Data Retention and Deletion Policy

1. Purpose

This policy defines how Athena Workflow retains, manages, and deletes personal and financial data belonging to accounting firms, their staff and their clients, in compliance with applicable data privacy laws — including the CCPA and, where applicable, the GDPR — and the requirements set by financial data providers such as Plaid.

2. Scope

This policy applies to all personal and financial data collected, stored, or processed by Athena Workflow, including:

• Firm, staff and client account information
• Bank-feed connection data obtained through the Plaid API
• Accounting data imported from QuickBooks Online and QuickBooks Desktop
• Imported bank transactions, uploaded bank statements and the transactions extracted from them
• Financial statements, closed-period snapshots and journal entries
• Activity logs and audit trails
• Uploaded documents, attachments and signed forms
• Billing records, invoices and payment references

3. Data Categories and Retention Periods

4. Financial Data from Plaid

4.1 Access token lifecycle

• Plaid access tokens are stored in encrypted form and are valid only while the client has an active bank connection.
• When a client disconnects a bank account, the stored access token is removed and no new financial data is fetched from that connection.
• The removal of the access token is immediate and permanent. Reconnecting creates a new token under a new consent record.

4.2 Imported transaction data

• Bank transactions and account data already imported before a disconnect are retained in the client's account for operational and accounting continuity.
• This retention is disclosed to the client in the consent step shown before every bank connection:

You can disconnect your bank account at any time. Previously imported data will remain in your account.

• Clients may request deletion of their imported transaction history by submitting a data deletion request (see Section 6). The firm can also delete the data of a single connected account from Source & Statement Control.

5. Automated Deletion on Account Removal

Deletions are performed by the platform, never by hand. Before a client or firm is deleted, the person deleting sees a destroy preview listing every dependent record that will go with it, and the deletion itself is written to the audit log in full (who, what, how many records). The following data is removed:

Staff account deletion removes:

• User profile and credentials
• Role permissions, access overrides and client assignments
• Billing rates
• Job assignments and time-tracking records
• Comments and uploaded attachments authored by the user
• Address records

Client account deletion removes:

• Client profile, contact information and client-portal credentials
• All associated jobs, tasks and time entries
• Comments, uploaded documents, attachments and signed forms
• Ownership and entity records that belong only to that client
• Bank-feed connections, encrypted access tokens and imported transactions
• Uploaded statements, extracted transactions, financial statements and journal entries

Preserved on account deletion:

• Audit, consent and deletion logs (for regulatory compliance; retained as a record of what was removed)
• Issued invoices and payment records required for tax and accounting obligations
• Aggregated or anonymized reporting data that cannot be linked back to an individual
• E-mail addresses on the bounce-suppression list, so that a deleted address is never mailed again

6. Consumer Rights and Deletion Requests

Firms, staff and clients have the following rights regarding their data:

6.1 How to submit a request

• E-mail our team at [email protected]
• Use the in-app settings to disconnect bank accounts, or ask your accounting firm to delete your client account

6.2 Response timeline

• Deletion and access requests are acknowledged within 5 business days.
• Requests are fulfilled within 30 days, in compliance with applicable privacy law requirements.
• Where a legal hold, an open accounting period or a regulatory obligation prevents immediate deletion, the requester is notified and the data is flagged for deletion at the earliest permissible date.

7. Data Minimization

Athena Workflow collects only the data necessary to provide the contracted service:

• Plaid access is scoped to the minimum products required (account identifiers, balances, transactions and — only where the client opts in — statements).
• Passwords are never stored; only salted cryptographic hashes are retained.
• Bank-feed access tokens and third-party integration credentials are encrypted at rest with AES-256 (see the Information Security Policy).
• Uploaded files are validated by type and size before they are accepted, and identical files are stored once.

8. Third-Party Data Processors

Data may be processed by the following sub-processors, each bound by its own data processing agreement and privacy policy:

9. Policy Review

This policy is reviewed at least annually, or upon:

• Changes to applicable data privacy laws
• Changes to data processing practices or third-party processors
• Significant changes to the platform's data collection scope

Material changes are communicated to firms through the application and on this page.