What we hold, and why.

The minimum the calc engine needs.

Every field below is read by at least one calc rule.

• Age. Age matters: whether a serious ill-health lump sum is paid, or the member dies, before or after age 75 decides whether that lump sum or death benefit is tested against the LSDBA or taxed as income.
• Scottish or rest-of-UK taxpayer. Sets the income-tax bands for non-savings income.
• Protection status. Structured field — enhanced, primary, fixed (2012 / 2014 / 2016), individual (2014 / 2016). Affects LSA and LSDBA ceilings, never free-text.
• Pension policies + contribution and event histories. The DB and DC policies feeding the PIA test, plus the prior three years of inputs that drive carry-forward (PTM055100).
• Headline income figures by year. Threshold income, adjusted income, relevant UK earnings. Single numbers per year per category — not the granular payslip lines they were derived from.

What your firm records, and how it is stored.

• Client record. A full name (required; it can be a reference or initials rather than a real name), and optionally a date of birth, National Insurance number, address and email. Each is encrypted at the application layer (AES-256-GCM) before it reaches the database. The name prints on the compliance annex; the calc engine and the audit record use an anonymised client reference instead. Two of these fields can feed a calculation. The LSA and LSDBA calculations work out from the date of birth whether the member was under or over 75. The annual allowance and carry-forward calculations check an entered address's postcode to flag that the client may be a Scottish taxpayer, and the bond calculations stop if it looks Scottish, because they do not yet support Scottish income-tax bands. Only the under-or-over-75 answer or the yes/no flag goes on to the calculation; the date of birth and the address themselves never reach the calc engine.
• Policy records. Plan numbers are encrypted in the same way, with a keyed hash kept beside them so a new document can be matched to the right policy. The policy form asks for one; a policy added in the carry-forward workflow or from a provider pack without one is given a placeholder reference instead. Beneficiary names, where your firm records them on a policy, are encrypted too. The calc engine never reads either.
• Details read from documents. The details lifted from an uploaded document can include identity details the document prints: the member's name, date of birth, NI number and plan number, or a P60's employer name and PAYE reference. They are held on the extraction record in our database, which is encrypted at rest, without the extra application-layer encryption the client record has. They follow the extraction windows in §04.
• Firm activity log. Security and administrative events (sign-ins, invitations, member, billing and deletion events) and document reviews are recorded with the time and, for some events that came from a browser (such as sign-ins, sending invitations and member removals), the IP address and browser used. They are part of your firm's audit trail and are not deleted on a fixed schedule; closing the firm removes the IP addresses and browser details. An entry recording that a client or calculation was deleted also keeps the initials of the member who deleted it, where that member has confirmed their name. A document-review event names the fields the reviewer changed and how confident the extraction was in each, never their values.

Client and policy records have no automatic deletion window: they stay until your firm deletes them. Deleting the firm removes its client and policy records when the request is accepted, including policies not linked to a client. The firm owner can also delete a policy individually, unless it is linked to a filed calculation or has recorded events that would be left behind. Deleting a client removes its policies and calculations. If it has filed calculations, only the firm owner can delete it, after downloading each filed annex and satisfying the two-step sign-in checks.

Not calc inputs, and invisible to the calc engine.

None of the fields below is a calc input. Where they are stored, §02 says how.

• NINO. Not a calc input on either tool. HMRC's own pension and bond worked examples don't use one, so the engine never reads it. Your firm can record it on the client, where it is encrypted, and a statement that prints it can carry it into the extraction record.
• Address. No calc rule reads an address. Where one is entered, the annual allowance and carry-forward calculations check its postcode to flag a possible Scottish taxpayer, and the bond calculations stop if it looks Scottish. We recommend identifying clients by a reference your firm picks.
• Plan and member reference numbers. The PIA test uses opening and closing capital values (PTM053100) or contributions paid (PTM044100). Neither needs a membership or plan number. Where your firm records a plan number on a policy, it is kept encrypted for document matching, and the engine never reads it.
• Employer details and payslip data. Income reaches the engine as headline figures per tax-year category, not the salary lines or payroll references they were derived from. An uploaded P60 is scheduled for deletion after 24 hours; the details read from it follow the extraction windows.
• Dependant identifying details. Where a calc references dependants (death-benefit allowance apportionment, for example), the input is a count plus structured tags. Beneficiary names recorded on a policy are encrypted and the engine never reads them.

Three buckets, you in control.

Source documents. P60s, pension statements, chargeable-event certificates and the other PDFs you upload for figure-extraction are stored in UK-region object storage, parsed by the extraction layer, and scheduled for deletion after 24 hours. This includes provider packs. Automated cleanup runs hourly and retries failed removals; it does not guarantee completion at the exact deadline.

Parsed extractions. Unconfirmed extracted content has a 90-day window. Once confirmed, it follows your firm's retention window from confirmation — six years by default. Raw extraction responses have a separate 30-day window. The audit/provenance record can remain after its extracted content is removed.

Output PDFs. The compliance annex you download is kept alongside the calculation it belongs to, so you can re-fetch without re-running the calc once filed. Draft PDF copies normally have a 30-day window. Deleting the calculation schedules its files for erasure; export them first if you need a copy. Filed annexes otherwise follow your firm's retention window.

Source: our hourly retention job · FCA SYSC 9

Verified before filing. Retained for checking years later.

Every filed calculation persists the full input set, the engine version (the package version plus a content hash of the engine sources), the tax-year config version, the calc date, the inputs in pence-integer form, the steps the result records, and the result. Some working is re-derived rather than stored: the annual allowance charge by band is not stored, and the annex re-derives it from the stored inputs and the retained config version. A later replay at the recorded versions checks the stored result and reports any difference or unavailable version rather than substituting today's rules.

Filed results are immutable and keep the inputs and versions needed to check them. A draft whose exact historic rules are unavailable must be recalculated with current rules before it can be filed. More on replayability.

Self-serve, within UK GDPR Art. 17 limits.

Client, calculation and draft deletion require confirmation and the appropriate firm access. Policies can be archived while preserving their version history; deleting the client removes its policy records. Stored files are queued for erasure and cleanup is tracked to completion. Firm owners can delete the whole firm and its client records from Settings → Firm → Danger zone; policy records are removed at the same time (§02). Finalised calculations follow the window your firm sets (six years by default); export anything you need before closing the firm. You are the controller and hold your own FCA record.

Subject-access (Art. 15) and portability (Art. 20) are available at Settings → Account → Export my data. We respond to any other request within one month at info@paraplanai.co.uk. Privacy notice §7 has the full list of rights.