Data retention schedule
1. Principles
We keep personal data only as long as necessary for the purpose it was collected, plus any legally-mandated retention floor. This page states each floor. When the floor elapses, data is deleted or fully anonymised as part of a monthly retention sweep.
2. Retention matrix
| Data category | Retention | Legal basis |
|---|---|---|
user — profile fields (name, email, locale, preferences) | Until you delete your account | Contract |
Authenticated session tokens | 30 days rolling; revoked immediately on sign-out | Contract, legitimate interest |
purchase_order, order_event and delivery evidence | 7 years after order completion | Tax and accounting obligations |
ledger_entry and payment metadata | 10 years after transaction | Legal obligation (financial records) |
admin_audit (admin action log) | 3 years | Legal obligation, dispute defence |
buyer_audit (buyer profile change log) | 3 years | Legal obligation, dispute defence |
csp_report (CSP violation reports, IP hashed) | 90 days | Legitimate interest (security) |
product_notify_wait (notify-me email queue) | 90 days after notification is sent, or 1 year from record creation, whichever comes first | Consent |
| Support tickets and messages | 2 years after the ticket is closed | Contract, legitimate interest |
| Envelope-encrypted account credentials on delivered orders | Deleted after buyer confirms delivery or escrow auto-releases — never longer than 30 days from delivery | Contract; deletion default |
3. Backup retention
Encrypted, off-site database backups are kept for 35 days on a rolling basis. Deletion requests do not scrub backups instantly; the backup falls out of the rolling window and is overwritten within 35 days.
4. Exercising erasure
You can request account deletion from your settings page. Deletion executes immediately for the profile row and revokes all sessions. Order and financial records are retained to the floors above with your personal identifiers pseudonymised where the underlying legal purpose permits.