1. Why We Retain Data

We keep your data for as long as necessary to:

• Provide you with the Filed service
• Meet Irish Revenue record-keeping obligations
• Handle any disputes or complaints
• Comply with our legal obligations under Irish and EU law

2. Retention Schedule

Account Information

Includes: name, email, trade type, business structure, VAT status, marital status

• Retention period: Duration of active account + 7 years from account closure
• Legal basis: Revenue record-keeping obligations (Taxes Consolidation Act 1997, Section 886)

Transaction Records (Income and Expenses)

Includes: amounts, dates, descriptions, categories, RCT status, VAT amounts

• Retention period: 7 years from the end of the tax year to which they relate
• Legal basis: Revenue record-keeping obligations — taxpayers must retain records for 6 years; Filed retains for 7 years as a safety margin

Receipt Photographs

Includes: photos of receipts and expense documents you upload

• Retention period: 7 years from the end of the relevant tax year
• Legal basis: Revenue record-keeping obligations; digitised records accepted by Revenue
• Note: Google Cloud Vision processes photos for OCR and does not retain them

Tax Summary Reports

Includes: year-end summaries and PDF exports

• Retention period: 7 years from the end of the relevant tax year
• Legal basis: Revenue record-keeping obligations

Authentication Data

Includes: hashed password, session tokens, login history

• Retention period: Duration of account; session tokens expire after 7 days of inactivity
• Legal basis: Security and fraud prevention (legitimate interests)

Technical and Error Logs

Includes: IP addresses, error logs, feature usage logs

• Retention period: 90 days
• Legal basis: Service stability and security monitoring (legitimate interests)

Payment Records

Includes: subscription status, payment dates, amounts

• Retention period: 7 years from date of transaction
• Legal basis: Irish accounting obligations and VAT records
• Note: Card details are held by Stripe only — not by Filed

Support and Communications

Includes: emails or messages you send to Filed support

• Retention period: 3 years from date of communication
• Legal basis: Legitimate interests (handling disputes and complaints)

Marketing Data

Includes: email addresses of subscribers who have not yet registered

• Retention period: Until unsubscribe or 2 years of inactivity, whichever is sooner
• Legal basis: Consent

3. Deleting Your Data

How to delete your account

Go to Settings → Account → Delete Account. This will:

• Immediately revoke your access to Filed
• Delete your account profile immediately
• Schedule your financial records for deletion after the 7-year Revenue retention period
• Send you email confirmation of the deletion

Data Subject Erasure Requests

You may also request deletion by emailing dpo@filed.ie. We will respond within 30 days. Note that we may need to retain certain financial data for 7 years to comply with Revenue requirements even after an erasure request.

4. Automated Deletion

Filed runs automated deletion processes that:

• Delete technical logs older than 90 days
• Expire session tokens older than 7 days of inactivity
• Remove marketing records meeting the inactivity criteria
• Flag financial records that have passed the 7-year retention window

5. Your Rights

You have the right to request information about what data we hold about you and how long we intend to keep it. See our Privacy Policy for your full rights under GDPR.

6. Contact

Data protection queries: dpo@filed.ie
General enquiries: legal@filed.ie
Website: filed.ie/privacy

Erasure requests and Revenue records

When you or your accountant ask us to erase data, we delete it straight away, except business records that Revenue requires be kept for six years from the end of the tax year they relate to (Taxes Consolidation Act 1997, s.886). Those records are kept only until 1 January of the seventh year after that tax year, and are then deleted. We tell you which records were kept and until when.