Account records
Active-account data is retained while needed to provide authorized employment access. A deletion request immediately disables access, revokes web and native sessions, removes push-delivery capability, and queues an idempotent account-owned personal-data purge that must finish within 24 hours. Retained employer audit evidence is a separate category.
Employment, KPI, and program history
Offboarded employees disappear from current shared technician views. Existing legacy deidentified KPI records and required program records may remain for three years. Deidentified security and administrator audit records may remain for one year. These records are disconnected from the deleted app account and remain available only to authorized roles.
Branch goal revision evidence
Immutable branch goal revisions are restricted evidence of target changes. Account deletion clears the recorded editor reference; it does not delete these revisions or prove that all retained evidence is unlinked or anonymous. The current cleanup does not automatically expire goal revisions. A future expiration or deidentification process requires a separate reviewed decision; no short-term deletion is introduced by account removal.
Planned compensation and review records—not yet enabled
New bonus-estimate history, driving-score evidence, work-note reviews, and related accounting and source-verification records are not yet enabled. Romex retains finalized bonus history indefinitely. Supporting evidence is preserved as recorded at payroll close without automatic short-term expiration, including the minimized source, Driver, review, accounting, and branch evidence supporting those results. This does not freeze live source heads or prevent legitimate invalidation and audited corrections. The existing three-year cleanup does not automatically cover these new record classes.
Removing an app account disables access and removes account-owned credentials, preferences, and delivery data through the account-deletion workflow. It does not automatically erase independently retained employer reporting, finalized compensation-estimate history, or its audit evidence. These records can remain linked to an employee or administrator; restricted access is not the same as anonymization. A correction to finalized results must preserve the audited history. Technicians whose canonical FieldRoutes identity is inactive are excluded from ordinary Bonus reports, exports, and their displayed totals. Stored awards and the complete restricted finalization audit are not deleted or recalculated because employment status changes.
Application retention and service-provider retention are separate. In particular, a request not to store an OpenAI response does not establish zero provider retention. Those controls and the final employee notice must be verified before automated review is enabled. Raw TRUCE sessions, locations, and device or contact identifiers are not retained under this policy. Existing account-security cleanup and backup-aging schedules are unchanged. Lifecycle and restore behavior still require verification before activation.
Restricted payment snapshots
The product owner approved the minimized collection purpose and access controls on August 5, 2026. Production payment ingestion remains disabled until the historical backfill and source-coverage checks reconcile. Approved imports are append-only so later corrections and refunds do not erase the prior as-of record.
Messages, personal content, and devices
Account preferences, passkeys, recovery codes, device tokens, notifications, support reports, and personal account identifiers are deleted. Message participation and read state are removed. Authored message or social content is deleted or replaced with a nonidentifying tombstone when conversation continuity must be preserved for another participant.
Backups and legal holds
Expired data is removed from production and ages out of encrypted backups under the daily and monthly backup schedule, no later than 365 days after deletion unless a documented legal hold applies. A hold must identify the record class, reason, approver, and expiration; it cannot silently restore application access or a deleted identity.