Version 1.4. Effective date: October 20, 2026. Prepared with AI assistance and not reviewed by a licensed lawyer. Not legal advice.
Acquiror AI provides informational output only, not investment, legal, tax, accounting, lending, or valuation advice; see the Terms of Service, AI Features and Output.
Data Retention Schedule
On this page
This schedule states how long Acquiror AI (a product of Umplify Technologies Inc.) retains each category of data it holds, why, and how it is eventually deleted. It is drawn from a direct review of the product and its infrastructure configuration. Where deletion is carried out by a person rather than by an automated process, the schedule says so.
See the notes under the table for the legal-basis references and the backup-purge lag explanation.
Retention table
| Category | Retention trigger | Period | Rationale | Deletion method | Backup-purge lag |
|---|---|---|---|---|---|
| Account / user identity data | Account creation; user removed from tenant | Life of the tenant relationship. When an administrator removes a user, the user's sign-in link is severed immediately and the user record is retained for the life of the tenant relationship as part of the tenant's audit trail (who created, changed, or exported what). It is deleted with the rest of the tenant's data at offboarding, or earlier on a verified deletion request (see the Privacy Policy) | Ongoing account administration and audit trail integrity | Removal severs the sign-in link; the record is deleted as part of tenant offboarding or on request | See the database backup note below |
| Terms acceptance records (who accepted which document versions, when, from which network address and client, and whether they confirmed authority; the checkout consent reference where Stripe collected one; the acknowledgement of the in-product notice about relying on AI output) | Acceptance | Life of the tenant relationship; deleted with the rest of the tenant's data at offboarding. Records are never changed or deleted individually | Evidence of acceptance of the Terms of Service and the documents it incorporates; included in the tenant export | Deletion as part of tenant offboarding | See the database backup note below |
| Tenant / organization data | Subscription termination and non-renewal | Life of subscription + 60-day export window + deletion within 90 days after the end of the export window (up to 150 days after termination in total) | Contractual necessity while the subscription is active; minimization after termination | Deletion is carried out by Umplify as an operational process after the export window closes; it is not yet automated | See the database backup note below |
| Billing records and invoices | Fiscal year end | 7 years after fiscal year end | Canadian tax recordkeeping requirement. The CRA requires business records be kept a minimum of 6 years from the end of the last tax year they relate to; 7 years is chosen as a safety margin above that minimum | Deletion after the retention period as an operational process; Stripe retains its own copies under its own policy, which is outside our control | See the database backup note below |
| Payment-provider webhook event records (including raw event payloads) | Event receipt | 7 years after fiscal year end, with the billing records they support | These records are how billing events are verified and, if delivery fails, replayed; they are kept with the billing ledger they explain | Same as billing records; there is no earlier automated expiry | See the database backup note below |
| Uploaded deal documents and target-company financials | Subscription termination, or deletion of the document or its deal by the customer | Life of subscription + 60-day export window + deletion within 90 days after the end of the export window (up to 150 days after termination in total). Deleting a document in the product removes the file, its extracted text, and its search index entries (index removal is retried automatically if the search service is briefly unavailable); deleting a deal removes its files and index entries through a background job and marks the deal as archived. If a file or index entry cannot be removed by the deal-deletion job, the leftover is reported to Umplify for manual removal rather than retried automatically | Balances the customer's ability to export its own data (self-service export) against data minimization once the relationship ends | File deletion (subject to the recovery window described below); search index removal; the archived deal's structured records (financial analyses, drafts, decisions, extracted figures) remain in the tenant's data, no longer readable in the product, until tenant offboarding or a verified deletion request | File storage keeps deleted files recoverable for 7 days, and keeps prior versions of a file for 30 days from the version's creation. A deleted file is therefore recoverable for between 7 and 37 days, depending on its age when deleted |
| Abandoned and failed uploads | Upload started but never completed, or the file rejected at completion | A pending upload that never completes is marked failed by a sweep that runs every 30 minutes; the row stays in the deal's document list until the user retries or deletes it. A file rejected at completion (empty, oversize, mismatched, or password-protected) is deleted at once. When a replacement upload is abandoned, the previous version's bytes stay in storage under the failed row until the user retries or deletes the document | Lets the user recover from an interrupted upload | Deletion by the user, or at tenant offboarding | As for uploaded documents |
| Figures extracted from documents by AI features (revenue, earnings, owner compensation and named add-backs, largest customers by share) | Extraction | Life of the deal's structured records: these figures stay with the deal after the source document is deleted, and are deleted with the deal's structured records at tenant offboarding or on a verified request | The extracted figures feed the deal's analyses, which must stay reproducible | Deletion with the deal's structured records as an operational process | See the database backup note below |
| AI-generated drafts and analysis records (email and LOI drafts, risk summaries, revenue-durability assessments, go/no-go proposals and decision records, investment memo notes) | Same trigger as Customer Data (deal or tenant offboarding) | Same period as uploaded deal documents: life of subscription + 60-day export window + deletion within 90 days after the end of the export window. Memo notes can be deleted individually in the product; drafts, summaries, and decision records stay with the deal's structured records (also after the deal is deleted and archived) until tenant offboarding or a verified request | Treated as an extension of the deal record they are generated from | Deletion as part of tenant offboarding or on request | See the database backup note below |
| AI question-and-answer history | Each question asked | 90 days, then deleted automatically by a daily job | Lets a user revisit recent answers and citations; minimization after that | Automatic daily purge of entries older than 90 days | Not applicable (these records are held in Microsoft's cloud storage outside the database and are not covered by database point-in-time restore) |
| AI response cache (the full text of recent AI responses, including recognized text from scanned pages, keyed by a hash of the request) | Each cached response | A cached response is not used after 24 hours. Expired cache entries are not removed by an automated job; they are removed as part of tenant offboarding | Avoids re-running an identical, recent AI request | Expiry on read; removal at offboarding | Not applicable |
| MCP prompt audit record (prompt name, user, argument and context-source names, outcome) | Each prompt invoked by a connected external AI client | Life of the tenant relationship; deleted at tenant offboarding or on a verified request. There is no automated expiry | Lets the customer see which prompts its connected clients invoked | Deletion at offboarding or on request | Not applicable |
| Generated export files (decision exports, investment memo PDFs, credit memo PDFs) | File generation | 30 days, then the file and its job record are deleted by a daily job (decision and memo exports that completed). The job records of exports that failed or never finished are kept until tenant offboarding; no file exists for them. Credit memo exports carry the same 30-day expiry and are removed at tenant offboarding | Lets the requesting user download the file; minimization after that | Automatic daily cleanup for completed decision and memo exports; offboarding for the rest | File storage recovery window as above |
| Audit logs (subscription changes, valuation events, data exports, stage transitions) | Record creation (append-only by design) | 7 years | Financial and compliance audit trail; aligned with the billing-record retention period | Deletion after the retention period as an operational process; no automated expiry exists today | See the database backup note below |
| Document upload completion counters (which documents completed upload in a billing period, used for plan-limit metering) | Period end | Current and previous billing period, then removed by an automated job | Plan-limit metering | Automatic | Not applicable |
| AI question-and-answer ratings and in-product feedback submissions | Record creation | Life of the tenant relationship; deleted at tenant offboarding or on a verified request | Product-improvement use of ratings and feedback | Deletion at offboarding or on request | Not applicable |
| AI usage and rate-limit counters | Record creation | Life of the tenant relationship; deleted at tenant offboarding. Counters record tokens, cost, and call counts per tenant and per day; rate-limit entries record per-user request counts in short time windows | Per-tenant cost and usage governance (token and dollar caps, rate limiting) and billing verification | Deletion at offboarding | Not applicable |
| Application telemetry (request telemetry, exceptions, application logs, which can include user and tenant identifiers, email addresses, document names, and the text of questions asked of the AI question-and-answer feature) | Ingestion | 30 days | Operational application performance monitoring and error diagnosis; not a long-term compliance record | Automatic expiry per the configured log retention setting | Not applicable |
| Marketing website prospect data (contact form submissions, waitlist and email sign-up records, plus the past write-up request records, a closed set the site no longer collects) | Submission, or consent withdrawal | 24 months after the submission, or earlier on consent withdrawal or request. A repeat sign-up with the same address is not stored again and does not extend the period. Unsubscribe (suppression) records are kept as long as needed to honour the opt-out | CASL consent-based marketing; minimization | Automatic daily purge by the website's own service; this data is held by the marketing website, a separate system from the product | Not applicable |
| Marketing website rate-limit counters (submitting IP address and a count of recent submissions) | Submission | At least 24 hours (the counting window), then removed by the same daily purge | Abuse prevention | Automatic | Not applicable |
| Security incident register | Incident detected or confirmed | 5 years minimum, tracking Quebec's Law 25 incident-register regulation (the controlling figure; see legal-basis note below) | Regulatory recordkeeping duty; supports both PIPEDA and Quebec breach-response obligations | Internal | Not applicable |
Tenant offboarding
Where a row above says data is deleted at tenant offboarding, that deletion is carried out by Umplify as an operational process after the export window closes; it is not yet automated.
Database backups
Several rows above reference this note instead of repeating it. The primary database is backed up automatically by Microsoft with point-in-time restore. Backups are retained for 7 days, after which a record deleted from the live database is also gone from backups. Backup copies may be held in Microsoft's paired Canadian region (a second Canadian region) as well as in the primary Canadian region; they do not leave Canada. File storage has its own recovery window, described in the uploaded-documents row.
Legal bases
- PIPEDA, Principle 4.5 (Limiting Retention): personal information must be retained only as long as necessary for the identified purposes, then destroyed, erased, or anonymized. This is the general baseline applied to every row above.
- Quebec Law 25, s. 3.2: requires governance policies and practices framing the retention and destruction of personal information, approved by the organization's privacy officer, and published in simple, clear language. This retention schedule is a primary artifact for satisfying that publication duty.
- Quebec's incident-register regulation (Regulation respecting confidentiality incidents, s. 7) sets a 5-year minimum retention for the incident register, which controls over PIPEDA's separate 24-month minimum (PIPEDA s. 10.3 and SOR/2018-64) whenever an incident touches a Quebec resident. We apply 5 years as the single global figure rather than maintaining two different clocks.
Deletion on request
Where a row above says deletion happens at tenant offboarding or on request, the request process in the Privacy Policy applies: we act on verified deletion requests within the period stated there, except where retention is required by law or is needed to establish, exercise, or defend legal claims, in which case we will tell you what we retained and why.