This standard states how the Company keeps and destroys records: where each class of record is kept, how long it is kept, how destruction is carried out and documented, and the two events that change the schedule: a legal hold and a personal-data deletion request. Keeping everything indefinitely increases breach exposure and conflicts with deletion duties; destroying too early breaks tax law and destroys evidence. How personal information is handled is governed by the Privacy Policy and the Company's position in Data Privacy Posture, which control over this standard where the two meet.
Roles and duties
- The Legal function owns the retention schedule: it assigns each new class of record a retention period when the record type is created, approves every destruction, and decides deletion requests that meet a legal retention duty.
- Each operating team keeps the records its work creates in the place named in the table below, and carries out approved destruction completely, including exported copies.
- The Managing Member approves destruction of any class of record not covered by a period already assigned in this standard.
Where records are kept
| Record class | Where it is kept | Notes |
|---|---|---|
| DMCA notices and case files | The structured notice records and the support case system | Notice record plus correspondence; see DMCA Agent Process |
| Published policies and their versions | The policy store and the policy version history in the admin portal | Every version, with change notes, publisher, and time; the enforcement record |
| Support cases and messages | The support case system | Includes the DMCA queue |
| Transaction and order records | The commerce order records | The commercial record; tax-relevant |
| Seller records and verification material | Seller records and verification artifacts | Verification records carry their own retention logic under the INFORM Act; see INFORM Act Seller Verification |
| Consent records | The cookie consent record and the server-side consent log | Proves what a user chose and when |
| Financial and payment-processor records | The payment processor's records and the wallet and payout records | The money trail; the processor retains under its own schedule |
| Tax filings and workpapers | The Tax Preparer's file and the corporate book | Seven-year retention |
| Corporate records | The corporate book | Formation documents permanent; annual reports per schedule; see Entity Records and Good Standing |
| AI disclosure records | The AI disclosure records | Who was told what, and when |
| Enforcement records | Violation and appeal records | Enforcement decisions need their evidence preserved |
Procedure: retention and destruction
- Classify at creation. Every new record type receives a class and a retention period when it is designed, not years later. A DMCA notice record, for example, is litigation-relevant by nature and follows the legal proceedings class from the day it exists.
- Retain by default. Nothing is deleted until two questions are both answered yes: has the class's period expired, and does no legal hold apply? See Legal Holds.
- Destroy completely. Destruction means the database records, copies in backups as the backup rotation cycles, and exported copies. A record that survives in exported spreadsheets held by individuals has not been destroyed.
- Document the destruction. Record what was destroyed, when, and under which period in this standard. Routine destruction under a stated schedule, documented in this way, is defensible; undocumented destruction is not.
The two events that change the schedule
A legal hold stops the schedule. A legal hold suspends all routine destruction for the records within its scope, even if a period expired the day before. Release of the hold resumes the schedule; it does not retroactively authorize the destruction that was blocked. See Legal Holds.
A deletion request bends the schedule. A person may have a right to deletion of personal information under applicable privacy law. A deletion request does not override a legal retention duty: tax records are kept for seven years regardless of a request: but it does require the Company to delete what may lawfully be deleted and to record what was kept, and why. "The order record was kept because tax law requires it" is a complete answer; "everything was kept because that was easier" is not. Deletion rights and how they are exercised are governed by the Privacy Policy.
Points that cause failures
- Backups. A record deleted from the live records persists in backups until the rotation cycles. That is normal and defensible, provided the backup rotation itself has a defined period. Backups kept indefinitely become the retention policy by accident.
- The policy version history. Every policy version is kept with its publisher and time because it is the proof of what rule was in force on a given date: the exact question an enforcement appeal or a legal proceeding asks. Policy versions are never removed to save space. See Policy Publication and Version Control.
- Email. Legally significant material that arrives or is sent by email: acknowledgment emails, DMCA confirmations, tax notices: is filed to the case or record it belongs to. An inbox is not an archive.
- AI-generated material. Listings written by seller AI tools, triage transcripts, and agent action records are records with their own retention logic, including the 12-month period for agent action records. Classify them when they are created; do not let a new kind of record fall outside the schedule because it is new.
Records created and where they are kept
This standard creates the retention schedule itself, destruction records, and the records made when a deletion request is partly refused on retention grounds. The Legal function keeps them with the corporate records, and destruction records are kept permanently.
Escalation
Any destruction proposed outside an assigned period, any deletion request that meets a retention duty, any discovery that records within a class have been destroyed early, and any question about breach exposure from records the Company holds are escalated to the Legal function at legal@aapawz.com. Breach duties themselves are governed by Data Breach Notification.
Review cadence
The Legal function reviews the schedule, the backup rotation period, and all destruction records once a year.
Related articles