Data Retention Policy
LAST UPDATED November 14, 2022
In order to keep organizations compliant with FTC Safeguard rules, Approve Owl limits retention of consumer data to 21 months after profile archiving or a maximum retention period of 25 months total per profile.
Consumers can request removal of their data from our platform before it is set for removal, as is their right by law in certain jurisdictions. We also extend that right to consumers in any jurisdiction as laws are subject to change and subject to adopt stricter data and privacy protections.
Customer Data
If customer data must be kept longer than consumer data due to regulations governing an organization, it is the organization's responsibility to export consumer data from Approve Owl to systems with more appropriate data retention policies. We offer API access and PDF packet downloads of consumer data for moving data to those systems.
Data Removed
When consumer data is set to be removed from our platform, the all data related to the individual consumer is removed from our platform including the following data:
Consumer Data
- Profile information
- Phone numbers
- Addresses
- Email addresses
- Employers and other specified income sources
- References
- Uploaded documents
- Generated and aggregated data, such as our compiled Report Card
Third-Party Data
- Bank account transactions and balances
- SentiLink scores and insights data
- Additional address metadata
- Additional phone number metadata
CRM Data
- Notes
- Appointments
- Inbound text messages
- Outbound text messages
- Logged sales data
- Applicant activity feeds
- Profile access logs
Ephemeral Data
Approve Owl also logs additional data for active consumers, but we do not consider it core to a consumer profile. This is data that would not necessarily be used for loan consideration by an underwriter.
If the data has not been enumerated above, it is considered ephemeral data. The time of the removal of ephemeral data varies based on the type. Below is a table of the minimum retention period for some data types with the max period being 24 months.
| Data Type | Minimum Retention |
|---|---|
| User Notifications | 1 week after dismissal |
| Applicant invite codes | 90 days after profile archiving |
| User Reminders | 90 days after profile archiving |
| Applicant activity stream | 90 days after profile archiving |
| Consumer portal visits and events | 90 days after event |
| Raw logged sales import files | 1 week after import |
| Raw bank account responses | 30 days after import |