All commercial, personal, and financial information that crosses the Cord platform is subject to clear retention policies, designed to protect your privacy rights — ARCO in Mexico, GDPR in the EU/UK, LGPD in Brazil, and the equivalent law in every other country where Cord operates — and be honest about what happens to your data if you delete your account. The full detail by jurisdiction lives in the Privacy Policy.

Who keeps what, and for how long

• Tax Documents (XML/PDF): Mexico’s Código Fiscal de la Federación (Art. 30) requires keeping accounting records and tax receipts for 5 years — but that obligation belongs to your business as the taxpayer, not to Cord as a software platform. Cord keeps your CFDI for as long as your organization exists, but it isn’t a long-term fiscal archive: if you delete your organization, the documents are deleted with it (see below). That’s why we ask you to export them first.
• Access Audit Logs: Session records, IP addresses, and destructive actions (Audit Trails) of your workforce are kept in hot access for 1 year for forensic investigations.
• Cardholder Bank Data: Cord NEVER stores CVVs or the complete magnetic stripe track. Tokenized Primary Account Numbers (PAN) can be deleted upon explicit request from the end user exercising their privacy rights (ARCO, GDPR, LGPD, or the equivalent in their country) by sending an email to legal@flouvia.com.

If you decide to delete your corporate Cord account, the deletion is real, immediate, and total — it includes the tax documents, not just the transactional databases. Export your CFDI first from Settings › Data & privacy; if you need to recover an already-stamped receipt later, you can also get it directly from the SAT using the folio fiscal.