WageShield H-1B exists to organize employment records you already have. This page describes exactly what the running software stores, what it refuses to store, and how you remove it. Where the behavior is enforced in code rather than promised in prose, it says so.
What we store
Your account email, display name, and a PBKDF2-SHA256 password hash. The plaintext password is never stored or logged.
A session record holding only the SHA-256 hash of your session token, plus its expiry.
Case settings, the structured facts you reviewed, your corrections, generated findings, and report selections.
Documents you upload and reports you generate, in private object storage under random case-scoped keys.
Operational audit events containing opaque IDs, file size and type, stage names, counts, rule version, and timestamps.
When you request AI review, the case stores the provider/model, prompt versions, opaque run and candidate IDs, verifier decision, and cited page—not the provider API key.
Optional AI evidence review
AI processing is off for an upload unless you explicitly select it. When selected, a bounded set of document pages and the declared document type are sent to the configured OpenRouter inference API for extraction and a separate grounding check. WageShield does not separately add your account email, password, case ID, or existing case history, but the selected pages naturally include whatever information appears in the document.
OpenRouter states that it does not retain prompts or completions unless the account explicitly opts into prompt logging. Downstream model hosts have separate policies; WageShield requests endpoints that deny provider data collection by default. Review OpenRouter's current provider logging documentation before opting in. WageShield does not use evidence or model output to train a model. Leave the option unchecked to use only local text parsing and manual review.
What we deliberately do not store
No analytics, advertising, or third-party tracking scripts of any kind.
No raw document text or evidence excerpts in application logs.
No structured SSNs, passport numbers, bank accounts, or payment credentials — the product never asks for them.
No copy of your private case material in the separate official-source corpus.
No employer, agency, or third-party notification. WageShield never contacts anyone on your behalf.
How long we keep it
Every review carries its own retention window, which you choose and can change at any time. Options run from 1 hour to 7 days, defaulting to 24 hours. Changing the setting restarts the window from that moment.
Expiry is enforced by a scheduled retention job that runs on the */15 * * * * cron schedule. It deletes expired cases, their stored objects, and their audit rows, and it verifies each object is gone before reporting success. Expired cases also stop being readable immediately, before the sweep reaches them.
Deleting a review
The Privacy tab of any review deletes it immediately. Deletion inventories every stored object for the case, removes them, confirms each is unreadable, then removes the case row, documents, reports, findings, corrections, and audit events.
One record survives: a deletion tombstone holding a one-way SHA-256 hash of the case ID, the request and completion timestamps, and the policy version. It contains no case content and cannot be reversed into a case ID. It is the only case record retained in the active database so a deletion can be proven.
Render continuously retains point-in-time recovery data for the paid PostgreSQL service. On this Hobby deployment, a prior database state can remain recoverable to an authorized workspace administrator for up to three days. Recovery copies are not served by WageShield; the operator must not restore deleted records into the live service and must reapply deletions before using any disaster-recovery database.
Who can reach your records
Every read of a document, report, or case resolves through a database ownership check against your authenticated account before any bytes are returned. A case belonging to another account returns the same response as a case that does not exist, so the API cannot be used to discover which reviews exist.
Stored objects are never exposed as public URLs. Owner identifiers are stripped from every JSON response.
Email and your choices
WageShield sends exactly one kind of email: a single-use password reset link you requested. There is no marketing list and no way to opt into one.
To access, correct, export, or delete your data, use the account and review controls in the product, or write to dgbhanderi20@gmail.com. Do not include private records or credentials in that message.
Scope and limits
WageShield organizes evidence and spots documentary differences. It does not decide that a law was broken, calculate a legally owed amount, file a complaint, or contact an employer or agency. Findings are inputs to a conversation with a qualified professional, not legal advice.