🗄️ Data-Retention Statement

| Data Category | System | Retention Period | Deletion Method | |---------------|--------|------------------|-----------------| | Reference Images | Supabase Storage reference-images bucket | 90 days after account deletion | Object delete + bucket lifecycle rule | | Embeddings / Hashes | Postgres reference_images.clip_vec & FAISS | 90 days after account deletion | Row delete, FAISS re-index | | Candidate Thumbnails | Supabase Storage candidate-images | 30 days after takedown case status = removed | Batch object delete daemon | | KYC Documents | Supabase Storage kyc bucket | 2 years after account deletion | Secure wipe | | Billing Records | Stripe | 7 years (tax compliance) | Stripe retention | | Audit Log | Postgres audit_log | 6 years | Not deletable (immutable) | | Analytics Events | Plausible DB | 18 months rolling window | Automatic prune | | Copyright Attestations | Postgres attestations | 6 years | Not deletable (legal defence) |

Last reviewed: 2025-04-27.

---