Each file is encrypted as soon as you add it. It reaches the firm when you press the Send button, and the firm is told in its own account that something has arrived. Your documents are stored in India, on AWS in Mumbai. The firm's people can open them only while signed in to the firm's account and only when their role allows it. Who can see what you upload explains this.
The notice you agreed to says how long the firm keeps your documents. The page shows it as Retention and your receipt repeats it. The period counts from the day you send each document. When it ends, the document is deleted. We destroy the key that protects the file, so it can never be read again, and then we remove the file.
The notice may word the period in one of two other ways. It may say "As long as you remain a client", with no date until the firm records that the relationship has ended. It may add a second period, such as "then a further 5 years as the law requires". The law's period then starts when the first one ends, and the documents are deleted when it ends.
Before the date, the firm can ask you to renew your consent, delete the documents earlier, or keep them longer by recording a reason. A reason is either that a law requires it or that you are still its client. If the firm keeps them longer, the date changes. Your rights link shows the current date under Deletes on.
After a deletion, the firm keeps a record that your documents existed and were deleted. The record holds each document's fingerprint, size and dates, together with the record that you gave consent. A fingerprint is a code worked out from the file that identifies it without containing it. The record does not hold the document.
For example
Amaltas Deshmukh & Co sends Anita Deshpande a request on 1 July 2027 with a retention period of 1 year. Her notice says up to 365 days. She sends everything on 1 July 2027, so her documents are deleted on 30 June 2028. Until then her rights link shows Deletes on 30 June 2028.