Data Retention Policy
How long we keep your information.
Updated September 17, 2026 · Shuttle Labs
This policy explains how Shuttle Labs retains information for the Shuttle waitlist and optional card-analysis service at shuttlecard.xyz. It should be read with our Privacy Notice and Data Disposal Policy.
The waitlist is operating. The financial-data analysis pilot is not yet open. The analysis periods below describe the policy for that pilot when it launches; joining the waitlist does not connect a financial account.
Our approach
We keep information for the purpose for which it was collected and seek to minimize both the amount collected and how long it remains available. We review whether retained information is still needed. A deletion request can shorten the ordinary retention period, subject to necessary identity verification and any applicable preservation obligation.
Retention schedule
| Information | Retention |
|---|---|
| Waitlist email, signup date, preferences and campaign attribution | While we operate the early-access waitlist and need the record to provide your requested invitation, unless you request removal sooner. We review continued need quarterly. If the waitlist ends, we will delete records no longer needed rather than automatically transfer them to an unrelated marketing list. |
| Imported financial accounts, transactions and liability snapshots | For the pilot, scheduled for removal from the live application 30 days after the bank connection is created, or sooner if you request deletion. We request up to 12 months of transaction history; that history window is separate from our 30-day storage period. |
| Analysis reports | For the pilot, scheduled for removal from the live application 30 days after each report is created, or sooner on request. |
| Plaid connection credentials | Kept encrypted while importing the one-time snapshot. We request revocation and remove the stored credential after import, following a terminal import failure, or when you request disconnection. Temporary provider failures may require retries. |
| Sign-in and invitation links | Sign-in links expire after 15 minutes; initial invitation links after seven days. Links are single-use. Stored token records are scheduled for cleanup after expiry. Expiry prevents authentication even if cleanup has not run yet. |
| Login sessions | Expire after seven days. Signing out invalidates the current session; expired session records are scheduled for cleanup. |
| Email delivery records | Queued message contents are encrypted and cleared after successful sending or expiry. Completed delivery-status records are scheduled for cleanup after 30 days. Provider delivery records have their own retention settings, which must be reviewed before the pilot launches. |
| Consent, account and operational records | May remain while you use the service or stay on the waitlist to support your choices and account operation. Deleting financial data alone does not remove the waitlist or all account metadata. You can request full account and waitlist removal by email. |
| Security and support records | Limited to what is necessary to handle requests, investigate issues and document security operations. Our security policy specifies a 12-month period for security evidence, unless an applicable obligation requires otherwise. Financial payloads and credentials should not be included in these records. |
Cleanup and provider delays
Scheduled deletion is a process, not a guarantee that every copy disappears at the exact expiry time. We must verify the pilot’s cleanup and revocation procedures before opening financial-data access. If a task or provider is unavailable, outstanding deletion and disconnection work requires retry or operator follow-up. A service pause does not cancel a deletion request.
Backups and other providers
Deleting information from the live application does not necessarily erase existing provider backups immediately. Backup retention and recovery settings must be confirmed before the financial-data pilot opens; we do not currently promise that all backup copies disappear within 30 days. Copies awaiting normal backup expiry must not be used for ordinary service activity. If data is restored, applicable deletion requests must be reapplied.
Cloudflare, Plaid and any activated email provider may retain information for their own service, security or legal purposes under their terms and privacy notices. Our live-application schedule does not override those independent obligations.
Exceptions and policy changes
If specific information must be preserved for an applicable legal obligation, dispute or security investigation, we will limit the retained information and its use to that purpose and review the exception. We will update this page if retention practices change and provide additional notice where required.
Request a shorter retention period
You can request removal from the waitlist now. When the pilot is available, the account’s financial-data deletion control will request disconnection and deletion of imported data and reports. See the Data Disposal Policy for the difference between deleting financial data and removing your full account.
For questions or a data request, contact Shuttle Labs at hello@shuttlecard.xyz. Please do not email bank passwords, full card numbers, or account access tokens.