Neon point-in-time recovery (PITR): per Neon plan, typically 7–30 days.
- Off-platform snapshots (when configured): 90 days.
After a deletion is processed, the affected records remain in backups until backup expiry. This is disclosed to LPs as part of the deletion-response when relevant.
6. Vendor Data Deletion
When the firm terminates its relationship with a vendor that has held personal information:
1. The vendor is instructed in writing to delete or return all firm data per its data-processing agreement.
2. Written confirmation of deletion is obtained and filed in the engineering log.
3. The vendor inventory in the firm's internal record is updated to mark the vendor as terminated with the deletion-confirmation date.
7. Roles and Responsibilities
- Fund Manager: approves material retention changes, signs off on quarterly retention activity, decides on deletion-request appeals.
- Engineering Owner: executes retention queries, performs deletions, documents exceptions, propagates vendor deletion requests, maintains the engineering log of retention activity.
- Legal Counsel (when engaged): advises on legal-hold scope and on retention-period adjustments tied to specific regulatory developments.
8. Reporting
A summary of retention activity is included in the quarterly review artifact, covering: deletions executed by category, deletion requests received with disposition, legal holds opened/closed, and any policy exceptions.
9. Policy Review
Reviewed annually. Material updates require Fund Manager approval and counsel review where the change affects legal exposure.
Change history
- 2026-05-27 — Initial draft (v0.9). Authored alongside Privacy Policy and Information Security Policy. Pending counsel review before publication.