What we hold, what we don't.

The minimum the calc engine needs.

Every field below is read by at least one calc rule. If a field doesn't feed a calc, it isn't on the list and doesn't live in the database.

• Display name. Operator-chosen — typically the client's name, but any firm-managed convention works (initials, reference, file number). The label exists so the paraplanner can find the right case; the calc engine never reads it.
• Date of birth. Age-precision matters — a few months either side of state-pension age changes available actions on the LSA, on the LSDBA and on protection regimes.
• Tax residency status, marital status. Drives the rUK / Scottish split and any spousal apportionment on the bond side.
• Protection status. Structured field — enhanced, primary, fixed (2012 / 2014 / 2016), individual (2014 / 2016). Affects LSA and LSDBA ceilings, never free-text.
• Pension policies + contribution and event histories. The DB and DC schemes feeding the PIA test, plus the prior three years of inputs that drive carry-forward (PTM055100).
• Headline income figures by year. Threshold income, adjusted income, relevant UK earnings. Single numbers per year per category — not the granular payslip lines they were derived from.

Not required, and invisible to the calc engine.

None of the fields below feed any calc rule, so the engine never reads them and we never ask for them. Any identifying information a paraplanner does enter is encrypted at the application layer before storage; the calc engine never reads it.

• NINO. Not a calc input on either tool. HMRC's own pension and bond worked examples don't use one, so the engine never reads it. If your firm enters it in the client record it is encrypted at the application layer; we never require it.
• Address. We don't run postcode-by-postcode advice surfaces, so no calc rule reads an address. We recommend identifying clients via the client reference your firm picks; where an address is entered it is encrypted at the application layer and is never seen by the engine.
• Scheme member reference numbers. The PIA test uses opening and closing capital values (PTM053100) or contributions paid (PTM044100). Neither needs the scheme membership number, so it doesn't enter the client record.
• Employer details and payslip data. Income context comes in as the headline figures per tax-year category, not the granular salary lines or payroll IDs they were derived from. The P60 your paraplanner uploads is parsed for the three or four figures the calc needs and then deleted.
• Dependant identifying details. Where a calc references dependants (death-benefit allowance apportionment, for example), the input is a count plus structured tags, never named individuals.

Three buckets, you in control.

Source documents. P60s, pension scheme statements, chargeable-event certificates and the other PDFs you upload for figure-extraction are stored in UK-region object storage, parsed by the extraction layer, and then permanently deleted 24 hours after they were created. An hourly cron is the enforcement point. Nothing carries over between paraplanner sessions.

Parsed extractions. The structured field data lifted from each document lives on in the client record. That's the audit artefact — a paraplanner returning to the file in eighteen months can see exactly which figures fed the calc and where each one was provenance-tagged from. It's yours to delete on demand; otherwise a finalised calculation is kept for the period your firm sets — six years by default — then deleted automatically.

Output PDFs. The compliance annex you download is kept alongside the calculation it belongs to, so you can re-fetch without re-running the calc. It goes the moment you delete the record (export it first if you need a copy), and otherwise lapses with the calculation under your firm's retention window.

Source: app/api/cron/purge-extractions/route.ts · FCA SYSC 9

Frozen at calc time. Replayable years later.

Every calculation persists the full input set, the engine version (sourced from package.json at build time), the tax-year config version, the calc date, the inputs in pence-integer form, every intermediate step, and the result. Twelve months on, feeding those inputs into the engine at the recorded version produces a byte-identical output.

Results are immutable and replayable. More on replayability.

Self-serve, within UK GDPR Art. 17 limits.

Any firm member deletes a client, policy, calculation or draft on demand — the record and its stored documents and PDFs are hard-deleted. Firm owners can delete the whole firm and its client PII from Settings → Firm → Danger zone. We don't keep a residual beyond what you choose: finalised calculations lapse on the window your firm sets (six years by default), and you can export anything first. You are the controller and hold your own FCA record.

Subject-access (Art. 15) and portability (Art. 20) are available at Settings → Account → Export my data. We respond to any other request inside 30 days at info@paraplanai.co.uk. Privacy notice §7 has the full list of rights.