Data Retention Policy

Version 4.2 | Last updated 30 October 2026

1. About this policy

1.1 This Data Retention Policy sets out how long Earnly Limited (company number 16183799), registered office 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our"), keeps records, the event that starts each retention period, the reason for the period, and how records are disposed of.

1.2 It applies to all personal data and other records processed by Earnly in connection with the Earnly platform (the "Platform") and the services provided through it (the "Services"), in all systems, environments, logs and backups. It binds Earnly's director, its contractors and every supplier that processes personal data for us.

1.3 It gives effect to the storage limitation principle in Article 5(1)(e) UK GDPR. Keeping personal data longer than necessary breaches that principle. Deleting a record that is under a legal hold or a statutory retention duty is equally a failure.

1.4 This policy is incorporated into the agreement between Earnly and each user (the "Agreement") under the "Documents forming part of the Agreement and order of precedence" clause of the Terms and Conditions, so the retention periods and deletion commitments it describes for users are commitments we make to them. The sections identified in clause 2.4 as internal controls bind Earnly and its suppliers and do not impose obligations on users. If there is a conflict between documents forming the Agreement, the order of precedence in that clause applies: in summary, the Privacy Policy prevails on the processing of personal data and the Open Banking Consent Notice prevails on consent to the account information service and the use of Open Banking Data. Changes to this policy that affect users are made under the "Changes to the Agreement" clause of the Terms and Conditions.

1.5 Definitions. In this policy:

1.5.1 "Account" means a user's account on the Platform, which may cover one or more companies and a personal profile;

1.5.2 "Business Day" means Monday to Friday, excluding bank holidays in England and Wales;

1.5.3 "Business User" means anyone using the Platform for a trade, business or profession, including without limitation a sole trader, contractor, freelancer, partnership, LLP, limited company or other organisation, and any individual (for example a director) acting on its behalf;

1.5.4 "Connected Account" means a UK bank or payment account that a user has connected to their Account through the Provider;

1.5.5 "Consumer" means an individual acting wholly or mainly outside their trade, business, craft or profession;

1.5.6 "Counterparty" means a person, other than the user, who is named or identifiable in Open Banking Data, for example the payer or payee of a transaction;

1.5.7 "Individual" means any natural person who uses the Platform, whether as a Consumer or as a sole trader or other Business User;

1.5.8 "Open Banking Data" means account details, balances and transaction data obtained from a Connected Account through the Provider;

1.5.9 "Organisation" means a company, LLP, partnership or other entity that is a Business User;

1.5.10 "Outputs" means the categorisations, confidence scores, tax and VAT estimates, summaries and other results the Platform generates;

1.5.11 "Provider" means Finexer Ltd (company number 12191948), which provides the account information service;

1.5.12 "Transaction-level Data" means Open Banking Data, every record derived from an individual transaction (including without limitation its categorisation, VAT treatment note, confidence score, transfer-detection result and any correction made to it), and any Output derived only from that Connected Account;

1.5.13 "Summary Outputs" means Outputs that do not reproduce individual transactions and that draw on more than one Connected Account or on information entered by the user, including without limitation tax estimates, salary and dividend totals and period summaries. Outputs derived only from one Connected Account are Transaction-level Data;

1.5.14 "User Content" means business and tax information a user enters into the Platform (for example company, VAT and payroll details and manually added items) and Summary Outputs; and

1.5.15 "Data Protection Lead" means Adam Marsh, Director of Earnly, who holds that role.

1.6 Related documents: the Privacy Policy, the Cookie Policy, the Open Banking Consent Notice, the Complaints Procedure, the Sub-processor List, the AI Policy and the Terms and Conditions.

2. Who this applies to

2.1 The retention periods in this policy apply in the same way to all users, whether they are Consumers, sole traders or other Business Users, or individuals acting for an Organisation.

2.2 Where a record relates only to an Organisation and identifies no individual, it is not personal data, but we apply the same periods so that records are handled consistently.

2.3 Personal data of Counterparties contained in Open Banking Data is kept only as part of the relevant Account holder's Transaction-level Data and is deleted with it.

2.4 Sections 1 to 4, 7, 8 and 10 describe what users can expect. Sections 5, 6, 9, 11 and 12 are internal controls that Earnly and its suppliers must follow.

3. Principles

3.1 Records are kept only while there is a defined purpose, a legal obligation or a live legal risk that requires them.

3.2 Every category of record has a fixed retention period, a trigger that starts it, and a stated basis. A period that cannot be justified must not be applied.

3.3 Retention must be enforced by automated deletion routines wherever possible, not by manual review.

3.4 Where a record is useful for analysis beyond its operational life, it must be anonymised to the standard in section 5, not kept in identifiable form.

3.5 Earnly does not keep records on a user's behalf for the user's own HMRC or Companies House purposes. Users are responsible for keeping their own business and tax records for as long as the law requires them to. The Platform lets users export their transactions as a CSV file at any time and during the 30-day Cooling-off Period described in the Terms and Conditions.

3.6 Earnly holds no physical records. All records are held electronically. Letters we receive by post are scanned into the relevant electronic record, and the paper is destroyed by cross-cut shredding within 5 Business Days of receipt.

4. Retention schedule

4.1 "Retention period" is the maximum period for which a record is kept after the trigger. Records may be deleted earlier where they are no longer needed. Periods run from the day after the trigger.

Customer and Platform records

Ref	Record type	Retention period	Trigger	Basis	Disposal
R1	Transaction-level Data for a Connected Account (Open Banking Data and records derived from individual transactions, including Counterparty data)	Kept while the connection is active. Deleted at the end of a 30-day cooling-off period after the trigger. During the cooling-off period the user can export the data as a CSV file and can reactivate the connection (by reconfirming or reconnecting it) or, after closure, reactivate the Account, in which case the data is kept. No transaction history is kept after this period	The earliest of: withdrawal of consent in the Platform or at the bank; expiry of the 90-day consent without reconfirmation; disconnection of the Connected Account (Settings, then Integrations), which also revokes the consent with the Provider; closure of the Account	Needed only to provide the Services while the user has consented. Aligned with the Open Banking Consent Notice and the Provider's End User Terms	Deletion from live systems; removed from backups when the backup set expires (section 6)
R2	Earnly's minimal record of each Open Banking consent: its scope and dates, reconfirmation, expiry and withdrawal, and the date and time of each data retrieval made under it. It contains no transaction data	6 years	End of the consent	Evidence that each access was lawful and authorised, and defence of complaints and claims about the account information service (section 5 Limitation Act 1980). The Provider keeps the authoritative consent record under its own policy (section 8)	Deletion
R3	Receipt images a user uploads	Kept with the transaction they are attached to. Deleted when that transaction is deleted under R1, within 30 days of the user deleting the image, and in any case at the end of the 30-day cooling-off period after Account closure	Deletion of the transaction or the image, or Account closure	Needed to provide the Services	Deletion from file storage
R4	User Content	Kept while the Account is open. Deleted at the end of the 30-day cooling-off period after Account closure	Account closure	Needed to provide the Services. The 30 days match the Cooling-off Period	Deletion
R5	Corrections a user makes to categorisations	A correction to a transaction is deleted with that transaction under R1. Any remaining correction rules are deleted at the end of the 30-day cooling-off period after Account closure	Deletion of the transaction, or Account closure	Needed to improve the user's own future categorisations	Deletion. The only thing that survives is the anonymised contribution in R6
R6	Merchant consensus table	Indefinitely	Contribution	Not personal data: the table meets the anonymisation standard in clause 5.4	Not applicable
R7	Account and profile data (name, email address, company details retrieved from Companies House, VAT number check results, preferences and security settings)	Kept while the Account is open. Deleted at the end of the 30-day cooling-off period after Account closure, except the fields kept in the contract record in R8	Account closure	Needed to provide the Services	Deletion of all fields not needed for R8
R8	Contract record: identity and contact details, Organisation details, the record of acceptance of the Terms and Conditions and other documents (date, time, document versions and IP address), the age and UK declaration made at signup, records of key notices sent, and the record of closure	6 years	End of the Agreement	Limitation period for contract claims (section 5 Limitation Act 1980)	Deletion
R9	Authentication data: hashed passwords, two-step verification settings and session records. Emailed one-time codes expire automatically shortly after issue and are not kept	Deleted at the end of the 30-day cooling-off period after Account closure	Account closure	No purpose survives closure	Deletion
R10	Dormant Accounts (no sign-in for 24 months)	After 24 months without a sign-in, we email the user. If the user does not sign in within 30 days of that email, the Account is closed and R1, R3, R4, R7 and R9 apply	Last sign-in	Storage limitation	As for R1, R3, R4, R7 and R9
R11	AI categorisation data: (a) the category suggested by the AI model where Earnly's rules, the user's own rules and the merchant consensus table cannot categorise a transaction; (b) AI request metadata (the time, the model used and whether the request succeeded or failed, with no content); and (c) the cleaned merchant name and amount sent to Anthropic. Earnly does not store prompts or responses separately. "Ask Earnly" is a preview that shows pre-written help content and sends nothing to any AI provider	(a) Kept with the transaction and deleted with it under R1. (b) 30 days. (c) Not kept by Earnly. Anthropic, as processor, deletes inputs and outputs within 30 days, but may keep a request flagged by its automated trust and safety systems under its Usage Policy for up to 2 years, and may keep data for longer where the law requires. Anthropic must not train its models on the data	(a) As for R1. (b) The request. (c) Receipt by Anthropic	(a) Part of the categorisation of the transaction. (b) Monitoring failure rates and investigating faults, without holding any content. (c) Anthropic's Data Processing Addendum and Commercial Terms, as described in the AI Policy and on the Sub-processor List. Any new AI provider requires 30 days' notice, a data protection impact assessment and no-training terms first	(a) As for R1. (b) Automatic deletion. (c) Deletion by Anthropic
R12	Personal data of a user found to be under 18	Account closed and data deleted without undue delay, keeping only a minimal record that the Account was closed and why, for 6 years	Discovery	Earnly does not provide Services to anyone under 18	Deletion

Communications, complaints, rights and marketing

Ref	Record type	Retention period	Trigger	Basis	Disposal
R13	Support correspondence: emails and attachments	2 years	The last message in the thread	Service quality and evidence of what was said to a user. Where the correspondence forms part of a complaint, R14 or R15 applies instead	Deletion from the mailbox
R14	Complaint records, including complaints about the account information service: the complaint, investigation, correspondence, holding replies, final response, referral to the Provider, Financial Ombudsman Service referral and outcome, and root-cause notes	6 years	Closure of the complaint (final response issued, or Financial Ombudsman Service decision, whichever is later)	Matches the 6-year limitation period and the period during which a complaint may still reach the Financial Ombudsman Service. Longer than the Provider's 3-year period for its own complaint records	Deletion
R15	Data protection complaint records under section 164A Data Protection Act 2018	6 years	Closure of the complaint	Evidence of compliance with the statutory complaints duty, and defence of claims and Information Commission investigations	Deletion
R16	Data subject request records: the request, identity checks, searches carried out, decision and response	6 years	Closure of the request	Accountability principle and defence of complaints and claims	Deletion. Copies of data disclosed are not kept beyond 30 days after the response; only a record of what was disclosed is kept
R17	Website waitlist data (name, email address, the business information given, and the record of acceptance)	Until the person creates an Account, asks to be removed, or 24 months after they joined the waitlist, whichever is first. If the person opens an Account, R7 and R8 apply instead	Joining the waitlist, Account creation or the request	Needed to invite the person to the Platform	Deletion
R18	Marketing consent records (the consent, date and time, IP address, wording and policy version shown, and the withdrawal)	While the consent is live, and 2 years after withdrawal	Withdrawal of consent or opt-out	Evidence that consent was validly obtained	Deletion
R19	Marketing suppression list	Indefinitely, holding only the email address and the date it was added	Opt-out	Needed to make sure a person who has opted out is not contacted again	Not applicable while needed
R20	Email send logs (recipient address, message type, date and time, delivery status)	12 months	Sending of the email	Evidence of notices sent and diagnosis of delivery problems	Automated deletion
R21	Cookies and similar storage on the user's device	As set out in the Cookie Policy. Earnly uses only strictly necessary and functional storage, so it holds no cookie consent records	Placement	The Privacy and Electronic Communications Regulations 2003	Expiry, or when the user clears it

Earnly's own statutory and business records

Ref	Record type	Retention period	Trigger	Basis	Disposal
R22	Earnly's own accounting, tax, VAT and payroll records, including any billing, invoices, payments and refunds	6 years	End of the Earnly financial year in which the transaction falls (Earnly's financial year ends on 31 January)	Corporation Tax records (paragraph 21 of Schedule 18 to the Finance Act 1998); accounting records (sections 386 and 388 Companies Act 2006, which set a minimum of 3 years for a private company); PAYE records (regulation 97 of the Income Tax (PAYE) Regulations 2003); and VAT records, which Earnly Limited keeps for 6 years because it is registered for VAT (paragraph 6 of Schedule 11 to the Value Added Tax Act 1994)	Deletion
R23	Company records: statutory registers, minutes of directors' decisions, resolutions and copies of filings	Statutory registers are kept for the life of the company (entries for former members for at least 10 years after they cease to be members). Minutes and records of resolutions are kept for at least 10 years from the date of the decision or resolution	Date of the entry, decision or resolution	Sections 121, 248 and 355 Companies Act 2006	Deletion once the statutory period has ended and the record is no longer needed
R24	Supplier and sub-processor records: contracts, due diligence, transfer risk assessments and reviews	6 years	End of the contract	Limitation period and evidence of Article 28 and transfer due diligence	Deletion
R25	Records of disclosures to public bodies, law enforcement and regulators	6 years	Date of disclosure	Accountability and evidence of the lawful basis relied on	Deletion
R26	Personal data breach register and incident records	6 years	Closure of the incident	Article 33(5) UK GDPR documentation duty and defence of claims	Deletion
R27	Contractor records (engagement terms, invoices, contact details and access records). Earnly has no employees other than its director, whose records fall under R22 and R23	6 years	End of the engagement	Limitation period for contract claims	Deletion
R28	Job and engagement applications that do not lead to an engagement	6 months	Notification of the decision	Defence of claims under the Equality Act 2010	Deletion
R29	Legal hold and retention exception records	6 years	Release of the hold, or end of the exception	Accountability	Deletion

Technical records

Ref	Record type	Retention period	Trigger	Basis	Disposal
R30	Security and audit logs: sign-in and two-step verification events, access to personal data (including support access), administrative and privilege changes, and Open Banking connection and revocation events	12 months	Creation of the log entry	Detecting and investigating unauthorised access and misuse. Matches the Provider's period for its own security logs	Automated deletion
R31	Application and diagnostic logs. Logs must not contain Open Banking Data, credentials or tokens	30 days	Creation of the log entry	Operational diagnosis	Automated deletion
R32	Deletion log (internal record identifiers and the date of deletion only, with no content)	12 months	Deletion	Needed to re-apply deletions after a restore (clause 6.4) and to evidence deletion	Automated deletion
R33	Backups of production systems (hourly transactional and daily full backups)	35 days	Creation of the backup	Business continuity and recovery (section 6)	Automated expiry of the backup set
R34	Test and development environments	Must not contain live personal data. Only synthetic data is used. Any live data found must be deleted at once and reported to the Data Protection Lead	Discovery	Data minimisation and security	Deletion
R35	Usage statistics	Earnly holds no identifiable usage analytics. Our hosting provider may produce aggregate, cookieless visitor statistics, which identify no one	Not applicable	Not applicable	Not applicable
R36	Anonymised and aggregated datasets meeting clause 5.3	Indefinitely	Anonymisation	Not personal data	Not applicable

5. Secure disposal and anonymisation

5.1 Disposal means putting a record permanently beyond use. Marking a record as inactive, archived or soft-deleted is not disposal.

5.2 Approved methods are: deletion from production databases and file storage; automated deletion and expiry routines on storage, logging and backup systems; and, for paper received by post, cross-cut shredding after scanning (clause 3.6).

5.3 Anonymisation must be irreversible by Earnly and any recipient, taking account of the means reasonably likely to be used to re-identify anyone, in line with Information Commission (ICO) guidance on anonymisation. Pseudonymised data remains personal data.

5.4 Merchant consensus table. The table is Earnly's only anonymised dataset built from user activity. It meets clause 5.3 because:

5.4.1 it stores only a merchant keyword of at least 3 characters, a category, a count of confirmations and the date of the last confirmation;

5.4.2 it holds no user, Account, Connected Account or company identifier, no transaction amounts and no dates of individual transactions;

5.4.3 a keyword is used to suggest a category only where at least 60% of confirmations agree; and

5.4.4 keywords that are personal names, person-to-person payment references or account references are excluded and never stored.

When a user confirms or corrects a category, only the keyword and category are added to the counts, and no link back to the user or the transaction is kept.

5.5 Processors must delete or return personal data at the end of the engagement and confirm deletion in writing, except for copies they are legally required to keep.

5.6 Where Open Banking Data is deleted, Earnly must also delete it from caches, search indexes and any derived datasets, other than the anonymised table in R6.

6. Backups and restore

6.1 Production backups are encrypted and held with our database provider in the AWS eu-west-1 (Ireland) region, as shown on the Sub-processor List. Transactional data is backed up hourly and the full system daily. Backups are kept for no longer than 35 days.

6.2 Deleting a record from live systems does not immediately remove it from backups. It is removed when the backup set containing it expires, which is no more than 35 days later.

6.3 Until then, backup data must not be restored to live systems, used for any purpose, or made available to anyone, except for a genuine recovery.

6.4 Restore procedure. After any restore, and before the restored system or data is put back into use, Earnly must re-apply every deletion recorded in the deletion log (R32) since the backup was taken, check that the deleted records are gone, and record the re-deletion in the compliance register.

6.5 When we tell a user that their data has been deleted, we tell them that copies may remain in encrypted backups for up to 35 days before they expire. No one may tell a user that data has gone from backups if it has not.

7. User-triggered deletion

7.1 Withdrawing Open Banking consent, disconnecting a Connected Account or letting a consent expire. When a user disconnects a Connected Account in the Platform (Settings, then Integrations), Earnly revokes the consent with the Provider and stops collecting data from that Connected Account at once. The same applies when the user withdraws consent directly with their bank, or when the 90-day consent expires without reconfirmation. A 30-day cooling-off period then applies. During it the user can export their transactions as a CSV file and can reactivate the connection by reconfirming or reconnecting it, in which case the data is kept. If the connection is not reactivated, Earnly deletes the Transaction-level Data for that Connected Account, including Outputs derived only from it, at the end of the cooling-off period (R1), in line with the Open Banking Consent Notice. Before a consent expires, we remind the user in the Platform and by email 14 days, 7 days and 1 day before expiry, and those reminders explain that the data will be deleted unless the consent is reconfirmed. Summary Outputs that also draw on other data stay in the Account until the user deletes them or closes the Account. Withdrawing consent does not close the Account.

7.2 Deleting content in the Platform. Where the Platform lets a user delete an item, the item is removed from live systems within 30 days and from backups under section 6.

7.3 Closing an Account. On closure, R1, R3, R4, R5, R7 and R9 apply, and the Open Banking consent for every Connected Account is revoked with the Provider. Before closing, the user is told what will be deleted and when, what will be kept and why, and how to export their data. A 30-day cooling-off period applies after closure, during which the user can sign in, export their data and reactivate the Account, in which case the data is kept. A user who asks for immediate deletion on closure has no cooling-off period, and deletion starts at once.

7.4 Erasure requests. An Individual may ask us to erase their personal data at any time by emailing privacy@earnly.co.uk or using the form at https://earnly.co.uk/privacy-request. We respond within one month, extendable by up to two further months for complex requests. We erase the data unless we must or are entitled to keep it, for example the records in R2, R8, R14 to R16, R18, R19, R22 and R26, or data under a legal hold. We tell the Individual which categories we are keeping and why, and we never refuse a whole request where part of it can be met.

7.5 Waitlist. A person on the website waitlist can ask us to delete their waitlist data at any time, and we do so within one month. We keep only their email address on the suppression list (R19) if they have opted out of marketing, so that we do not contact them again.

8. Records kept by the Provider

8.1 The Provider, Finexer Ltd, is an independent controller for the account information service consent journey, the authoritative consent and audit record, security and fraud prevention, and its own regulatory complaints. It keeps its own records under its own privacy notice at https://finexer.com/legal/privacy. At the date of this policy, the Provider keeps consent records and the audit trail for 5 years from the end of the consent, complaint records for 3 years, and security logs for up to 12 months.

8.2 Earnly's retention periods are set so that Earnly's records are consistent with the Provider's: Earnly keeps its own copy of consent and access records for 6 years (R2), its complaint records for 6 years (R14) and its security logs for 12 months (R30).

8.3 Deleting data from the Platform does not delete the records the Provider keeps as an independent controller. Individuals can ask the Provider about its records at privacy@finexer.com.

9. Legal hold

9.1 Where litigation, a regulatory investigation, a complaint, a dispute, an insurance claim, a Financial Ombudsman Service referral or an Information Commission enquiry is reasonably anticipated or under way, the Director must issue a written legal hold for the relevant records.

9.2 Each hold must be logged in the legal hold log in the "Registers" section of Earnly's Legal & Compliance space in Confluence, recording its scope (the specific records, users or systems affected), the reason, the date issued and the date released.

9.3 A hold suspends scheduled deletion, including automated deletion, for the records within its scope only. Those records are flagged so that the deletion routines skip them. Where a routine cannot skip a record, the record is copied, before the routine runs, to a restricted and access-logged location in Earnly's production database environment in the same region, and the copy is noted in the hold log and deleted when the hold is released.

9.4 A hold must be limited to the records relevant to the matter. A hold over one user's records does not justify keeping other users' records.

9.5 Only the Director may release a hold, and must do so as soon as the reason has ended. Records whose retention period expired during the hold must then be deleted within 30 days of release.

9.6 Destroying records under a legal hold may be a serious breach and, in proceedings, a contempt of court. Anyone who becomes aware that held records have been or may be deleted must report it to the Director at once.

10. Information given to users

10.1 The Privacy Policy summarises the periods in this policy. The Open Banking Consent Notice states the 30-day deletion of Transaction-level Data. The Cookie Policy states storage durations. These documents must be kept consistent with this policy, and any change to a period in R1, R4, R7, R8 or R14 must be reflected in them before it takes effect.

11. Roles and responsibilities

11.1 The Director, Adam Marsh, owns this policy and the schedule as Data Protection Lead, issues and releases legal holds, approves exceptions, and makes sure user-facing documents match this policy.

11.2 The Director is also responsible for the deletion routines, backup expiry and the restore procedure in section 6, and for testing them under section 12. Contractors who build or change those routines must follow this policy and must not change a retention period without the Director's written approval.

11.3 No one may create copies of personal data outside approved systems, keep extracts beyond the immediate task, or use live personal data in test or development environments.

11.4 Any exception to a retention period must be approved in writing by the Director, with the reason, scope and a review date, and recorded in the compliance register.

12. Monitoring and review

12.1 Deletion routines must be tested at least every 6 months, alongside the restore test, including a test that Transaction-level Data is deleted at the end of the 30-day cooling-off period after a consent ends and that deletions are re-applied after a restore. The results are recorded in the compliance register.

12.2 Compliance with this policy is reviewed as part of Earnly's annual data protection compliance review.

12.3 This policy is reviewed at least annually and whenever there is a material change to the Services, the systems, the processors, the arrangement with the Provider, or the law.

13. Contact

13.1 Data protection and deletion requests: privacy@earnly.co.uk, or the form at https://earnly.co.uk/privacy-request. General support: support@earnly.co.uk.

13.2 Post: Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU.

13.3 Individuals can complain to us about how we handle their personal data using the Complaints Procedure or the "How to complain" section of the Privacy Policy, including through our online complaint form at https://earnly.co.uk/complaints. We acknowledge complaints within 2 Business Days. Individuals also have the right to complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.