Skip to content
SPOTLESS DETAILRequest

Policies

Data Retention & Disposal Policy

Last updated October 12, 2026

This policy sets how long Spotless Detail Solutions (“Spotless Detail”) keeps each kind of information and how it is securely deleted. We keep data only as long as we need it to serve customers, meet legal, tax and contractual obligations, and run the business. It supplements our Information Security Policy and Privacy Policy and is reviewed at least once a year.

Download this policy as a PDF

1. Retention schedule

  • Customer profile (name, phone, email, service addresses, vehicles, notes): while the customer is active, then 3 years after their last service or app sign-in. Deleted sooner on request (section 3).
  • Appointment and service history (jobs, invoices, payment records): 7 years, because they are business and tax records.
  • Before/after photos and videos: 3 years after the service, unless the customer asks for earlier deletion.
  • Text messages and consent records (opt-ins, STOP requests): 5 years after the last message, to document consent.
  • Card details: held by Stripe, not by us. We keep only brand, last four and expiry, for as long as the card is on file.
  • Bank data obtained through Plaid (transactions from our own business accounts): 7 years as bookkeeping and tax records. Plaid access tokens are deleted as soon as a connection is no longer needed.
  • Sign-in codes and one-time links: expire within 10 minutes; records of them are deleted after 90 days.
  • Security and audit logs: 2 years.
  • Staff records: as required by employment and tax law (generally 4 to 7 years after employment ends).

2. Secure disposal

  • Records past their retention period are deleted from our database and file storage, or, where history must stay intact for accounting, anonymized so they no longer identify a person.
  • When a Plaid connection is removed, we disconnect it through Plaid and delete the stored access token the same day.
  • Backups held by our providers expire on their own schedules (generally within 30 days); deleted data is not restored from backups except to recover from an incident.
  • Paper with customer or financial information is shredded. Devices are wiped before they are sold, recycled or reassigned.

3. Customer requests

  • Customers can ask to see or delete their information by emailing spotless.dtail@gmail.com or by deleting their account in the Spotless app.
  • We confirm the request comes from the customer, then complete it within 30 days. Information we must keep by law (for example tax records) is kept only for that purpose and deleted when the period ends.

4. Enforcement and review

  1. Once a year, and whenever our systems change, the Owner runs a retention review: identifies records past their period in each system and deletes or anonymizes them.
  2. The review date and what was removed are recorded.
  3. This policy is reviewed at the same time to keep it in line with applicable privacy laws and our agreements with partners such as Plaid.