Purpose
This policy defines how In The BLK LLC retains, disconnects, deletes, and disposes of consumer and application data processed through InTheBlk. It is designed to support data minimization, consumer privacy rights, secure financial-data handling, and compliance with applicable legal and contractual obligations.
Scope
- Account and authentication records.
- Plaid-linked institution and account metadata.
- Balances and transaction records.
- User-created financial workspace information and review decisions.
- Operational and security logs.
- Privacy-request records.
- Audit records.
Retention Principles
In The BLK LLC retains personal and financial data only for as long as reasonably necessary to provide requested product functionality, maintain user-requested history, operate and secure the service, investigate errors or security events, satisfy legal or contractual obligations, resolve disputes, or document privacy actions where a minimal record is necessary.
Data that is no longer required is deleted, anonymized, or rendered inaccessible according to the capabilities of the applicable system.
Linked Financial Institution Disconnect
Disconnecting a financial institution stops future access through that connection; it is not the same action as deleting previously imported financial history.
- Provider access is revoked or disabled where supported.
- Stored Plaid access-token material is removed.
- The connection is marked inactive or otherwise disabled.
- InTheBlk no longer uses the disconnected connection to retrieve new financial data.
- Previously imported history may remain available unless the user separately requests financial-data deletion or account deletion.
Delete Financial Data
Users may request deletion of imported financial information through the application or published privacy-request mechanisms.
Deletion requests are authorized using the authenticated user's identity. InTheBlk does not rely on a client-supplied user identifier to determine whose data is deleted. Deletion operations are designed to be idempotent and safe to retry.
- Protected provider connection records and access-token material.
- Linked financial-account records.
- Balance information.
- Imported transaction records.
- Synchronization records not required for security, legal, or audit purposes.
- Derived application records that contain deleted financial information.
Account Deletion
Users may delete their InTheBlk account. Signing out of InTheBlk does not delete user data.
- Authentication and confirmation of the destructive action.
- Deletion of linked-provider access and financial data.
- Deletion of remaining user workspace information, subject to legitimate retention requirements.
- Deletion of the user's application authentication identity.
- Termination of the active session.
Privacy Requests
Consumers may submit requests concerning their personal information through the published InTheBlk Data Rights mechanism.
In The BLK LLC may take reasonable steps to verify a requester's identity before fulfilling a request. Privacy-request forms must not be used to submit banking credentials, Social Security numbers, full account numbers, routing numbers, or unnecessary financial information.
- Access requests.
- Deletion requests.
- Correction requests.
- Privacy questions.
Operational and Security Logs
Operational and security logs are retained for a limited period consistent with service operation, troubleshooting, fraud and abuse prevention, incident investigation, legal obligations, and managed-platform capabilities.
Logs are designed to exclude Plaid access tokens, bank credentials, authorization headers, full account or routing numbers, and unnecessary consumer financial payloads.
Where a minimal audit record remains after deletion, it is limited to non-financial metadata reasonably necessary to document the request, security event, or legal obligation.
Backups and Managed Service Copies
Deletion from active application systems may not immediately remove data from provider-managed backups, replicas, or disaster-recovery copies. Such copies expire or are overwritten according to managed-provider retention cycles and are not restored for ordinary product use after a valid deletion request except where necessary for disaster recovery, legal requirements, or security investigation.
Legal and Contractual Retention
In The BLK LLC may retain limited information when required by law, legal process, contractual obligation, fraud prevention, security, dispute resolution, or enforcement of agreements. Where retention is required, access is restricted and the information is deleted when the retention requirement ends.
Validation and Periodic Review
Retention and deletion controls are periodically validated through application and backend testing. This policy is reviewed at least annually and after material changes to product functionality, data flows, applicable privacy obligations, or data-processing providers.
This policy is adopted by In The BLK LLC.