The Vitals Group.

Data Retention and Disposal Policy

Version 1.0 · Effective September 17, 2026 · Reviewed annually, next by September 2027 · Policy owner: Sumit Rastogi, Owner

1. Purpose and scope

This policy sets how long The Vitals Group keeps each kind of information it holds about clients, prospects and the people connected to them, and how that information is destroyed when the period ends. It applies to every system we use: our client portal ("Heartbeat"), the databases and file storage behind it, email, cloud drives, staff laptops, bank-data connections made through Plaid, and paper. It supports our Privacy Policy and our Information Security Policy, and meets our obligations as a tax return preparer under the FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557.

2. Principles

• Keep only what we need, only as long as we need it. Every category below has a defined period and a trigger that starts the clock.
• Legal holds win. If information is subject to an audit, tax examination, dispute or legal request, it is kept until the matter is closed, whatever the schedule says.
• Deletion is real. "Deleted" means removed from our active systems and from our providers' storage, not archived somewhere else; where a provider keeps backups, those age out on the provider's own cycle (currently within 30 days).
• Clients can ask sooner. A client may request deletion at any time; we honour it within 30 days except for records the law requires us to keep, and we say which those are.

3. Retention schedule

Information	Kept for	Clock starts / notes
Prospect submissions (statements or documents sent before any engagement)	90 days	From last contact. Deleted sooner on request.
Client bookkeeping records: bank and card statements, transaction data, categorized ledgers, check and deposit images, monthly reports	Engagement + 7 years	From the end of the tax year the record relates to. Matches the IRS look-back for substantial understatement and state statutes.
Tax returns and workpapers we prepared	7 years after filing	IRS Publication 4557 / Circular 230 practice.
Payroll records (wage reports, tax deposits, paystubs)	7 years	Federal minimum is 4 years (IRS) and 3 years (FLSA); we keep 7 to align with the bookkeeping records they support.
Engagement letters, consents, authorizations (including bank-connection consent)	Engagement + 7 years	Evidence of what we were allowed to do.
Bank-data connections (Plaid access tokens and account links)	Until the engagement ends or the client asks	Removed at Plaid (/item/remove) within 30 days of either. Data already received stays under the bookkeeping-records row.
Portal accounts (client and staff logins)	Disabled within 1 business day of the engagement or employment ending; deleted after the bookkeeping records they own are deleted	Password hashes and two-factor secrets are cleared at disablement.
Email correspondence with clients	7 years	Client emails can carry instructions and approvals that support the books; kept on the same schedule.
Marketing and website data (form leads that never became prospects, ad measurement cookies, scheduling records)	Up to 2 years	Or the provider's default if shorter. No statements are held here.
Application and server logs	Provider default (Render: 7 days for live logs)	Logs never contain passwords, tokens or full account numbers.
Security records: access reviews, incident notes, this policy's versions	5 years	Safeguards Rule evidence.
Backups of the production database	Provider's rolling window	Automated by the hosting provider; not a separate archive. Deleted records leave backups as the window rolls.

4. Disposal methods

• Portal and database records: deleted through the application's delete functions (which purge the statement, its transactions and its files together) or by direct database deletion by the Owner, then confirmed absent by query.
• Files in cloud storage (Cloudflare R2, Google Drive/OneDrive): deleted and then removed from trash or version history.
• Bank connections: revoked at the provider so no further data flows, then the stored access token is deleted.
• Email: deleted from the mailbox and its trash.
• Laptops and drives: full-disk encryption is on at all times; a device leaving service is erased with the operating system's full erase (cryptographic erase) before disposal or resale.
• Paper: cross-cut shredded. No client paper is kept outside the office or a locked cabinet.

5. Procedure

1. Trigger. An engagement ends, a client asks, a prospect goes quiet for 90 days, or a record reaches the end of its period.
2. Check for holds. The Owner confirms no audit, examination, dispute or legal request touches the records.
3. Return, then delete. For a departing client we first export their books and reports to them, then delete on the schedule above, starting with bank connections and portal access.
4. Record it. The date, what was deleted and by whom is noted in the client's file (kept under the security-records row).
5. Annual sweep. Each January the Owner reviews all client and prospect records against this schedule and deletes what has aged out.

6. Client requests

Any client or prospect can ask what we hold, ask for a copy, ask us to correct it, or ask us to delete it, by emailing sumit@thevitalsgroup.com. We answer within 10 business days and complete deletion within 30 days, telling the person plainly if any record must be kept longer and why.

7. Review

The Owner reviews this policy every year, after any security incident, and whenever we add a system that stores client information. Changes are dated at the top.