Data Retention & Disposal Policy

1. Purpose & Scope

This policy governs how ASME Holdings LLC (“ASME,” “we,” “us”) retains and disposes of the personal and financial information it collects to operate its residential property-management business, including information collected through its rental-application portal and any consumer financial data obtained through third-party providers such as Plaid. It applies to all applicant, tenant, and vendor data held in ASME’s systems.

2. Data we retain

Applicant identity and contact details; rental-application information (income, residence, and screening data); identity and Social Security documents; tenant lease, ledger, and payment records; vendor onboarding records; account communications; and consumer financial data (bank account balances and account-holder identity) obtained with the consumer’s consent through Plaid for the purpose of verifying an applicant’s ability to pay.

3. Retention periods

• Rental applications that do not result in a tenancy are retained for a minimum of two (2) years to meet fair-housing recordkeeping obligations. After that period they are reviewed monthly by the retention job and purged on the owner’s confirmation; nothing is purged while a legal hold is open. An application that carries a payment record is kept for the seven-year financial period instead.
• Tenant records (lease, ledger, screening results, identity documents) are retained for the duration of the tenancy and for a minimum of seven (7) years after move-out, aligned to FCRA, HUD, and IRS requirements. After that period the archived tenant record is reviewed monthly by the retention job and purged on the owner’s confirmation; nothing is purged while a legal hold is open. Payment, ledger and legal-notice records are never purged by that job.
• Payment and financial records are retained for seven (7) years to meet IRS requirements.
• Consumer financial data obtained via Plaid is retained only as long as necessary for the application decision and any resulting tenancy (see Section 4).
• Account communications and legal notices are retained for seven (7) years as business records.

4. Consumer financial data obtained via Plaid

Financial data obtained through Plaid is used solely for the stated purpose of verifying an applicant’s identity, balances, and income as part of tenant screening. It is stored encrypted, is never sold or shared for marketing, and is retained only as long as necessary for the application decision and any resulting tenancy. When this data is no longer required, or upon a consumer’s deletion request (subject to the legal retention periods above), ASME deletes the data from its systems and revokes the associated Plaid access. Plaid access credentials are stored encrypted and are never exposed to end users.

5. Storage & security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2 or better). Sensitive fields (Social Security numbers and third-party access tokens) are additionally field-encrypted. Access is restricted by role-based access control with row-level security, and multi-factor authentication is required for administrative access.

6. Disposal & secure deletion

Disposal is automated for the categories where an automated purge runs: administrative audit logs (staff activity after 12 months; access denials and security events after 24 months), resident-portal session and activity records, expired backup snapshots and superseded document versions, and — monthly, by the retention job — rental applications that did not result in a tenancy (after two years), archived former-tenant records (seven years after move-out) and self-tour identity images (after ninety days). Nothing is purged while a legal hold is open, and the job records what it purged and what it held. Payment and financial records are never purged by that job. For any remaining category, records that reach the end of their retention period are securely deleted on periodic review, or on a consumer’s request. Deletion removes the underlying records and associated files; where a third-party access token exists (e.g., Plaid), that access is revoked as part of disposal.

7. Legal hold exception

Records that are the subject of an active dispute, litigation, audit, or legal or regulatory hold are exempt from purge and are retained until the hold is released. The monthly retention job checks for an open dispute, eviction, collections placement or legal-hold flag before every deletion and skips any record that has one; for the other automated purges the hold is enforced by the purge itself, and elsewhere it is applied at review.

8. Consumer rights & consent

Data is collected only with the consumer’s explicit consent, evidenced by a signed authorization and this and our Privacy Policy. Consumers may request access to, correction of, or deletion of their data, subject to the legal retention obligations described above.

9. Policy review

This policy is reviewed at least annually, and upon any material change to our systems or to applicable data- privacy law, by the Owner of ASME Holdings LLC.

10. Contact

Questions about this policy: ASME Holdings LLC, 2220 County Road 210 West, Suite 108-311, Jacksonville, FL 32259, (904) 479-8510.

Last updated: September 7, 2026.