Data Retention

1. Your browser

Before checkout, claim material is held in application memory. A temporary draft is written to sessionStorage only to support the checkout redirect. It has a 24-hour application expiry. On expiry, a subsequent read will remove it; a live page also clears expired state. Success removes the saved draft. You can also remove device-local material using your browser’s site-storage controls. Refreshing or closing the tab can lose an unsaved report; a browser's tab-restore feature can preserve sessionStorage until expiry or explicit clearing.

OCR uses local execution with no language cache in IndexedDB. Images are compressed into the browser-held draft. We do not promise secure forensic erasure from your device, its browser caches, screenshots, downloads, backups or another open tab. Downloaded/printed reports remain under your control until you delete them yourself. The rendered report remains in page memory until you clear, reload or leave the page, or the live session expires; it is not a saved-report account.

2. Contact messages

Contact messages contain the name, email and message you submit. They are separate from the claim flow, are used to respond to your request, and become eligible for deletion after 30 days. Routine cleanup removes eligible messages; periods of inactivity may delay physical deletion. Do not include claim files or sensitive records. A legal obligation or documented legal hold may require longer retention, which must be assessed separately.

2. Application security markers

ClaimReadiness does not keep an archive of source claim documents or reports. A separate encrypted report-delivery outbox may temporarily hold a generated PDF and its recipient address for up to 24 hours, solely for sending and retries. A SHA-256 checkout-session hash, processing state, attempt count and timestamps are used to prevent repeat use. A payment can only be used during its seven-day generation eligibility window. Expired payment-use markers become eligible for purge after seven days. Keyed IP-hash rate-limit entries become eligible after 24 hours.

Eligible markers are removed during routine maintenance and service activity. Physical deletion may occur later than the eligibility date during periods of inactivity. Expired payment sessions remain ineligible even if a marker has been deleted. No claim content is retained in those markers. Public legal-notice snapshots, including the operator’s published contact information, are preserved as version history and contractual evidence, separately from claim content. Older notice versions are reviewed alongside transaction and dispute records.

3. Payments, legal acceptance and providers

Stripe retains payment/billing records and checkout metadata, including the accepted notice version/hash, acceptance time, age/accuracy/acknowledgment and immediate-generation flags. Those are transaction/contract records, not uploaded claim files. Applicable accounting, fraud, dispute and legal requirements, and Stripe's role and arrangements, determine their retention; clearing the browser does not erase Stripe records.

OpenAI's input/output retention depends on its current commercial terms, model/features and any verified account agreement, with possible safety/legal exceptions. A zero-retention agreement is not established by the application code. Hosting, platform access/security logs and any support communications also have their own verified operational schedules. The browser-only extraction promise does not cover independent provider records.

A documented legal hold can delay otherwise applicable deletion for a specific dispute or obligation, using only necessary records. Any legal hold is limited to the records and period needed for the relevant obligation. We do not keep claim content in the application as a precautionary archive. An encrypted report-delivery payload is removed after Resend accepts it or its 24-hour retry window expires. Expired payloads cannot be sent; routine cleanup removes them, and periods of inactivity may delay physical deletion. Status-only records (hashed job reference, provider message ID, timestamps, attempt count and delivery state) are removed after seven days. Resend can retain the message, attachment and delivery data under its own arrangements, and copies delivered to an inbox remain under the recipient’s control.

4. Preferences and deletion requests

If you allow Google Analytics, Google can retain analytics events and identifiers according to the property’s configured retention settings and its applicable terms. The operator’s Google Analytics retention setting has not been verified through this application. Analytics cookies such as _ga are separate from the app’s saved analytics preference and can persist according to Google Analytics settings. Turning analytics off stops this app’s measurement and attempts to remove accessible analytics cookies; it does not erase data already received by Google. Use browser storage controls to remove remaining device-local cookies and contact us about applicable deletion requests.

Your analytics choice (allow or decline) is saved in localStorage on this browser for 180 days. The preference contains only its version, choice, and timestamp, not claim or payment information. After expiry or clearing browser storage, we ask again. Optional speech permission stays in page memory and clears when you refresh or close the page. You can withdraw analytics and speech permission through Privacy choices. Essential checkout/session and payment processing are separate.

Use the Contact us page for support and privacy requests. For an account, payment or provider deletion request, identify the relevant transaction without resending your policy or images. We will act within applicable legal duties and explain records that cannot lawfully be deleted yet. Once browser-only content is cleared, ClaimReadiness cannot retrieve it to satisfy a later request.