# VenturePath Retention & Deletion Schedule: Owner and Counsel Review Copy

**Version:** 0.4 · **Review date:** 2 October 2026

> Amara+ has approved a two-year retention period after account deactivation as the operating policy for this controlled alpha. The current service does not yet provide an account-deactivation state or an automated two-year expiry job. Those controls must be implemented and evidenced before the policy is described as automated. Verified account deletion remains available separately.

| Record | Proposed active period | Disposal trigger/process |
|---|---|---|
| Unverified registration | Current: until verified or manually removed. Proposed: 24 hours | The 24-hour automatic purge is not implemented and must not be claimed as operational |
| Account/profile | Current: active account life. Proposed: 2 years after deactivation if a deactivation feature is introduced | The current service has no deactivation state or two-year purge job. Users can use verified account deletion; lawful holds remain limited and documented |
| Legal acceptance receipt | Active account life plus 2 years after deactivation | Keep only the minimal immutable proof, restrict access, and remove it when the period ends unless a documented lawful hold applies |
| Optional consent history | While relevant + proof period | Preserve grant/withdrawal history minimally; stop processing promptly on withdrawal |
| Active venture/project | Current: project life. Proposed: up to 2 years after deactivation if that feature is introduced | Export; 30-day disclosed project recovery window; then purge deleted project data unless another active member retains the shared venture or a lawful hold applies |
| Project versions/snapshots | Project life or user policy | User-configurable; included in deletion/export rules |
| Deleted-project backups | Maximum 90 days proposed | Backup rotation and verified restoration are not yet operational release controls; do not claim expiry until both are evidenced |
| Authentication/security logs | 90–365 days risk-based | Restrict, rotate, aggregate where possible; extend only for active incident/hold |
| Audit history | Active account life plus 2 years after deactivation | Minimize content, preserve integrity and lawful attribution, and remove it when the period ends unless a documented lawful hold applies |
| Customer research contact key | Study-specific short period | Delete at published study date; keep pseudonymized findings only if consent/law allows |
| Interview recordings/transcripts | Study-specific, default no longer than needed | Delete raw recordings before derived notes where feasible; propagate to AI/transcription vendor |
| Support tickets | 24 months proposed after closure | Remove unnecessary attachments/sensitive data earlier |
| AI inputs/outputs | User/project policy | Prefer no provider retention; delete with project unless needed for incident/audit and disclosed |
| Product analytics | 13 months maximum proposed | Aggregate/anonymize earlier; delete identifiers; honor withdrawal |
| Marketing preference/suppression | While active; minimal suppression after opt-out | Stop messages promptly; retain only what prevents re-contact where lawful |
| Privacy request file | Request closure plus 2 years, or account deactivation plus 2 years if later | Restrict identity evidence and delete excess verification material promptly. Extend only for a documented lawful hold |
| Incident record | Incident closure + legal/security period | Preserve minimum evidence, decisions, notifications, and remediation |

Deletion must cover active database, object storage, search indexes, caches, vendors, exports controlled by VenturePath, and backup expiry. A user-created download cannot be remotely deleted. Legal holds require named authorization, scope, start/review date, and release.

Identity scrubbing from a shared venture removes exact account identifiers and exact display-name values from known structured fields. The substantive contribution, decision, evidence reference and finalized synthesis remain with the venture under an anonymous account label so the shared project and accountability record are not silently rewritten. The process cannot reliably find a person's name, email address or other identifier when a contributor has typed it into unrestricted free text. Shared-venture free text therefore remains with the venture unless a team lead edits it, a valid rights request requires action, or the venture itself is deleted. This limitation must be considered before users place personal data in plan answers, notes or interview content.