1. Summary
Eva Store does not have one retention period for all data. Different records serve different purposes: operating your account, delivering a service, keeping financial and dispute records, and securing the platform. The table below describes the current technical behaviour and marks the periods that still need legal and operational approval.
This is not an approved legal retention schedule. The periods marked [OWNER/LEGAL APPROVAL REQUIRED] must be approved and applied consistently before this page is published as final.
2. Retention by category
| Category | Current retention or behaviour | Status |
|---|---|---|
| Account and profile | Kept while the account exists. After a deletion request, the account enters the grace/hold/anonymisation lifecycle. | Identifying fields cleared at anonymisation. |
| Student and client details | Kept while the account exists; rows deleted at anonymisation. | Verified in the deletion workflow. |
| Profile image | Released to storage cleanup at anonymisation. | Verified. |
| Messages and attachments | Kept for conversation participants, dispute integrity, and safety. After deletion, linked to an internal identifier with the name removed. No maximum period is published. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Service requests, quotes, deliveries, revisions, disputes | Kept for service and dispute integrity and the other party's history. No maximum period is published. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Orders, payments, refunds, vouchers, points, subscriptions, finance records | Kept for financial integrity and legal obligations. No maximum period is published. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Reviews and provider responses | Public after moderation; kept for service history. No maximum period is published. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Notifications | Purged after about 180 days by the notification retention job. | Technical setting; legal approval pending. |
| Push-device registrations | Kept until the device is revoked, you sign out everywhere, or the account is deleted. The current deletion workflow does not remove them automatically. | Known gap. |
| Presence / last seen | Stored as a timestamp; you can hide it. It is not removed by the current anonymisation workflow. | Known gap. |
| Audit logs (including IP and user agent) | Append-only; no automatic retention period. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Outbox, integration, extension, and MCP records | Purged after about 30 days. | Technical setting. |
| Raw advertising events | Rolled up after 3 complete UTC days; raw events purged after 10 days. | Technical setting. |
| Pending uploads | Upload window is 30 minutes; expired uploads are cleaned up. | Technical setting. |
| Download links | Short-lived signed URLs, maximum 5 minutes. | Technical setting. |
| Backups | Provider-dependent; not individually restored into the live service. | [OWNER/LEGAL APPROVAL REQUIRED] |
| Legal holds | Block erasure until released. | Verified in the deletion workflow. |
3. Why records are kept after deletion
Deleting your account does not automatically delete records that belong to another participant's history or that the operator must keep for financial, dispute, security, or legal reasons. The deletion workflow anonymises your identifying profile fields and detaches records from your name as far as the workflow allows. It does not rewrite the other party's conversation history.
4. Deletion timeline
The account is deactivated immediately. The grace period is configured by the operator; the backend default is 30 days and the allowed range is 1–90 days. Final processing starts after the grace period and after any hold is released. A fixed completion target is [OWNER/LEGAL APPROVAL REQUIRED].
See Account deletion for the full workflow and the current gaps.
5. Your choices
You can correct profile data, hide your last-seen time, change notification preferences and quiet hours, revoke devices, deactivate your account, or request deletion. Privacy requests are handled through the in-app support conversation; identity is verified before a sensitive request is executed.
6. Approval status
The following must be approved before this page is final: the maximum retention period for messages, service records, financial records, reviews, and audit logs; the legal basis for each; the backup retention period; the deletion completion target; and the treatment of the known deletion gaps. [OWNER/LEGAL APPROVAL REQUIRED]