Data Retention Schedule
Last updated: November 2, 2026. This schedule explains how long Rankaza retains personal information, the legal basis for each retention period, and what happens when data reaches the end of its retention period under GDPR, DPDP, CCPA/CPRA, LGPD, and PIPEDA.
1. Retention Principles
We retain personal data only as long as necessary to fulfil the purposes for which it was collected, including for tax, legal, accounting, and fraud-prevention purposes. Retention is governed by:
- Storage limitation (GDPR Art. 5(1)(e)): personal data is not kept longer than necessary.
- DPDP §8(7): personal data is erased when consent is withdrawn or the purpose is fulfilled, unless retention is required by law.
- Legal hold: data subject to litigation, audit, or investigation is retained until the matter is resolved.
2. Retention Schedule by Data Category
| Data category | Examples | Retention period | Legal basis | End-of-retention action |
|---|---|---|---|---|
| Account & profile | Name, email, password hash, role, preferences | Active account + 2 years after closure | Contract performance; legal | Delete or anonymize |
| Orders & placements | Order ID, status, target URL, publisher, placement details | 7 years after order fulfillment | Tax; accounting; contract | Anonymize financial identifiers |
| Support tickets & messages | Contact form submissions, support threads | 3 years after resolution | Legal; service delivery | Delete |
| Uploaded articles & documents | DOC/DOCX/PDF/TXT/RTF submissions up to 10 MB | 12 months after order completion | Service delivery | Delete from S3 |
| Cookie consent receipts | Consent ID, categories, version, timestamp | 12 months from last activity | Consent evidence (GDPR Art. 7) | Delete |
| Analytics & usage logs | Page views, device data, interaction events | 26 months | Legitimate interest; consent | Delete or aggregate |
| Security & session records | Session tokens, auth events, IP at login | 90 days after session end | Security; fraud prevention | Delete |
| Audit logs | Admin actions, privacy requests, consent changes | 3 years | Legal; compliance | Archive or delete |
3. Automated Enforcement
Retention is enforced automatically where the data store supports it:
- DynamoDB: time-to-live (TTL) attributes on consent receipts, sessions, and privacy-request records purge expired items automatically.
- S3 (uploads): lifecycle rules expire objects in the uploads bucket after the retention period for the associated order.
- CloudWatch logs: log groups retain events for 26 months by default.
- Cognito: deleted user accounts are removed upon verified erasure requests; inactive accounts are reviewed annually.
4. Deletion on Request
You may request deletion of your personal data at any time under GDPR Art. 17, DPDP §12, CCPA §1798.105, or LGPD Art. 18. Submit your request to [email protected] or through your account settings. We will:
- Verify your identity before acting on the request.
- Delete or anonymize the data unless a legal retention exception applies (tax, fraud, legal hold).
- Notify you of any exception and the reason data must be retained.
- Complete the request within the timeframe required by applicable law (typically 30 days under GDPR/DPDP; 45 days under CCPA/CPRA).
- Tax and accounting records required by law
- Records subject to a legal hold, litigation, or regulatory investigation
- Fraud-prevention records needed to detect or prevent unlawful activity
- Dispute-related records needed to resolve an open dispute or chargeback
5. Legal Holds and Exceptions
Some data must be retained beyond the standard period despite a deletion request, including:
Where an exception applies, we will retain only the data necessary for the stated purpose and inform you of the retention basis.
6. Contact
Data Protection Officer: [email protected]
Rankaza, 123 SEO Street, Suite 100, New York, NY 10001