Data Retention and Deletion Policy

This Data Retention and Deletion Policy explains, in plain language, how long we typically keep personal data when you use the Y.O.D.O. Service and what triggers deletion.

This policy must be read alongside:

• our Terms and Conditions (which set key feature rules and deletion clocks), and
• our Privacy Policy (which explains what we collect, why, lawful bases, and your rights).

If there is a conflict, the Terms and Conditions govern how the Service operates, and the Privacy Policy governs how we process personal data. This policy is a transparency summary of retention practice.

1. Key principles

2. Definitions used in this policy

3. Retention overview

3.1 Delivered Messages (Recipient access window)

• Availability: Delivered Messages are available to Recipients for 12 months from the delivery trigger. Extensions to the access window may be available on request within the original 12-month period. See our Terms for details.
• Removal: If not accessed and downloaded within that window, they are deleted from our active systems, subject to limited retention in backups and logs as described in section 6.

3.2 Death certificates (Passing verification documents)

• Storage: The certificate is stored as a file (PDF, JPEG or PNG, up to 20 MB) in encrypted object storage (AWS S3), with metadata in our database (upload timestamp, uploader identity, verification status, resolution cause, who resolved it, and encrypted resolution notes). We do not compute or store a hash or checksum of the certificate.
• Live retention: The certificate file is held while the Account Holder's account is active. Recording the verification outcome does not delete the file; it changes a status field. There is no seven-year retention period and no 30-day timer on the certificate file.
• Removal: The file is removed from live storage when the account is deleted. Because the S3 bucket has object versioning enabled with a 365-day lifecycle on noncurrent versions, a removed certificate persists as a recoverable noncurrent version for up to 365 days after account deletion, then is permanently deleted.
• Verification log: The passing-report timeline / event-log entry (event type, actor, timestamp and an encrypted details payload) and the Persona identity-verification record (provider identifiers, encrypted extracted name, name-match result and score, status, encrypted provider session token, and the inquiry-attributes block returned by Persona webhooks) are kept while the account is live and are soft-deleted on account deletion: excluded from live queries but retained in encrypted form so we can answer a later dispute or regulator query. The raw identity-document image is held by Persona, not by Y.O.D.O.
• Metadata survivorship: Because the passing-report row is soft-deleted rather than destroyed, the fact that a certificate once existed (including who uploaded it and when) is preserved after the certificate file itself has been removed from live storage.

3.3 Non-response deletion (Account Holder silence with no Delegate action)

If a Check-in is missed and there is no Account Holder response and no Delegate action:

• Pre-deletion steps: We may begin pre-deletion steps after 30 days from T0.
• Deletion: We may delete undelivered Messages, media, and Account-operational data from our active systems after 60 days from T0.
• Pause: These timelines pause during a Care Pause. When a Care Pause ends, the deletion clock resumes from where it paused rather than restarting.

3.4 Trial ended with no payment details (non-subscribed state)

If the Free Trial ends and you do not add payment details:

• We do not charge you.
• Check-ins stop and Delegates are not contacted (as set out in the Terms).
• Retention and deletion then follow the rules for non-subscribed accounts, including the non-response and inactivity pathways described in the Terms.

3.5 Subscription ended and grace period passed (Inactive accounts)

If your subscription ends and any payment grace period has passed without resolution:

• Paid features stop and Check-ins stop (per the Terms).
• If you are not an active Delegate for anyone else, your account may become Inactive.
• We may schedule deletion of Account-operational data and undelivered Messages 30 days after the account becomes Inactive, subject to the exceptions in section 6.

3.6 Subscription status on deletion

If we delete your account under section 3.3 (T0-based deletion) or 3.5 (Inactive deletion), any paid subscription linked to that account will end at the time of deletion and we take reasonable steps to stop future renewals (including by cancelling the subscription record with our payment provider where applicable). If a renewal payment is taken after deletion due to timing or processing delays, contact Support and we will review and, where appropriate, refund that renewal payment.

4. Retention schedule

The timeframes below are typical. We may retain some data longer where necessary and proportionate for legal claims, fraud prevention, security, or compliance (see section 6).

5. Special cases

5.1 Delegate-only accounts

If you have a Delegate-only account and you have no active Delegate relationship:

• We may delete your account and associated account data after 30 consecutive days of being Inactive, as described in the Terms.

5.2 Disputes, restricted accounts, and legal holds

If an account is in dispute, under investigation, or subject to a legal request:

• We may retain relevant data for longer than the typical periods while the issue is active and for a reasonable period afterwards.

5.3 Passing reported shortly before deletion

If a Passing is reported shortly before deletion would otherwise occur:

• We may allow a limited period (up to 30 days, subject to any extensions permitted under the Terms) to complete verification, as described in the Terms.

5.4 Partner referral parameters and the 15% Partner discount

If you reach Y.O.D.O. through an approved Partner link, or you enter a Partner code when you sign up, we save a small set of details (the Partner code, plus tracking tags such as utm_source, utm_medium and utm_campaign). We use these only to apply the 15% Partner discount within the time limit set out in Schedule F of our Terms.

• How long we keep them: up to 3 months from when we first see them, matching the Schedule F redemption window.
• When the discount is used or the 3 months are up: we remove the referral details from our live systems. We keep only a short proof-of-discount note (which Partner you came from and that the discount was applied) in our billing records for accounting and refund handling.
• Auto-association at sign-up: signing up with a Partner code automatically adds that Partner to your Special Delegate list. You can remove the Partner from your Special Delegate list at any time in account settings before any verification event.
• Changing your mind: you can email info@yodo.ltd at any time to ask us to remove unused Partner referral details from your account. If you do this before the discount is applied, you will not be able to use that offer afterwards.
• Cookies: how cookies and consent work for these details is explained in Cookies Policy §6.

6. What we may keep even after "deletion"

Even after an account is deleted from active systems, we may retain limited data where necessary and proportionate for:

• Compliance with legal obligations
• Fraud prevention and security
• Dispute handling and chargebacks
• Audit and accountability (for example minimal verification event logs)

We restrict access to retained data and keep it only for as long as needed for those purposes.

7. Your choices and rights

You can request access to your personal data and exercise your rights under data protection law by contacting info@yodo.ltd. We will respond within one month of receiving your verified request. In complex cases we may extend this by a further two months and will notify you if we do.

Some deletion requests may be limited where we must retain data for legal, security, or fraud-prevention reasons (for example where a payment dispute is ongoing or we must retain audit logs).

8. Changes to this policy

We may update this policy from time to time. We will update the "Last Updated" date and may provide additional notice where changes are material.