# VenturePath Retention & Deletion Schedule: Owner and Counsel Review Copy

**Version:** 0.1 · **Review date:** 25 July 2026

> Periods are proposed product requirements and must be confirmed against purpose, contracts, limitation/accounting duties, customer needs, vendor capability, and launch law.

| Record | Proposed active period | Disposal trigger/process |
|---|---|---|
| Unverified registration | 24 hours | Delete if verification not completed; rate-limit/security logs separate |
| Account/profile | Account life | Delete/anonymize after closure and recovery period unless lawful hold |
| Legal acceptance receipt | Agreement life + `[COUNSEL PERIOD]` | Immutable minimal proof; restrict access; delete when claims/compliance purpose expires |
| Optional consent history | While relevant + proof period | Preserve grant/withdrawal history minimally; stop processing promptly on withdrawal |
| Active venture/project | Project/account life | Export; 30-day disclosed recovery window; purge active data |
| Project versions/snapshots | Project life or user policy | User-configurable; included in deletion/export rules |
| Deleted-project backups | Maximum 90 days proposed | Expire through tested backup rotation; no routine restoration to live use |
| Authentication/security logs | 90–365 days risk-based | Restrict, rotate, aggregate where possible; extend only for active incident/hold |
| Audit history | Agreement + `[COUNSEL PERIOD]` | Minimize content; preserve integrity and lawful attribution |
| Customer research contact key | Study-specific short period | Delete at published study date; keep pseudonymized findings only if consent/law allows |
| Interview recordings/transcripts | Study-specific, default no longer than needed | Delete raw recordings before derived notes where feasible; propagate to AI/transcription vendor |
| Support tickets | 24 months proposed after closure | Remove unnecessary attachments/sensitive data earlier |
| AI inputs/outputs | User/project policy | Prefer no provider retention; delete with project unless needed for incident/audit and disclosed |
| Product analytics | 13 months maximum proposed | Aggregate/anonymize earlier; delete identifiers; honor withdrawal |
| Marketing preference/suppression | While active; minimal suppression after opt-out | Stop messages promptly; retain only what prevents re-contact where lawful |
| Privacy request file | Request closure + `[COUNSEL PERIOD]` | Restrict identity evidence; delete excess verification material promptly |
| Incident record | Incident closure + legal/security period | Preserve minimum evidence, decisions, notifications, and remediation |

Deletion must cover active database, object storage, search indexes, caches, vendors, exports controlled by VenturePath, and backup expiry. A user-created download cannot be remotely deleted. Legal holds require named authorization, scope, start/review date, and release.