Zero Data Retention (ZDR) Policy

1. Overview

ExactCov (operated by Productimiser Ltd) implements a strict Zero Data Retention (ZDR) policy. All uploaded credit agreements, compliance certificates and borrower financial documents, together with any extracted files, are automatically and permanently deleted within 24 hours of upload. No exceptions.

This policy applies to all data processed through the ExactCov platform, including data submitted via the web interface, API, and any white-label or partner integrations.

2. Scope

The following data is subject to automatic deletion within 24 hours of upload:

• Original uploaded files - Credit agreements, compliance certificates and any other uploaded borrower financial documents
• Extracted data files - CSV, Excel, and JSON outputs generated from uploaded documents
• Temporary processing data - Any intermediate files created during OCR extraction, parsing, and validation
• Cached analysis results - Any stored outputs from covenant extraction and monitoring engines (covenant terms, financial ratios, compliance test results, etc.)

3. The 24-Hour Deletion Window

When a document is uploaded to ExactCov:

• The file is processed, extracted, and analysed immediately upon receipt.
• The customer has 24 hours to retrieve results via the API or web interface.
• After 24 hours, all files and extracted data are permanently deleted.
• Deleted data cannot be recovered by any party, including ExactCov.

4. Data Retained Outside ZDR Scope

The ZDR policy applies to uploaded documents and their derivatives. The following operational data is retained separately and does not contain the content of credit agreements, compliance certificates or other borrower financial documents:

None of this retained data includes the actual content of credit agreements, compliance certificates, extracted covenant data, or borrower financial information.

5. Technical Implementation

The ZDR policy is enforced through the following technical controls:

• Automated deletion jobs - Scheduled processes run continuously to identify and remove expired files from all storage locations.
• No backup retention of file content - Deleted files are excluded from system backups. Uploaded document content is never included in backup archives.
• Secure erasure - Files are securely deleted from storage, not merely marked as deleted.
• Storage isolation - Uploaded files are stored in dedicated, isolated storage (Cloudflare R2) separate from application databases and infrastructure.

6. Regulatory Alignment

The ZDR policy supports compliance with:

• UK GDPR - Data minimisation principle (Article 5(1)(c)) and storage limitation principle (Article 5(1)(e)).
• Data Protection Act 2018 - Processing limited to what is necessary for the stated purpose.
• FCA Consumer Duty - Minimising risk to consumers by limiting the window during which sensitive financial data is held.

7. Customer Responsibilities

Customers using the ExactCov platform should be aware that:

• API responses and exported files must be retrieved within 24 hours of upload.
• Customers are responsible for storing results on their own systems once retrieved.
• If re-processing is required after the 24-hour window, the original file must be uploaded again.

8. Contact

For questions about this policy:

Email: legal@exactcov.com

Web: exactcov.com

Company: Productimiser Ltd, InfoHub, 41 Petley Road, London, W6 9SU (Company No. 15016956)

This policy is reviewed annually and updated as necessary to reflect changes in technology, regulation, or business operations.