DRIVEDOCKET SOLUTIONS LLC
DATA RETENTION & DELETION POLICY
Consumer-Facing Mobile & Web Application
Effective Date: April 2026
Version: 1.0 — MVP Release
Platform: DriveDocket Mobile Application (iOS & Android) and Web Application
1. Purpose
This Data Retention and Deletion Policy describes how DriveDocket Solutions LLC (“DriveDocket”) retains, manages, and deletes personal information and documents collected through the DriveDocket mobile application (the “Application”). It is intended to complement the DriveDocket Privacy Policy and Terms of Service and to provide users with clear information about their rights regarding their data.
2. Scope
This policy applies to all personal information and documents collected from users of the DriveDocket Application across both the mobile application (iOS and Android) and the web application, including account information, uploaded documents, vehicle records, infraction records, compliance data, and authentication data.
3. Data Retention Principles
DriveDocket retains personal information only for as long as necessary to provide the service to you and to fulfill the purposes described in our Privacy Policy. Our retention approach is guided by the following principles:
- • We do not retain data beyond what is necessary for the stated service purpose.
• We provide you with full control over your data, including the ability to delete individual documents and your entire account at any time.
• We do not sell, license, or otherwise transfer retained data to third parties.
• We apply appropriate security controls to all retained data throughout its lifecycle.
4. Retention Periods by Data Category
4.1 Account Information and Profile Data
Retained for the life of your active account. Upon account deletion, all account and profile data is permanently deleted.
4.2 Uploaded Documents
Retained in encrypted storage (AWS S3) for the life of your active account. You may delete individual documents at any time through the Application. Upon account deletion, all documents — including all copies stored in AWS S3 — are permanently and irreversibly deleted.
4.3 OCR-Extracted Data
DriveDocket uses optical character recognition technology (“OCR”) to automatically read and extract information from documents you upload, such as expiration dates, names, policy numbers, and violation details, without requiring you to type that information manually. Data extracted from your uploaded documents via OCR is retained for the life of your active account and is deleted upon account deletion.
4.4 Vehicle Records and Infraction Records
Retained for the life of your active account. Deleted upon account deletion.
4.5 Authentication Tokens
JSON Web Tokens (JWT) and refresh tokens expire automatically per their configured expiry periods. Refresh tokens are revoked upon logout. Expired tokens are soft-deleted (marked inactive in the database) and may be retained for a limited period for security audit purposes before permanent deletion.
4.6 Push Notification Tokens
Retained for the life of your active account and deleted upon account deletion.
4.7 Server-Side Logs
Server-side logs generated during the development and operation of the Application are retained for up to 90 days for operational, debugging, and security purposes. These logs do not contain the content of uploaded documents. After 90 days, server logs are permanently deleted.
4.8 One-Time Passcodes (OTP)
OTP codes are generated server-side, delivered via email or SMS, are time-limited and single-use, and are discarded immediately upon use or expiration. OTP codes are not retained.
5. Legally Required Retention
DriveDocket may retain certain information beyond the periods described above where required by applicable law, court order, or valid legal process. Examples may include
- • Records relevant to litigation, regulatory investigation, or legal proceedings in which DriveDocket is involved.
• Records required by applicable state or federal law for a defined retention period
Where DriveDocket retains information beyond the standard retention period for legal reasons, that data will be stored securely, access will be restricted to those with a need to know, and it will be deleted as soon as the legal retention obligation has been fulfilled.
We recommend Ayodele confirm with tax counsel whether any business-level retention obligations apply to DriveDocket’s operational records independent of user data. Standard IRS guidance recommends retaining business financial records for a minimum of three to seven years depending on the record type. This policy addresses user data only.
6. Account Deletion
6.1 User-Initiated Account Deletion
You may delete your account at any time through the Application Settings (Settings > Account > Delete Account). Account deletion is permanent and irreversible. Upon deletion, the following data is immediately and permanently removed from DriveDocket’s systems:
- • User account record and all profile information.
• Driver profile and all extracted license data.
• All uploaded documents and all copies stored in AWS S3.
• All vehicle information and records.
• All infraction, citation, and violation records.
• All notification history.
• All push notification tokens.
• All address history.
• All authentication and refresh tokens.
Please note that once your account is deleted, this action cannot be undone. You will not be able to recover any documents or data previously stored in the Application.
6.2 Account Deactivation
If you wish to temporarily suspend access to your account without deleting your data, you may request account deactivation by contacting DriveDocket at support@drivedocket.com. A deactivated account retains your data but prevents login access. You may reactivate your account at any time by contacting us. Deactivated accounts that remain inactive for more than 24 months will be subject to permanent deletion in accordance with this policy.
6.3 Operator-Initiated Deletion
DriveDocket reserves the right to delete accounts that are found to be in violation of the Terms of Service or that are otherwise determined to pose a risk to the Application or other users. Users will be notified prior to deletion where practicable.
7. Data Deletion Requests
In addition to in-app account deletion, you may submit a data deletion request by contacting DriveDocket at privacy@drivedocket.com. We will respond to verified deletion requests within 30 days. We may request verification of your identity before processing a deletion request.
Certain information may be exempt from deletion where retention is required by applicable law or where the information is necessary to resolve a dispute or enforce our Terms of Service.
8. User Rights by Jurisdiction
8.1 California Residents
California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. DriveDocket does not sell personal information. To exercise your California privacy rights, contact us at privacy@drivedocket.com.
8.2 Other State Privacy Laws
Several states have enacted or are enacting comprehensive consumer privacy laws. As DriveDocket serves users across the United States, we are committed to reviewing and updating this policy as additional state privacy laws take effect. Users in Virginia, Colorado, Connecticut, Texas, and other states with applicable privacy laws may have rights similar to those described above. Contact us at privacy@drivedocket.com to exercise any applicable rights.
9. Security During Retention
All data retained by DriveDocket is stored using the following security measures:
- • Encrypted storage using AWS S3 with server-side encryption.
• Secure API communications using TLS/HTTPS protocols.
• Access controls restricting data access to authorized personnel only.
• Automatic session expiry and token revocation to limit unauthorized access.
10. Changes to This Policy
We may update this Data Retention and Deletion Policy from time to time. When we make material changes, we will notify you through the Application or by email to your registered address at least 14 days before the changes take effect.We may update this Data Retention and Deletion Policy from time to time. When we make material changes, we will notify you through the Application or by email to your registered address at least 14 days before the changes take effect.
11. Contact Us
For questions about this policy or to submit a data deletion request:
DriveDocket Solutions LLC
Attn: Privacy
privacy@drivedocket.com
www.drivedocket.com