Last updated: July 18, 2026
This policy explains how long Tax Corpus retains the personal information, tax records, and documents you share with us, and the basis on which we delete or anonymize them. This document supplements our Privacy Policy.
1. Why We Retain Data
We retain customer records to deliver our services, respond to compliance queries or statutory audits from tax authorities (such as the IRS, HMRC, FBR, and provincial revenue boards), defend potential legal claims, comply with cross-border anti-money laundering (AML) obligations, and maintain a verifiable audit trail of our professional work.
2. Retention Periods
The table below describes the standard retention periods for each category of data. Where a regional statutory minimum applies, we keep records for at least that mandatory period.
| Category | Examples | Retention Period |
| KYC & Identity Documents | Passports, driver’s licenses, utility bills, Articles of Organization/Incorporation, beneficial ownership details. | For the duration of the professional engagement, plus a minimum of 5 to 7 years following termination to comply with US, UK, and Pakistani AML regulations. |
| Tax Filings & Supporting Workpapers | Tax returns, schedules, P&L statements, balance sheets, 1099/W-2 forms, bank statements, receipts. | 6 to 7 years from the date of filing or the statutory deadline (whichever is later), aligned with IRS, HMRC, and FBR audit window limitations. |
| Business Registration Records | State formation documents, Companies House filings, SECP/FBR certificates, corporate bylaws, partnership deeds. | For the active life of the corporate entity, plus an additional 6 years following the dissolution or strike-off of the entity. |
| Order & Payment Records | Invoices, receipts, bank transfer logs, payment gateway ledger data. | Up to 7 years for international corporate accounting, financial reporting, and tax compliance purposes. |
| Customer Communications | In-portal chat logs, support emails, video consultation notes, advisory briefs. | Linked directly to the related service order; permanently purged or anonymized when the corresponding order record reaches its end-of-life. |
| Account Profile & Credentials | Legal names, emails, phone numbers, securely hashed authentication credentials, login history. | Kept while your client portal account remains active; permanently deleted upon a verified account-deletion request, subject to overriding statutory legal holds. |
| Marketing & Newsletter Data | Subscription status, marketing consent logs, opt-in/opt-out events. | Maintained continuously until you unsubscribe. When you opt-out, your email is moved to a permanent suppression list to honor your preference. |
| Analytics & Technical Logs | Page views, system error logs, IP access histories, firewall/security audit logs. | Up to 24 months for standard performance diagnostics and product analytics; security-critical logs may be held longer for active investigations. |
3. Backups and Disaster Recovery
Encrypted server backups are taken automatically on a strict, rolling schedule. Records deleted from live database systems persist in encrypted backups for a short rotation cycle (typically 30 to 60 days) before being completely overwritten by newer backup blocks. Restoring data from these systems is strictly reserved for disaster recovery protocols—never for re-introducing data that a customer has formally requested to erase.
4. Deletion at End of Life
When a specific retention period concludes, records are either permanently and securely overwritten or irreversibly anonymized. When a client requests account deletion, a cascading wipe is triggered through our internal portal. This removes active orders, custom forms, messages, and structural profiles, preserving only the absolute minimum baseline required for cross-border regulatory or audit compliance.
5. Your Rights
Under international privacy frameworks (including the GDPR and US state privacy laws), you can request a copy of your stored data, ask us to rectify mistakes, or request the deletion of your user profile. We will honor your deletion request to the maximum extent permitted by law; however, please note that we cannot delete tax workpapers, filed tax returns, or active AML identification documents while statutory record-keeping periods remain legally active.
6. Contact Us
To exercise any of your privacy choices, submit a data access request, or ask questions about our data management practices, please contact our compliance desk:
Tax Corpus
- Email: [email protected]
- Phone: +92 336 6518 557
- Business Hours: Monday – Friday, 10:00 AM – 7:00 PM
This document is provided for informational purposes and does not constitute formal legal advice. Statutory retention periods are subject to shifting regional legislation; we will update this policy actively as global rules evolve.