Data Retention & Disposal Policy

Last updated: August 30, 2026 · Version 1.1

This policy describes how long WellAhead keeps the data you entrust to us, and how we securely dispose of it when it is no longer needed. It complements our Privacy Policy, Security Policy, and Terms of Service.

WellAhead is provided by CleverMind AI LLC ("CleverMind," "WellAhead," "we," "us," or "our"). This policy covers all consumer data we process, including the account, transaction, and balance data we receive from our data provider (Plaid).

1. Principles

• Minimize. We collect and keep only the data the Services need.
• Retain only as long as needed. We keep data while it is needed to provide the Services or to meet a legal obligation, then dispose of it.
• Dispose securely. When data is no longer needed, it is deleted using secure methods, including cryptographic erasure of encryption keys.

2. What we retain, and for how long

• Account, transaction, and balance data (from Plaid): retained while your account is active and the linked account remains connected, so we can provide budgeting and insights. Removed when you delete your account or disconnect the linked account.
• Derived data (categories, insights): retained with its source data and removed at the same time.
• Identity and authentication data: retained while your account is active (handled by our managed authentication provider).
• Encryption keys: per-user data keys are retained only while your encrypted data exists; they are destroyed or rotated on deletion.
• Operational logs: retained for a limited period for security and troubleshooting, and structured to avoid storing secrets or unnecessary personal data.

3. Deletion and account closure

You may request deletion of your data at any time (in the app or at security@getclevermind.com). On deletion we:

• Hard-delete the data we hold about you, including derived data and your per-user encryption keys.
• Revoke bank access at the source by removing the linked item with our data provider (Plaid item removal).

To be accurate rather than flattering: removing the item revokes access, but Plaid's own retention of previously shared data is governed by Plaid's policy, not ours. We delete everything we hold; we do not overstate control over a third party's records.

4. Disposal and backups

• Production deletion. Deleted data is removed from the production database.
• Backups age out. Encrypted backups follow a fixed retention schedule (automated daily backups with a defined retention window), after which the deleted data no longer exists in any backup.
• Cryptographic erasure. Because sensitive data is encrypted with per-user keys, destroying those keys renders the corresponding data unrecoverable.
• Key longevity. Wrapping keys are retained at least as long as any backup that references them so backups stay recoverable during their window, then retired.
• Media disposal is handled by our managed cloud providers under their own certified controls.

5. Compliance and review

This policy is written to align with applicable United States consumer data-privacy laws, including consumer rights to access and delete personal data. It is reviewed at least annually and whenever a material change occurs, and is versioned on each update. WellAhead is intended for users in the United States (see our Privacy Policy).

6. Contact

Questions about retention or deletion of your data? Contact:

CleverMind AI LLC
13802 N Scottsdale Rd, Suite 151-52, Scottsdale, AZ 85254-3403
security@getclevermind.com