This policy exists to:

• Ensure compliance with applicable data privacy laws including applicable U.S. state privacy laws and regulations
• Minimize data retention to only what is necessary for legitimate business, legal, or contractual purposes
• Protect user privacy by ensuring timely and secure disposal of data no longer required
• Fulfill obligations to third-party data providers including Plaid, Alpha Vantage, and Stripe

This policy applies to:

• Personal data provided by users of the Bidness platform
• Financial data retrieved via third-party APIs (Plaid, Alpha Vantage)
• Subscription and billing data processed via Stripe
• Platform usage, analytics, and log data

All electronic data subject to disposal shall be deleted using secure methods appropriate to the storage medium:

• Database records: Hard deletion via Supabase; soft-deleted records permanently purged after applicable retention period
• API response data: Ephemeral data (Plaid, Alpha Vantage) is not persisted to storage and is discarded after each session
• Cached data: Redis/Upstash cache entries expire automatically per configured TTL and are not backed up
• Backup data: Supabase automated backups are retained per Supabase’s standard backup retention policy and overwritten on a rolling basis

Data held by third-party processors is subject to their respective data retention and deletion policies. Ember Media LLC will submit deletion requests to third-party processors as required upon user account deletion or upon expiry of applicable retention periods.

Users of the Bidness platform have the right to request deletion of their personal data. Upon receiving a verified deletion request:

• Ember Media LLC will process the request within 30 days
• User account data will be permanently deleted from Supabase
• Associated trading history, preferences, and usage data will be purged
• Billing records will be retained for the period required by applicable financial regulations (7 years)

Deletion requests may be submitted to support@askbidness.com.

This policy will be reviewed at minimum every six months, or upon:

• A significant change in the nature of data processed by Ember Media LLC
• A change in applicable law or regulatory requirement
• A material change in third-party data processor relationships
• A data breach or security incident involving retained data

A scheduled check also flags any policy page that has not been reviewed in 90 days and emails the policy owner, so an overdue review is noticed rather than assumed.

Any exceptions to this policy must be approved in writing by the CEO of Ember Media LLC and documented with a rationale, applicable legal basis, and defined end date for the exception.

Questions regarding this policy should be directed to: