Last Updated: October 19, 2026 — Private in-app feedback retention and deletion are specified in §3.11. Prior revision: Section 3 is extended with Group payment audit records (a tamper-evident audit log of every change to a group's payment labels and slots, kept for 7 years to satisfy tax and financial-record obligations) and Personal-information detection signals (small hashed signals we keep to review and improve our pattern detection, kept for 2 years for safety and abuse-prevention purposes). Both stores are registered in the deletion / anonymization job and are subject to the same completion check — a failed sweep parks the request in a held state and never falsely reports completion. The §4 cascade adds the two new stores; the audit store uses anonymize in place (the identifying details are replaced with one-way placeholders, the row stays) so the audit history of every group's payments remains intact while no personal information about you remains recoverable, and the detection-signal store is fully anonymized. Both stores use cryptographic hashing with a key kept on our servers. Cross-references to legal/privacy-policy.md §12, legal/internal/records-retention-schedule.md §3.16–§3.17 are added in §3.10. No other sections changed.

Plain-English Summary. When you close your Allospend account (or when our legal record-keeping period ends), we delete the personal information we hold about you from our production systems within 30 days, from our backups within 90 days, and we never use deletion as an excuse to withhold records we are required by law to keep (like anti-money-laundering and tax records). Group memberships are anonymized, NFC stickers are remotely deactivated, and outstanding payments must be settled before the account closes. Group-collection audit records and detection signals are governed by their own retention floors (7 and 2 years respectively) and are anonymized in place — not deleted — when you close your account, so the audit history remains intact while no personal information about you stays recoverable.

Plain-English Summary. When you close your Allospend account (or when our legal record-keeping period ends), we delete the personal information we hold about you from our production systems within 30 days, from our backups within 90 days, and we never use deletion as an excuse to withhold records we are required by law to keep (like anti-money-laundering and tax records). Group memberships are anonymized, NFC stickers are remotely deactivated, and outstanding payments must be settled before the account closes.

1. Purpose and Scope

This Data Deletion Procedures document ("Procedures") is published by Allospend Technologies LLC ("Allospend," "we," "us," "our"), the operator of the Allospend consumer brand and the Allospend iOS mobile application. It describes the technical and organizational steps Allospend takes to delete personal information when a triggering event occurs, in compliance with:

• California Consumer Privacy Act / California Privacy Rights Act — Cal. Civ. Code §§1798.105, 1798.130, and 11 CCR §7060 et seq.;
• EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") — Articles 5(1)(e), 17, and 19;
• UK Data Protection Act 2018 and UK GDPR;
• Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §6801 et seq. — financial-institution record-keeping obligations;
• Bank Secrecy Act ("BSA") / Anti-Money-Laundering laws — 31 U.S.C. §5311 et seq., 31 CFR §1010.430, and 12 CFR §21.11 (bank-record retention);
• Internal Revenue Code §6501 (statute of limitations on assessment) and IRS Publication 552 (record-keeping guidance).

Capitalized terms not defined here have the meaning given in the Privacy Policy.

2. Triggers for Deletion

Allospend initiates the deletion procedures upon any of the following triggers:

• Account-closure request. A request to close the Allospend account, submitted from the account settings in the iOS app or by emailing privacy@allospend.app.
• Data-subject request. A verifiable consumer request to delete personal information under CCPA §1798.105 or GDPR Art. 17, including the right-to-be-forgotten claims.
• Automatic inactivity purge. No login, transaction, or active support interaction for 24 consecutive months, after which we send two warnings (at 18 months and 23 months) and then initiate closure. This is consistent with the storage-limitation principle in GDPR Art. 5(1)(e).
• Sanctions match. A positive match against the OFAC Specially Designated Nationals ("SDN") List, the U.S. Department of Commerce Denied Persons List, the UN Security Council Consolidated List, or any equivalent national or supranational sanctions list, in which case the account is suspended and data is retained and disclosed only as required by the Office of Foreign Assets Control ("OFAC") regulations at 31 CFR Part 501.
• Regulatory order. A binding order, subpoena, or warrant from a U.S. federal or state court, regulator, or law-enforcement body requiring deletion or restriction of personal information.

3. Data Inventory to Delete

The deletion procedures cover every category of personal information collected and processed through the Allospend service. The inventory below mirrors the categories described in our Privacy Policy.

3.1 Account and Identity Data

• Account email address, password (rendered unrecoverable — we hold only the salted-and-hashed verifier), display name, profile photo, phone number, date of birth, residential address (if collected for tax or KYC purposes).
• KYC verification artifacts provided to Stripe Identity or Plaid (see Section 4) — government ID images, selfie, document metadata, address proof. KYC artifacts are deleted by the KYC vendor under their own retention policy; we delete only the reference IDs and verification status fields stored in our database.

3.2 Biometric Data

• Biometric templates generated by Apple Face ID, Touch ID, and Passkeys. These are stored only locally on the device Secure Enclave and are never transmitted to our servers. When the account is deleted, we instruct the iOS app to clear the local biometric opt-in flag; the device-side templates themselves are owned and controlled by Apple and are destroyed automatically when the user disables the biometric or uninstalls the app (see our Biometric Information Notice for the full treatment).

3.3 Financial Data

• Wallet balances, transaction history (NFC payments, Cash App, Venmo, PayPal, Apple Pay routing metadata, withdrawals), recurring-expense configurations, group expense records, and aggregate financial analytics.
• We retain no more than 5 years of transaction history in compliance with the BSA / AML record-keeping rule (31 CFR §1010.430) and GLBA safeguarding requirements, even after account closure; the 7-year IRS retention overrides for any transaction that affects a tax-reportable event under IRC §6501.

3.4 Group and Social Data

• Memberships in NFC payment groups, expense splits, owed balances, settlement status, and direct messages sent inside group threads. Group members are notified via in-app message and email that a participant has left (subject to the notice opt-out on the requester's behalf).

3.5 NFC Sticker Records

• Sticker identifiers purchased, paired, and assigned to groups or vehicles. Deletion of an account triggers remote deactivation of any NFC sticker identifiers registered to that account (Section 7).

3.6 Communications

• Support emails and chat transcripts sent to support@allospend.app and forms handled by our transactional email provider or our in-app Help Center are deleted when the underlying support ticket is closed and any post-closure retention window has expired.
• Marketing emails sent through our newsletter provider are deleted from mailing lists within 24 hours of an unsubscribe request or account closure.

3.7 Smart Notes AI Data

• Prompts and outputs generated by the Smart Notes feature, which is processed through OpenAI, Anthropic, or Google Cloud AI under zero-retention / "data not used to train public models" terms. On account closure we issue a deletion request to the relevant AI provider under their account-data deletion API and delete the prompts, outputs, and intermediate embeddings we store.

3.8 Device Tokens

• Push tokens registered with OneSignal for the iOS app.
• Sign-in credentials from Apple "Sign in with Apple" and Google "Sign in with Google."

3.9 Marketing and Analytics

• Pseudonymized analytics events tied to the user's identifier. The identifier is deleted; aggregated, non-identifying analytics may be retained in aggregate form indefinitely.

3.10 Group payment audit and detection-signal stores (added 2026-09-16)

• Group payment audit records. An append-only log of every change to a group's "For" label or payment slot — who edited it, when, and on which device. Each row carries a keyed cryptographic digest of the relevant identifiers, the actor user, the group, the request id, and the timestamp. The row also carries the retention period, the lawful basis (tax-and-financial-record obligation), the deletion behavior (anonymize in place), and an automatic expiry timestamp. Retention period: 7 years. When you close your account: the row is anonymized in place rather than deleted — the identifying fields are replaced with one-way placeholders and the timestamp of the anonymization is stamped. The append-only history stays intact; no personal information about you is recoverable from the row. See legal/privacy-policy.md §12 and legal/internal/records-retention-schedule.md §3.16.
• Personal-information detection signals. When our scanner detects a possible email, phone, credit-card number, or similar pattern in a stored group label, we record a small hashed detection signal so we can review and improve our pattern detection over time. Each signal carries the same keyed cryptographic digest, the matched patterns, the group, the actor, and the timestamp. Retention period: 2 years for safety and abuse-prevention purposes. When you close your account: the signal is anonymized (no original text recoverable). See legal/privacy-policy.md §12 and legal/internal/records-retention-schedule.md §3.17.
• Apple Pay quote snapshots (the exact cents of every fee calculation, including the per-link fee share, the platform fee, and the net amount paid to the organizer) are part of the financial record (§3.3) and are retained for the seven (7) year financial-record period. They are not user-entered free text and carry no personal information beyond the per-link cents math.

3.11 Private In-App Feedback and Organizer Contribution History

Your private in-app feedback, optional diagnostics, and personalized fix notices expire 30 days after server receipt. Deleting a report removes its text, preview, diagnostics, collection context, network hash and resolution content immediately. A minimal record containing only account/report/operation identifiers, payload hash, deletion status and timestamps remains for 24 hours after deletion to recognize delayed retries. Repeating deletion does not extend that period. Content becomes unavailable at expiry independently of the database's asynchronous physical cleanup.

The account-erasure job removes owned feedback, replay records and organizer contribution history, clears personal count projections, and invalidates affected aggregate counts. It also removes approval-actor references separately from report ownership. Account write guards prevent stale retries and workers from adding these records after erasure. Retained owned feedback and contribution history are included in the account data export, with explicit continuation cursors where additional pages are needed. The separate statutory financial-record schedules still apply to financial records.

The app also clears its protected pending-feedback copy on sign-out, account replacement or successful in-app account deletion. Pending copies have a 24-hour logical retry deadline and are physically cleared when expiry is detected while the app can execute and access Keychain. Offline or powered-off devices cannot be remotely guaranteed immediate local cleanup; stale submissions remain subject to server account-erasure fences. No feedback body is kept in UserDefaults. Feedback abuse-control counters contain only hashed identifiers/timestamps and expire within at most one hour after the last admission check, separately from content and replay records.

Content-free feedback reviewer-access records expire with the report, no later than 30 days from server receipt, and are deleted when you delete the report or erase your account. They identify authorized access without retaining the feedback content. Erasing a reviewer account also clears that reviewer identity from access records belonging to other retained reports.

4. Cascading Deletion Across Sub-Processors

We instruct each sub-processor to delete or return the relevant personal data in accordance with our Data Processing Addendum and the underlying vendor terms. The deletion cascade executes as follows:

The cascade runs as a coordinated deletion job with explicit completion checkpoints and retry-with-backoff.

5. Verification of Deletion

After the deletion cascade completes, Allospend performs a verification pass:

1. Database re-scan. A nightly compliance job re-runs the MongoDB deletion filter against the closed user set; any residual document is reviewed by the Privacy Officer and either deleted or moved into the documented retention-exception bucket.
2. Search-engine deindexing. Public-profile pages that no longer exist return HTTP 410 (Gone).
3. Receipt delivery. The Privacy Officer emails a "Deletion Complete" receipt to the registered email within 14 days of the cascade finishing. The receipt identifies the categories deleted and the categories retained under the retention exceptions (Section 6), with a clear legal citation for each exception.

6. Retention Exceptions

Allospend does not delete, and instead retains under controlled-access retention buckets, the following categories of personal information after account closure or a delete request, where retention is required or permitted by law:

6.1 Bank Secrecy Act / AML Records — 5 Years (31 CFR §1010.430(d))

We retain any record of funds transmittals, currency-transaction reports, suspicious-activity reports, and the underlying account information sufficient to reconstruct the transaction, for five years from the date of the transaction or the date the report was filed, whichever is later. After the 5-year period, the records are deleted.

6.2 Tax Records — 7 Years (IRC §6501; IRS Pub. 552)

We retain tax-reportable transactions (1099-K-eligible gross payments and similar records) and the related party information for seven years from the date of the transaction. After the seven-year period, the records are deleted.

6.3 Fraud Investigations — 3 Years After Closure

If the account has been flagged for suspected fraud, sanctions exposure, or anti-money-laundering review, we retain internal investigation notes, chargeback records, and dispute logs for three years after the account is closed, in accordance with the consumer-fraud statute-of-limitations in most U.S. states and the SAFE Act record-keeping obligations. Records are accessible only to the Compliance Officer and the legal team.

6.4 Pending Litigation Hold

If the user is involved in active litigation (or is reasonably anticipated to be) at the time of a delete request, Allospend issues a litigation hold that suspends deletion of the relevant records until the hold is released by counsel.

6.5 Required by Other Law

Where a federal, state, or foreign law requires retention, we retain for the period required and then delete.

7. Group Impact and Outstanding Payments

Closing an account that has open group obligations triggers a structured handoff:

1. Outstanding balances. If the user owes money on any expense split at the time of deletion, the request to close the account is paused and the user is prompted to settle before closure. We do not delete financial records that would extinguish a group member's claim against another user.
2. Owner-of-group transfer. If the user is the sole owner of an NFC payment group or expense group, ownership is automatically transferred to the longest-tenured active member; if no such member exists, the group is marked for handoff, no new spending is permitted, and the group's pool balance is refunded to the source payment instrument within 14 days.
3. Anonymization in remaining groups. Where the user was a member (not owner) of groups still active after closure, the user is anonymized to other members (Former Member placeholder, profile picture removed, display name replaced with the initials F.M.); the user's individual transactions remain visible only to the group owner for accounting purposes.
4. Notification to other members. Other group members are notified by in-app message that a member's account has been closed and that any unpaid balances owed by or to that member are now subject to the outlined retention rules.

8. NFC Sticker Deactivation

When an account is closed:

1. We call our sticker-authority service to deactivate every NFC sticker identifier registered to the user.
2. The deactivation is logged to an immutable audit table; even if the user later re-opens an account, NFC stickers deactivated under a prior closure are not automatically re-paired — the user must purchase or re-register stickers.
3. Apple Wallet passes issued for the deactivated stickers are revoked by the device side on the next NFC interaction (the Apple Wallet framework marks the pass as no longer active and refuses to transmit the underlying token).
4. Where the sticker is associated with a vehicle or a business asset, the deactivation does not affect the physical sticker — the user is instructed to physically destroy the sticker; in the meantime, the sticker cannot authenticate to the Allospend network.

9. Backups and Disaster-Recovery Copies

Personal data is backed up to encrypted, append-only cold storage on a 30-day rotation. Backups are not modified by the live deletion cascade. Within 90 days of account closure, the affected backup snapshots are rotated out and securely overwritten using NIST SP 800-88 Rev. 1 (Clear or Purge, depending on the storage class). Verification: we run a "post-rotation audit" that confirms the user is not present in any remaining backup chain.

10. Confirmation Email and Acknowledgement

Within 14 days of cascade completion, we send a deletion confirmation email to the registered address. The email:

• restates the categories deleted;
• restates the categories retained under the documented exceptions, with the legal citation for each;
• provides a link to appeal or to request a final export;
• references these Procedures.

If a back-up rotation is still in progress at the 14-day point, the confirmation email notes the rotation timeline; a final "back-up rotation complete" notice is sent within 90 days of cascade completion.

11. Appeal

If you believe your deletion request was not properly fulfilled, you may appeal as set out in the Data Subject Request & Consumer Rights Procedures (Section 8) by emailing compliance@allospend.app within 30 days of the deletion receipt.

12. Contact Information

• Deletion requests: privacy@allospend.app
• In-app: Settings → Privacy → Privacy Data → Close Account
• Appeals: compliance@allospend.app
• General support: support@allospend.app

Allospend Technologies LLC 725 Kingsland Avenue, Suite 100 St. Louis, MO 63130 USA

© 2026 Allospend Technologies LLC. All rights reserved. Allospend and Dummii are trademarks of Allospend Technologies LLC.