Data Retention & Disposal Policy

1. Purpose & Scope

This policy governs how ASME Holdings LLC (“ASME,” “we,” “us”) retains and disposes of the personal and financial information it collects to operate its residential property-management business, including information collected through its rental-application portal and any consumer financial data obtained through third-party providers such as Plaid. It applies to all applicant, tenant, and vendor data held in ASME’s systems.

2. Data we retain

Applicant identity and contact details; rental-application information (income, residence, and screening data); identity and Social Security documents; tenant lease, ledger, and payment records; vendor onboarding records; account communications; and consumer financial data (bank account balances and account-holder identity) obtained with the consumer’s consent through Plaid for the purpose of verifying an applicant’s ability to pay.

3. Retention periods

• Rental applications that do not result in a tenancy are retained for a minimum of two (2) years to meet fair-housing recordkeeping obligations, then securely deleted, unless subject to a legal hold.
• Tenant records (lease, ledger, screening results, identity documents) are retained for the duration of the tenancy and for seven (7) years after move-out, aligned to FCRA, HUD, and IRS requirements, then automatically and securely purged unless subject to a legal hold.
• Payment and financial records are retained for seven (7) years to meet IRS requirements.
• Consumer financial data obtained via Plaid is retained only as long as necessary for the application decision and any resulting tenancy (see Section 4).
• Account communications and legal notices are retained for seven (7) years as business records.

4. Consumer financial data obtained via Plaid

Financial data obtained through Plaid is used solely for the stated purpose of verifying an applicant’s identity, balances, and income as part of tenant screening. It is stored encrypted, is never sold or shared for marketing, and is retained only as long as necessary for the application decision and any resulting tenancy. When this data is no longer required, or upon a consumer’s deletion request (subject to the legal retention periods above), ASME deletes the data from its systems and revokes the associated Plaid access. Plaid access credentials are stored encrypted and are never exposed to end users.

5. Storage & security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2 or better). Sensitive fields (Social Security numbers and third-party access tokens) are additionally field-encrypted. Access is restricted by role-based access control with row-level security, and multi-factor authentication is required for administrative access.

6. Disposal & secure deletion

Records that reach the end of their retention period are securely and permanently deleted through an automated purge process. Deletion removes the underlying records and associated files; where a third-party access token exists (e.g., Plaid), that access is revoked as part of disposal.

7. Legal hold exception

Records that are the subject of an active dispute, litigation, audit, or legal or regulatory hold are exempt from automatic purge and are retained until the hold is released.

8. Consumer rights & consent

Data is collected only with the consumer’s explicit consent, evidenced by a signed authorization and this and our Privacy Policy. Consumers may request access to, correction of, or deletion of their data, subject to the legal retention obligations described above.

9. Policy review

This policy is reviewed at least annually, and upon any material change to our systems or to applicable data- privacy law, by the Owner of ASME Holdings LLC.

10. Contact

Questions about this policy: ASME Holdings LLC, 2220 County Road 210 West, Suite 108-311, Jacksonville, FL 32259, (904) 479-8510.

Last updated: July 5, 2026.