Data Retention

1. Your browser

Before checkout, claim material is held in application memory. A temporary draft is written to sessionStorage only to support the checkout redirect. It has a 24-hour application expiry. On expiry, a subsequent read will remove it; a live page also clears expired state. Success removes the saved draft. You can also remove device-local material using your browser’s site-storage controls. Refreshing or closing the tab can lose an unsaved report; a browser's tab-restore feature can preserve sessionStorage until expiry or explicit clearing.

OCR uses local execution with no language cache in IndexedDB. Images are compressed into the browser-held draft. We do not promise secure forensic erasure from your device, its browser caches, screenshots, downloads, backups or another open tab. Downloaded/printed reports remain under your control until you delete them yourself. The rendered report remains in page memory until you clear, reload or leave the page, or the live session expires; it is not a saved-report account.

2. Contact messages

Contact messages contain the name, email and message you submit. They are separate from the claim flow, are used to respond to your request, and become eligible for deletion after 30 days. Routine cleanup removes eligible messages; periods of inactivity may delay physical deletion. Do not include claim files or sensitive records. A legal obligation or documented legal hold may require longer retention, which must be assessed separately.

2. Application security markers

ClaimReadiness does not persist claim content or reports in D1 or an upload bucket. A SHA-256 checkout-session hash, processing state, attempt count and timestamps are used to prevent repeat use. A payment can only be used during its seven-day generation eligibility window. Expired payment-use markers become eligible for purge after seven days. Keyed IP-hash rate-limit entries become eligible after 24 hours.

Eligible markers are removed during routine maintenance and service activity. Physical deletion may occur later than the eligibility date during periods of inactivity. Expired payment sessions remain ineligible even if a marker has been deleted. No claim content is retained in those markers. Public legal-notice snapshots, including the operator’s published contact information, are preserved as version history and contractual evidence, separately from claim content. Older notice versions are reviewed alongside transaction and dispute records.

3. Payments, legal acceptance and providers

Stripe retains payment/billing records and checkout metadata, including the accepted notice version/hash, acceptance time, age/accuracy/acknowledgment and immediate-generation flags. Those are transaction/contract records, not uploaded claim files. Applicable accounting, fraud, dispute and legal requirements, and Stripe's role and arrangements, determine their retention; clearing the browser does not erase Stripe records.

OpenAI's input/output retention depends on its current commercial terms, model/features and any verified account agreement, with possible safety/legal exceptions. A zero-retention agreement is not established by the application code. Hosting, platform access/security logs and any support communications also have their own verified operational schedules. The browser-only extraction promise does not cover independent provider records.

A documented legal hold can delay otherwise applicable deletion for a specific dispute or obligation, using only necessary records. Any legal hold is limited to the records and period needed for the relevant obligation. We do not keep claim content in the application as a precautionary archive.

4. Preferences and deletion requests

Your optional choices are held in page memory only. ClaimReadiness does not save them in localStorage, sessionStorage, cookies, or an account. Refreshing or closing the page clears them; optional services return to off. You can reset your current choice through Privacy choices. Essential checkout/session and payment processing are separate.

Use the Contact us page for support and privacy requests. For an account, payment or provider deletion request, identify the relevant transaction without resending your policy or images. We will act within applicable legal duties and explain records that cannot lawfully be deleted yet. Once browser-only content is cleared, ClaimReadiness cannot retrieve it to satisfy a later request.