Data Retention and Disposal Policy

This Data Retention and Disposal Policy explains how CafeTally retains, deletes, and disposes of customer data, account data, organization data, financial data, operational records, backups, and logs.

This policy applies to data processed through CafeTally products, including team communication, mobile notifications, inventory, costing, stock check, product, recipe, receipt, expense, finance, Plaid, Square, analytics, support, and team management features.

CafeTally keeps data only for as long as reasonably needed to provide the service, maintain security and reliability, support customer-directed workflows, comply with legal obligations, resolve disputes, enforce agreements, and maintain ordinary business records.

• Customer-controlled product data is retained while the account or organization remains active unless the customer deletes it or asks us to delete it.
• Sensitive financial data is retained only as needed for connected finance features, reporting, audit trails, compliance, or customer-requested deletion workflows.
• Security, diagnostic, and operational logs are retained for limited periods based on security and reliability needs.
• Backups are retained for disaster recovery and expire through normal backup rotation.

CafeTally retention periods vary by data type and business need.

• Account data: name, email, authentication metadata, mobile sessions, registered devices, push tokens, notification preferences, MFA metadata, settings, and support communications.
• Organization data: teams, store assignments, invitations, stores, inventory, categories, forms, stock checks, manual stock status, stock reports, alerts, products, recipes, modifiers, rulebooks, reports, and activity history.
• Communication data: General channel and direct messages, photos, reactions, mentions, read state, pins, content reports, blocking choices, and moderation actions.
• Financial data: Plaid connection metadata, account metadata, transaction records, categorizations, finance audit logs, P&L, cashflow, reconciliation, receipt, and expense records.
• Integration data: Square tokens, Square merchant and location metadata, catalog, inventory, and sales sync data.
• System data: cookies, session data, analytics events, diagnostic records, security logs, and error logs.

For active accounts and organizations, CafeTally generally retains product data until the customer deletes it, disconnects an integration, closes the account, or requests deletion.

Some records, such as financial audit logs, categorization history, stock check history, and activity logs, may be retained to preserve reporting integrity while the organization remains active.

Stock lists created in the mobile app without an account are stored in the app database on that device and are not retained in CafeTally's server systems.

A user can delete individual items or entire local lists in the app. Removing the app also removes its local stock-list database, subject to the device platform's backup and restore behavior.

Account deletion does not delete a separate local stock-list database. Delete those lists in the app or remove the app if you also want to remove that device-only data.

Users can begin account deletion through the product or follow CafeTally's public account deletion instructions. CafeTally verifies the active session or requestor identity and requires explicit confirmation before deletion.

When an eligible non-owner teammate deletes an account, CafeTally removes active sessions, registered devices, push tokens, personal preferences, store assignments, and the user account after server-side verification succeeds.

Personal account deletion removes author identity references where practical but retains workplace message text and uploaded photos with the organization. Personal information embedded in those messages or photos is not automatically erased. Organization-owned stock decisions and operational records also remain with personal identity removed where practical.

An owner must transfer ownership responsibilities before personal account deletion can complete. The mobile ownership-handoff process requires the named teammate to accept before roles change, preserves business records and the existing subscription, and requires both participants to sign in again. Requests to close an organization, or cases where a safe handoff is unavailable, require a separately verified request; the mobile app does not perform an organization teardown.

CafeTally may retain limited append-only activity history and finance audit evidence after account or organization deletion when needed for security, integrity, incident reconstruction, compliance, dispute resolution, or deletion proof.

If a customer disconnects a Plaid bank connection, CafeTally stops future syncing for that connection, revokes the Plaid Item where supported, and deletes imported transactions and account metadata associated with that bank connection from active CafeTally product records.

If a customer clears all Plaid bank connections for a store, CafeTally removes the connected Plaid Items where supported and deletes imported Plaid financial data associated with those bank connections from active CafeTally product records.

When covered by account or organization deletion, Plaid-derived account metadata, transactions, categorization records, and related reports are deleted from CafeTally production systems, subject to backup expiration and legally required retention.

Deleted production data may remain in encrypted backups and limited logs for a short time until those systems rotate or expire. Backups are used for disaster recovery and are not restored to active systems except when needed for security, continuity, or legal reasons.

If a backup containing deleted data is restored, CafeTally will take reasonable steps to re-apply deletion requests where applicable.

CafeTally may retain limited information when required or permitted by law, including for tax, accounting, fraud prevention, security investigations, dispute resolution, legal compliance, or enforcement of agreements.

When a legal hold applies, affected data is retained only as long as needed for that purpose and then deleted or de-identified when the hold ends.

CafeTally uses disposal methods appropriate to the data type and storage system.

• Production database records are deleted using application-controlled hard-delete workflows or approved administrative deletion procedures.
• Communication records may be replaced with a deletion tombstone or de-identified when removing the record entirely would break organization-owned operational history or a required moderation record.
• Sensitive tokens, credentials, and financial fields are removed with their parent records or invalidated through the relevant integration provider where supported.
• Backups expire through retention schedules and secure infrastructure controls.
• Where deletion is not feasible or legally appropriate, data may be de-identified or aggregated so it no longer identifies a customer, user, or organization.

CafeTally account deletion workflows include server-side verification checks that confirm targeted account and organization records were removed before the session is cleared.

A deletion workflow that cannot prove its complete target set stops without presenting the request as completed.

For deletion requests handled outside the product, CafeTally may verify completion through administrative review, system checks, or written confirmation to the requestor.

To request deletion, access, correction, export, or additional information about data retention, contact CafeTally. We may need to verify your identity and authority over the account or organization before acting on a request.