Privacy notice

Information processed for a calculation

An authorized lender user may enter service dates, pay information, duty information, a ZIP code, and other fields needed by the selected tool. Income Recon uses those values to return the current result. The service does not retain those applicant inputs, uploaded pay records, or calculation results in the client account database.

This release does not retrieve SCRA records. The lender obtains any SCRA result through its own authorized process and enters only the information needed for the calculation.

Account and security information

Income Recon keeps client organization records, user names, account identifiers, password-verifier data, two-factor authentication setup data, session records, login-attempt records, and security audit events. Passwords are not stored in readable form. This information supports authentication, account administration, abuse prevention, and investigation of security events.

Usage information

The service records which client organization and signed-in user used a tool, the tool name, the type of usage event, and the event time. These records support client reporting, security review, and service operation. They do not include applicant names, calculation inputs, documents, or calculated amounts.

Access and service providers

Account and usage information is available only to authorized client users, authorized Income Recon administrators, and service providers needed to host, secure, and operate the service. Income Recon does not sell applicant information. A client organization remains responsible for deciding who may use its account and for removing access that is no longer required.

Hosting and security providers may automatically create access and diagnostic logs that include an IP address, country or region, user agent, requested route, request time, and related request or security metadata. Income Recon does not intentionally place request bodies, applicant calculation inputs, uploaded documents, or calculation results in those logs.

Retention and deletion

Income Recon applies the following standard retention periods. The automatic cleanup job runs every day.

• Applicant calculation inputs, uploaded records, and calculation results are not retained after the calculation is processed.
• Client sessions expire after 12 hours and administrator sessions expire after 8 hours. Expired session records are removed within 24 hours after expiration.
• Login-attempt records are retained for 7 days and removed within the following 24 hours.
• Usage records are retained for 13 calendar months and removed within the following 24 hours.
• Administrator audit records are retained for 24 calendar months and removed within the following 24 hours.
• An inactive client organization and its associated account and usage records are retained for 30 days after deactivation and removed within the following 24 hours. Reactivating the organization during that period cancels the scheduled deletion.

Active account records are kept while the client relationship remains active. Client administrators may request account closure or user removal through the Income Recon representative identified in the service agreement.

The fixed periods above govern records maintained in the Income Recon application database. Hosting and security providers may retain their access, diagnostic, and threat-detection logs under their own service controls and retention schedules. Those provider-controlled periods may differ from the application periods above.

Questions and requests

For a privacy question or account-data request, email privacy@incomerecon.com. To report a suspected security issue, email security@incomerecon.com. You may also contact the Income Recon representative identified in your service agreement. Do not include an applicant's Social Security number, full date of birth, pay document, or other sensitive information in a message.