Home / Data Retention & Deletion Policy
Legal
Data Retention & Deletion Policy
Last updated October 11, 2026. Questions? Contact us at (772) 356-3550 or support@eburstservices.com.
This policy explains how long eBurst Payments (a trade name of eBurst Services Inc) keeps personal information, including bank information received through Plaid, and how it is deleted. It applies to applicants, customers, partner shops and website visitors, and is enforced automatically by our systems every day.
Principles
- We collect only what we need to evaluate applications, service plans, prevent fraud and meet legal obligations.
- We keep bank access only while it’s needed, and records only as long as the law requires.
- You can disconnect your bank or close your account yourself at any time.
Retention schedule
| Information | How long we keep it |
|---|---|
| Plaid bank connection (access to your accounts) | Ended automatically 30 days after a decision on your application, after 60 days without activity on an unsubmitted application, or immediately when you disconnect, revoke access through Plaid, or close your account. |
| Bank information used in a decision (balances, transaction summary, account owner name check) and uploaded bank statements | Kept with the application record for at least 25 months after we notify you of our decision, as required by Regulation B (12 CFR 1002.12(b)), then deleted. |
| Applications that did not become a plan | At least 25 months after the decision notice (Regulation B), then personal details are deleted and only non-identifying statistics remain. |
| Unsubmitted applications | Deleted after 12 months of inactivity, or immediately when you close your account. |
| Plans, agreements and payment records | While the plan is open and at least 25 months after it is paid off or closed; bank data and statements tied to the plan are then deleted. Payment and accounting records may be kept longer where tax, accounting or legal-hold obligations require. |
| Accounts and sign-in data | While your account is open. After you close it, your profile is de-identified once nothing remains under a legal retention period. |
| Security codes and password-reset links | One-time codes expire in 10 minutes; reset links in 60 minutes; records are deleted within a day. |
| Security and audit logs | Kept as long as needed to protect accounts and investigate incidents. |
How deletion works
- Bank access: we call Plaid to remove the connection and permanently destroy our encrypted access key. After that, eBurst Payments can no longer retrieve any information from your bank.
- Records: personal fields, bank data and uploaded files are permanently deleted from our systems; non-identifying facts (such as the amount requested and the decision) may be kept for reporting.
- Backups: server backups are kept only for disaster recovery; deleted information ages out of them on their normal rotation and is never restored to active use.
- Legal holds: if a law, regulator or court requires us to keep specific records (for example during a dispute), we keep only those records until the obligation ends.
Your choices
- Disconnect a bank: Profile & security → Connected banks → Disconnect, or at my.plaid.com.
- Close your account and request deletion: Profile & security → Close account. If a plan is open or an application is under review, contact us and we’ll explain what must be kept and for how long.
- Questions or requests: call (772) 356-3550 or email support@eburstservices.com.
We review this policy at least once a year and whenever our services or legal requirements change.