5. Data Retention Policy
5.1 Our Approach
Supreme AI retains personal information and Customer Data only for as long as necessary for the purposes for which it was collected, plus any minimum period required by Australian law. When data is no longer needed and no retention obligation applies, we delete or de-identify it securely.
Our retention periods are set with specific reference to the obligations of reporting entities under section 116 of the AML/CTF Act 2006 (Cth) and Chapter 30 of the AML/CTF Rules, which require reporting entities to retain customer identification records, transaction records, and AML/CTF program documents for a minimum of 7 years.
5.2 Retention Schedule
| Data Category | Retention Period and Legal Basis |
|---|---|
| Customer identification and verification records (KYC, CDD, ECDD) | 7 years from end of customer relationship or relevant transaction. AML/CTF Act s.116; AML/CTF Rules Ch.30. |
| Beneficial ownership records | 7 years from end of customer relationship. AML/CTF Act s.116. |
| AML/CTF Program documents (Part A / Part B / risk assessments) | 7 years from date program version ceases to be current. AML/CTF Act s.116. |
| SMR, TTR, and IFTI drafts, lodgement records, and supporting evidence | 7 years from lodgement or decision. AML/CTF Act s.116. |
| Annual Compliance Report and supporting evidence | 7 years from lodgement. AML/CTF Act s.116. |
| Training records (staff AML/CTF training completion) | 7 years from date of training. AML/CTF Rules. |
| Independent review reports and evidence | 7 years from date of review. AML/CTF Act. |
| Account holder identity and contact details | Duration of account plus 7 years. Tax and corporate records obligations. |
| Billing, invoices, and tax records | 7 years from end of relevant financial year. Income Tax Assessment Act 1936 and 1997 (Cth). |
| Support tickets and AI chatbot conversations | 12 months from closure, unless needed for dispute, audit, or legal proceedings. |
| Marketing consents and preferences | Until consent is withdrawn plus 5 years as evidentiary record. Spam Act 2003 (Cth). |
| Cookie and web analytics data | Up to 13 months. Operational; industry standard. |
| System and access logs (security) | Up to 12 months. Operational; ISO 27001 requirement. |
| Backup data (rolling) | Up to 90 days. Operational continuity. |
| Records destruction log | 7 years from the date of destruction. Internal governance. |
5.3 Deletion on Request
You may request deletion of personal information about you by contacting [email protected]. We will assess each request promptly and within 30 calendar days inform you of the outcome. We may decline to delete information where:
- Retention is required by the AML/CTF Act, AML/CTF Rules, or other Australian law (for example, customer identification records that you as reporting entity must retain under s.116)
- The information is reasonably necessary for our own legal or regulatory obligations
- The information is necessary to complete a legal proceeding or investigation in which we are involved
Where we cannot delete information, we will explain the reason and, where practicable, restrict further use of the information to the minimum necessary for the retention purpose.
5.4 Account Closure
- You may export your Customer Data at any time from the Platform and within 30 calendar days of account closure
- Production Customer Data is removed within 60 calendar days of account closure, unless a legal retention obligation requires otherwise
- Backup data expires within 90 calendar days of last write
- De-identified analytics data may be retained indefinitely
5.5 Secure Deletion
Deletion is performed using cryptographic erasure for encrypted volumes and certified overwriting for magnetic media. Physical media is destroyed in accordance with AS/NZS standards. Our service providers are contractually required to apply equivalent standards. We maintain a records destruction log, itself retained for 7 years, capturing what was destroyed, when, by whom, and under what authority.