How Long Information Is Kept

Current verified facts

• The consent identifier has a maximum age of approximately 180 days, as described in the Cookie Policy.
• The strictly necessary als_safety_reporter cookie lasts for up to 90 days; the report database stores only its HMAC hash, not the raw token, IP address, name or email address.
• Public profile, artwork, feed, comment and reaction records can remain in search-engine or third-party caches after removal from ALS.
• Issued licences, project evidence and related records may need to remain after an account closes so continuing rights, obligations and disputes can be understood.
• The current Privacy Policy records a six-year retention anchor for order, licence, subscription billing, Stripe payment, settlement, refund, dispute, accounting and seller-reporting evidence, measured after the end of the financial year in which the transaction completed.
• Private ZIP-import preview objects expire no later than 24 hours after an import run starts. Consumption, cancellation and expiry all enter the same retryable Storage API cleanup path; individual preview links continue to expire after one hour.
• Ordinary public support-contact submissions are retained for no more than 24 months, then contact details and message content are minimised. The minimal receipt is deleted 90 days later unless a documented legal hold remains active.

Approved schedule and implementation status

ALS has approved a category-by-category retention and deletion schedule for account data, messages, projects, files, reports, support, security, backup and provider-side records. Account closure becomes eligible after the 30-day cancellation period. That does not mean every related record is erased on day 30: required financial, licence, dispute, safety, privacy-operations and provider records may instead be retained or minimised for their documented period. Final automated deletion remains fail-closed until the platform has proved each applicable cleanup, retention and provider-offboarding path.

Requests and exceptions

Contact privacy@artlicencestudio.co.uk to request access, correction, restriction or erasure where applicable. Identity verification and a lawful retention exception may be required. We will explain the verified reason that applies rather than rely on this draft as a fixed service-level promise.

Related policy

The canonical customer-facing processing description is the Privacy Policy. Cookie-specific names and maximum ages are listed in the Cookie Policy.