Data Retention and Deletion Policy

Data Retention and Deletion Policy Operator: D3 REI, LLC, a New Jersey limited liability company doing business as SignREI ("SignREI," "we," "us," or "our") Platform: signrei.com and all related services (the "Platform") Effective date: June 22, 2026 1. Purpose and scope This Data Retention and Deletion Policy ("Policy") governs how long SignREI retains data processed through or in connection with the Platform, and how that data is deleted. It applies to all data SignREI holds, including Sender account data, data SignREI processes on behalf of Senders, and data SignREI generates in operating the Platform. This Policy works together with our Terms and Conditions, Privacy Policy, and Electronic Records and Signatures Disclosure. Where this Policy and a written customer agreement differ, the customer agreement controls for that customer. 2. Guiding principle: retain the minimum SignREI retains data only for as long as it serves a legitimate operational purpose or is required by applicable law, and no longer. When data is no longer needed for the purpose for which it was collected, and is not subject to a legal-hold or legal-retention requirement, it is eligible for deletion. SignREI is not a system of record and assumes no obligation to retain any document, signature, audit record, or other data except where retention is required by law. 3. Roles and responsibilities Senders. Each Sender is the controller of its documents and the data within them and is solely responsible for retaining its own executed documents and any records it is required by law to keep. Senders must download and independently store their completed documents and audit records at or before completion of signing. SignREI does not serve as a Sender's archive or recordkeeping system. SignREI. SignREI maintains data only as needed to provide, secure, and operate the Platform, to meet its own legal, tax, and accounting obligations, and to enforce its agreements. SignREI sets internal retention defaults consistent with this Policy and may adjust them. 4. Retention standards The periods below are maximum guidelines and internal defaults, not commitments. SignREI may delete data sooner in its discretion, and may retain data longer only where required by law or subject to a legal hold under Section 5. Data categoryRetention standardCompleted documents, signatures, and audit recordsSignREI is not a system of record. These may be made available to the Sender for a limited period after signing is completed and are subject to deletion thereafter at SignREI's discretion. Senders are responsible for retaining their own copies.Signer personal information within documents (e.g., name, email, IP, device data, signature image)Processed on behalf of the Sender; deleted together with the related document, on the Sender's documented instruction, or when no longer needed to provide the Platform, whichever is earlier.In-progress or incomplete signing sessionsRetained only while needed to complete the transaction; eligible for deletion after the session expires or is abandoned.Sender account and profile dataRetained while the account is active and for a limited period after closure as needed for legal, security, and operational purposes, then deleted.Billing and payment recordsRetained as needed to meet applicable tax, accounting, and recordkeeping obligations (generally not exceeding seven years), then deleted.Technical, security, and access logsRetained for a limited period to support security, fraud prevention, troubleshooting, and operations (internal default typically not exceeding 24 months), then deleted or de-identified.Support and other communicationsRetained for a limited period after the matter is resolved, then deleted. Where SignREI de-identifies or aggregates data so that it no longer reasonably identifies an individual, that data is not subject to this Policy and may be retained and used as permitted by law. 5. Legal holds and required retention Notwithstanding any other section, SignREI will retain data beyond its standard period when retention is required by applicable law, regulation, subpoena, court order, or governmental request, or when the data is reasonably necessary to a pending or anticipated legal claim, investigation, dispute, or audit (a "Legal Hold"). When a Legal Hold applies, deletion of the affected data is suspended until the hold is lifted. A Legal Hold overrides any deletion request, including a Sender instruction or a privacy-rights request, to the extent permitted or required by law. 6. Deletion and disposal When data reaches the end of its retention period and is not subject to a Legal Hold, SignREI deletes or de-identifies it using methods reasonably designed to render it unrecoverable in the ordinary course. Data may persist for a limited additional period in encrypted system backups until those backups are overwritten or expire on their normal cycle; backup data is not restored to active use except for disaster recovery and is deleted in the ordinary course. 7. Deletion and privacy-rights requests SignREI honors verified deletion requests as required by applicable privacy law. Because SignREI acts as a service provider or processor for Signer and document data, a Signer's request to delete information contained in a document should be directed to the Sender that sent it; SignREI will act on the Sender's documented instructions and as required by law. SignREI may decline or defer a deletion request to the extent retention is required by law or a Legal Hold, or where an exception under applicable law applies. 8. No system of record; limitation SignREI is not a system of record and is not an archive. SignREI has no obligation to retain, back up, or maintain any data except as required by law, may delete eligible data at any time with or without notice, and is not liable for any loss of, or inability to access, any data. Senders bear sole responsibility for retaining the records they need. 9. Review and changes SignREI may review and revise this Policy and its internal retention defaults at any time. Changes take effect when the revised Policy is issued or posted with a new effective date. 10. Contact D3 REI, LLC dba SignREI 921 Pleasant Valley Ave, Suite 425 Mount Laurel, NJ 08054 sign@signrei.com