DataRetention&DeletionPolicy

This Data Retention and Deletion Policy describes how DriveDocket Solutions LLC ("DriveDocket") retains, manages, and deletes personal information and documents collected through the DriveDocket mobile application (the "Application"). It is intended to complement the DriveDocket Privacy Policy and Terms of Service and to provide users with clear information about their rights regarding their data.

This policy applies to all personal information and documents collected from users of the DriveDocket Application across both the mobile application (iOS and Android) and the web application, including account information, uploaded documents, vehicle records, infraction records, compliance data, and authentication data.

DriveDocket retains personal information only for as long as necessary to provide the service to you and to fulfill the purposes described in our Privacy Policy. Our retention approach is guided by the following principles:

• We do not retain data beyond what is necessary for the stated service purpose.
• We provide you with full control over your data, including the ability to delete individual documents and your entire account at any time.
• We do not sell, license, or otherwise transfer retained data to third parties.
• We apply appropriate security controls to all retained data throughout its lifecycle.

DriveDocket uses optical character recognition to automatically read and extract information from documents you upload — such as expiration dates, names, policy numbers, and violation details — without requiring you to type that information manually.

DriveDocket may retain certain information beyond the periods described above where required by applicable law, court order, or valid legal process. Examples may include:

• Records relevant to litigation, regulatory investigation, or legal proceedings in which DriveDocket is involved.
• Records required by applicable state or federal law for a defined retention period.

Where DriveDocket retains information beyond the standard retention period for legal reasons, that data will be stored securely, access will be restricted to those with a need to know, and it will be deleted as soon as the legal retention obligation has been fulfilled.

6.1 User-Initiated Account Deletion

You may delete your account at any time through the Application Settings (Settings > Account > Delete Account). Account deletion is permanent and irreversible. Upon deletion, the following data is immediately and permanently removed from DriveDocket's systems:

• User account record and all profile information.
• Driver profile and all extracted license data.
• All uploaded documents and all copies stored in AWS S3.
• All vehicle information and records.
• All infraction, citation, and violation records.
• All notification history.
• All push notification tokens.
• All address history.
• All authentication and refresh tokens.

6.2 Account Deactivation

If you wish to temporarily suspend access to your account without deleting your data, you may request account deactivation by contacting DriveDocket at support@drivedocket.com. A deactivated account retains your data but prevents login access. You may reactivate your account at any time by contacting us. Deactivated accounts that remain inactive for more than 24 months will be subject to permanent deletion in accordance with this policy.

6.3 Operator-Initiated Deletion

DriveDocket reserves the right to delete accounts that are found to be in violation of the Terms of Service or that are otherwise determined to pose a risk to the Application or other users. Users will be notified prior to deletion where practicable.

In addition to in-app account deletion, you may submit a data deletion request by contacting DriveDocket at privacy@drivedocket.com. We will respond to verified deletion requests within 30 days. We may request verification of your identity before processing a deletion request.

Certain information may be exempt from deletion where retention is required by applicable law or where the information is necessary to resolve a dispute or enforce our Terms of Service.

8.1 California Residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. DriveDocket does not sell personal information. To exercise your California privacy rights, contact us at privacy@drivedocket.com.

8.2 Other State Privacy Laws

Several states have enacted or are enacting comprehensive consumer privacy laws. As DriveDocket serves users across the United States, we are committed to reviewing and updating this policy as additional state privacy laws take effect. Users in Virginia, Colorado, Connecticut, Texas, and other states with applicable privacy laws may have rights similar to those described above. Contact us at privacy@drivedocket.com to exercise any applicable rights.

All data retained by DriveDocket is stored using the following security measures:

• Encrypted storage using AWS S3 with server-side encryption.
• Secure API communications using TLS/HTTPS protocols.
• Access controls restricting data access to authorized personnel only.
• Automatic session expiry and token revocation to limit unauthorized access.

We may update this Data Retention and Deletion Policy from time to time. When we make material changes, we will notify you through the Application or by email to your registered address at least 14 days before the changes take effect.

For questions about this policy or to submit a data deletion request:

• DriveDocket Solutions LLC, Attn: Privacy
• privacy@drivedocket.com
• www.drivedocket.com