Data Retention Policy
Last updated March 8, 2026
1. Overview of Data Retention
PlugVerse is committed to transparency about how we handle your data. We retain different types of information for different periods based on legal requirements, business needs, and your rights under privacy laws including GDPR and CCPA.
When you delete your account, we distinguish between:
- Personal Identifiable Information (PII) - Immediately anonymized
- Financial and Legal Records - Retained for 7 years as required by law
- Public Content - May be retained for platform integrity
2. Seven-Year Retention Period
PlugVerse retains certain financial and contractual records for seven (7) years after account deletion. This retention period is legally required for the following reasons:
2.1 IRS Tax Compliance
The Internal Revenue Service (IRS) requires businesses to retain financial records for a minimum of 7 years. PlugVerse must maintain records of all platform transactions, fees, and payouts to comply with federal tax law and provide documentation if audited.
2.2 Sarbanes-Oxley Act (SOX)
The Sarbanes-Oxley Act requires the retention of financial records for 7 years to ensure accurate financial reporting and prevent fraud. As a payment platform, PlugVerse must maintain detailed transaction records.
2.3 Statute of Limitations
North Carolina's statute of limitations for written contracts and fraud claims is 10 years, with a 7-year standard for business records. We retain contract and payment records for 7 years to defend against potential legal claims and resolve disputes.
2.4 Payment Processor Requirements
Our payment processor (Stripe) requires retention of transaction records for chargeback disputes, fraud investigation, and compliance purposes. Stripe's terms mandate maintaining payment-related data for extended periods.
3. What Data Is Retained vs. Deleted
When you request account deletion, PlugVerse follows this data handling procedure:
3.1 Immediately Anonymized (Soft Deletion)
The following personal information is immediately anonymized when you delete your account:
- Full name (changed to "Deleted User [random ID]")
- Email address (changed to "deleted-[random]@plugverse.deleted")
- Phone number (removed)
- Profile photo and media uploads (removed from storage)
- Social media links (removed)
- Bio and profile description (removed)
- Location and address information (removed)
- Authentication credentials (Supabase Auth account deleted)
- Stripe Connect account (deactivated)
3.2 Retained for 7 Years (Legal Requirement)
The following records are retained for 7 years after account deletion for legal and regulatory compliance:
- Contracts: All signed performance contracts, venue booking contracts, and cancellation records
- Payment Records: Gig payments, venue booking payments, platform fees, artist payouts, processing fees
- Transaction History: Payment intents, charges, refunds, transfers, and Stripe transaction IDs
- Tax Information: 1099 forms, W-9 submissions, tax ID numbers, and earnings summaries
- Dispute Records: Chargeback claims, contract disputes, cancellation reasons, and resolution outcomes
- Reliability Scores: No-show incidents, late arrivals, performance ratings, and disciplinary actions
Note: Retained records are anonymized (linked to deleted user ID, not personal information) and are only accessible to authorized personnel for legal/compliance purposes.
3.3 Platform Integrity Data (Retained Indefinitely)
Certain anonymized data is retained indefinitely for platform integrity and safety:
- Aggregated analytics (page views, feature usage - no personal identifiers)
- Fraud detection logs (IP addresses, device fingerprints - linked to deleted user ID only)
- Security incident reports (account compromises, abuse reports)
- Public reviews you wrote (anonymized as "Former PlugVerse User")
4. Retention Periods by Data Type
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Name, Email, Phone | Immediately anonymized | GDPR/CCPA Right to Erasure |
| Profile Media (Photos, Videos) | Immediately deleted | GDPR/CCPA Right to Erasure |
| Contracts & Agreements | 7 years | NC Statute of Limitations |
| Payment Transactions | 7 years | IRS, SOX, Stripe Requirements |
| Tax Forms (1099, W-9) | 7 years | IRS Tax Code |
| Dispute & Chargeback Records | 7 years | Fraud Prevention, Legal Defense |
| Messages & Conversations | 30 days after deletion | Business Operations |
| Search History & Activity Logs | 90 days | Service Improvement |
| Aggregated Analytics | Indefinitely (anonymized) | Legitimate Business Interest |
| Security Logs (Fraud Detection) | Indefinitely (anonymized) | Platform Safety & Security |
5. Your Rights (GDPR & CCPA)
Depending on your location, you have specific rights regarding your data:
5.1 Right to Access
You can request a copy of all personal data we hold about you. Submit a request to privacy@plugverse.app and we will provide your data within 30 days.
5.2 Right to Erasure ("Right to Be Forgotten")
You can delete your account at any time from your Settings page. Upon deletion:
- Personal information is immediately anonymized
- You cannot reactivate your account (deletion is permanent)
- Financial records are retained for 7 years (legal requirement) but anonymized
- You will receive a confirmation email when deletion is complete
Note: Account deletion is blocked if you have active contracts, pending payments, or unresolved disputes. You must resolve these before deletion.
5.3 Right to Portability
You can export your data in machine-readable format (JSON). This includes your profile, gig history, applications, and messages. Contact privacy@plugverse.app to request a data export.
5.4 Right to Rectification
You can update your profile information at any time from your Settings page. If you find inaccurate data you cannot edit yourself, contact us to correct it.
5.5 Right to Opt Out (CCPA)
California residents can opt out of the "sale" of personal information (though PlugVerse does not sell your data). You can opt out of marketing emails at any time via the unsubscribe link in any email.
6. How to Request Data Deletion
To delete your PlugVerse account and request data erasure:
- Log in to your PlugVerse account
- Navigate to Settings → Account
- Scroll to the "Delete Account" section
- Click "Check if I can delete my account" to verify no blockers exist
- If eligible, click "Delete My Account" and confirm by typing "DELETE MY ACCOUNT"
- Your account will be immediately soft-deleted (PII anonymized)
- You will receive a confirmation email within 24 hours
Blockers that prevent deletion: Active contracts, pending payments, escrow holds, unresolved disputes, active subscriptions, or open venue bookings. You must resolve these before deletion.
If you encounter issues deleting your account, contact us at privacy@plugverse.app with your account email and we will assist you.
7. Third-Party Data Retention
PlugVerse uses third-party services that have their own data retention policies:
- Stripe: Payment data is retained per Stripe's Privacy Policy (typically 7+ years for fraud prevention)
- Supabase: Authentication records are deleted when you delete your account. Database records follow PlugVerse's retention policy.
- Azure Blob Storage: Media files (photos, videos) are immediately deleted when you delete your account.
8. Changes to This Policy
We may update this Data Retention Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
9. Contact Us
If you have questions about this Data Retention Policy or wish to exercise your data rights, please contact us:
PlugVerse
This Data Retention Policy is part of our commitment to transparency and compliance with GDPR, CCPA, and other privacy regulations.