Data Retention Policy
We believe in keeping your data only as long as necessary. This policy details exactly how long each category of data is retained and what happens when it is deleted.
📅 Updated: July 20, 2026·🔖 Version 2.0·⚖️ Governed by Indian Law
1Overview
Cashtro retains personal and financial data only for as long as necessary to:
- Provide and improve our services to you
- Comply with legal obligations under Indian law (including tax, GST, and financial regulations)
- Resolve disputes and enforce our agreements
- Protect the security and integrity of our Platform
When data is no longer needed for any of these purposes, it is permanently deleted or irreversibly anonymized.
2Data Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & identity information | Until deletion + 30 days grace period | Service provision |
| Profile information (name, email, phone) | Until account deletion | Contract |
| PAN / GSTIN / business info | Until deletion or 7 years, whichever later | GST Act compliance |
| Financial transactions & cashbooks | Until deletion or 7 years for tax records | IT Act / GST Act |
| GST Invoices | 7 years from invoice date | GST Act (mandatory) |
| Budget & goal records | Until account deletion | User preference |
| Receipt images (saved) | Until account deletion | User preference |
| Receipt images (ephemeral AI scan) | Deleted within seconds of processing | No storage |
| Chat messages | Until deletion or account closure | User preference |
| Blog posts & comments | Until deletion or account closure | User preference |
| Push notification tokens | Until logout or token renewal | Security |
| Authentication logs (IP, timestamps) | 12 months | Security & fraud prevention |
| Crash logs & error reports | 90 days | Debugging |
| Support tickets | 3 years after closure | Dispute resolution |
| Payment transaction records | 7 years | RBI / tax compliance |
| Anonymized analytics | Indefinite (non-personal) | Product improvement |
3Account & Identity Data
When your account is active, we retain all account information necessary to provide the service. Upon account deletion:
- A 30-day grace period begins during which you may reactivate your account and recover data.
- After 30 days, personal identifiers (name, email, phone) are permanently purged.
- Financial records that must be retained for legal compliance are anonymized (detached from your identity) and retained only as long as legally required.
4Financial & Invoice Data
Legal Notice: Under India's GST Act, businesses are required to maintain invoice and financial records for a minimum of 7 years from the relevant assessment year. If you use Cashtro's GST invoicing features for business purposes, this legal retention requirement applies to your invoice data even after account deletion.
In practice this means:
- If you delete your account, transaction and invoice data required by law is anonymized (personal identifiers removed) but the financial record shell is retained for the legally required period.
- Personal cashbooks and non-taxable transactions are deleted within 30 days of account deletion.
- You can export all your financial data at any time before account deletion from Settings > Export Data.
5Technical & Log Data
- Authentication logs (login IP addresses, timestamps): Retained for 12 months to detect unauthorized access and support security investigations.
- Crash reports: Retained for 90 days, automatically deleted thereafter. Crash reports do not contain financial data.
- API access logs: Retained for 30 days for operational monitoring, then deleted.
- Notification delivery logs: Retained for 30 days to confirm delivery and troubleshoot issues.
6AI Processing Data
- Receipt scan images (not saved): Discarded within seconds of AI processing completion. No persistent storage.
- Receipt images (explicitly saved by you): Retained until you delete them or close your account.
- AI chat conversation history: Retained until you delete individual conversations or close your account.
- AI model outputs (insights, categorizations): Retained as part of your transaction/financial records. Deleted with the records they are attached to.
7Legal Retention Requirements
Certain data must be retained to comply with Indian law regardless of account deletion requests:
| Requirement | Data Type | Retention Period | Authority |
|---|---|---|---|
| GST Act compliance | Tax invoices, GST records | 7 years | CBIC / GST Council |
| Income Tax Act | Transaction & payment records | 7 years | Income Tax Department |
| RBI guidelines | Payment gateway transaction records | 7 years | Reserve Bank of India |
| IT Act 2000 | Cybersecurity incident logs | 12 months | Ministry of Electronics |
| Court orders / legal holds | Any relevant data | Duration of order | Competent court |
8Data Deletion Process
When you request account deletion or your data is due for deletion:
- Initiation: Deletion requested from Settings > Account > Delete Account, or via email to legal@cashtro.in.
- Grace Period: 30-day grace period begins. You may reactivate during this time.
- Export Window: During the grace period, you can still export your data.
- Personal Data Purge: After 30 days, all personal identifiers are permanently deleted from production systems.
- Backup Purge: Encrypted backups containing your data are overwritten within 90 days.
- Legal Data Anonymization: Financial records requiring legal retention are anonymized and stripped of all personal identifiers before being retained for the legally required period.
Data deletion is irreversible after the grace period. Please ensure you have exported any data you wish to keep before confirming deletion.
9Questions About Data Retention
For questions about data retention or to submit a formal deletion request, contact our Privacy Officer at legal@cashtro.in. We respond to formal data requests within 30 days.