PLUGVERSE · LEGAL

DATA RETENTION

Last updated: March 8, 2026

Important Notice: This Data Retention Policy explains how long PlugVerse retains your information, why certain data is kept for specific periods, and your rights regarding data deletion. This policy supplements our Privacy Policy.

1. Overview of Data Retention

PlugVerse is committed to transparency about how we handle your data. We retain different types of information for different periods based on legal requirements, business needs, and your rights under privacy laws including GDPR and CCPA.

When you delete your account, we distinguish between:

Personal Identifiable Information (PII) - Immediately anonymized
Financial and Legal Records - Retained for 7 years as required by law
Public Content - May be retained for platform integrity

2. Seven-Year Retention Period

PlugVerse retains certain financial and contractual records for seven (7) years after account deletion. This retention period is legally required for the following reasons:

2.1 IRS Tax Compliance

The Internal Revenue Service (IRS) requires businesses to retain financial records for a minimum of 7 years. PlugVerse must maintain records of all platform transactions, fees, and payouts to comply with federal tax law and provide documentation if audited.

2.2 Sarbanes-Oxley Act (SOX)

The Sarbanes-Oxley Act requires the retention of financial records for 7 years to ensure accurate financial reporting and prevent fraud. As a payment platform, PlugVerse must maintain detailed transaction records.

2.3 Statute of Limitations

North Carolina's statute of limitations for written contracts and fraud claims is 10 years, with a 7-year standard for business records. We retain contract and payment records for 7 years to defend against potential legal claims and resolve disputes.

2.4 Payment Processor Requirements

Our payment processor (Stripe) requires retention of transaction records for chargeback disputes, fraud investigation, and compliance purposes. Stripe's terms mandate maintaining payment-related data for extended periods.

3. What Data Is Retained vs. Deleted

When you request account deletion, PlugVerse follows this data handling procedure:

3.1 Immediately Anonymized (Soft Deletion)

The following personal information is immediately anonymized when you delete your account:

Full name (changed to "Deleted User [random ID]")
Email address (changed to "deleted-[random]@plugverse.deleted")
Phone number (removed)
Profile photo and media uploads (removed from storage)
Social media links (removed)
Bio and profile description (removed)
Location and address information (removed)
Authentication credentials (Supabase Auth account deleted)
Stripe Connect account (deactivated)

3.2 Retained for 7 Years (Legal Requirement)

The following records are retained for 7 years after account deletion for legal and regulatory compliance:

Contracts: All signed performance contracts, venue booking contracts, and cancellation records
Payment Records: Gig payments, venue booking payments, platform fees, artist payouts, processing fees
Transaction History: Payment intents, charges, refunds, transfers, and Stripe transaction IDs
Tax Information: 1099 forms, W-9 submissions, tax ID numbers, and earnings summaries
Dispute Records: Chargeback claims, contract disputes, cancellation reasons, and resolution outcomes
Reliability Scores: No-show incidents, late arrivals, performance ratings, and disciplinary actions

Note: Retained records are anonymized (linked to deleted user ID, not personal information) and are only accessible to authorized personnel for legal/compliance purposes.

3.3 Platform Integrity Data (Retained Indefinitely)

Certain anonymized data is retained indefinitely for platform integrity and safety:

Aggregated analytics (page views, feature usage - no personal identifiers)
Fraud detection logs (IP addresses, device fingerprints - linked to deleted user ID only)
Security incident reports (account compromises, abuse reports)
Public reviews you wrote (anonymized as "Former PlugVerse User")

4. Retention Periods by Data Type

Data Category	Retention Period	Legal Basis
Name, Email, Phone	Immediately anonymized	GDPR/CCPA Right to Erasure
Profile Media (Photos, Videos)	Immediately deleted	GDPR/CCPA Right to Erasure
Contracts & Agreements	7 years	NC Statute of Limitations
Payment Transactions	7 years	IRS, SOX, Stripe Requirements
Tax Forms (1099, W-9)	7 years	IRS Tax Code
Dispute & Chargeback Records	7 years	Fraud Prevention, Legal Defense
Messages & Conversations	30 days after deletion	Business Operations
Search History & Activity Logs	90 days	Service Improvement
Aggregated Analytics	Indefinitely (anonymized)	Legitimate Business Interest
Security Logs (Fraud Detection)	Indefinitely (anonymized)	Platform Safety & Security

5. Your Rights (GDPR & CCPA)

Depending on your location, you have specific rights regarding your data:

5.1 Right to Access

You can request a copy of all personal data we hold about you. Submit a request to cooper@plugverse.app and we will provide your data within 30 days.

5.2 Right to Erasure ("Right to Be Forgotten")

You can delete your account at any time from your Settings page. Upon deletion:

Personal information is immediately anonymized
You cannot reactivate your account (deletion is permanent)
Financial records are retained for 7 years (legal requirement) but anonymized
You will receive a confirmation email when deletion is complete

Note: Account deletion is blocked if you have active contracts, pending payments, or unresolved disputes. You must resolve these before deletion.

5.3 Right to Portability

You can export your data in machine-readable format (JSON). This includes your profile, gig history, applications, and messages. Contact cooper@plugverse.app to request a data export.

5.4 Right to Rectification

You can update your profile information at any time from your Settings page. If you find inaccurate data you cannot edit yourself, contact us to correct it.

5.5 Right to Opt Out (CCPA)

California residents can opt out of the "sale" of personal information (though PlugVerse does not sell your data). You can opt out of marketing emails at any time via the unsubscribe link in any email.

6. How to Request Data Deletion

To delete your PlugVerse account and request data erasure:

Log in to your PlugVerse account
Navigate to Settings → Account
Scroll to the "Delete Account" section
Click "Check if I can delete my account" to verify no blockers exist
If eligible, click "Delete My Account" and confirm by typing "DELETE MY ACCOUNT"
Your account will be immediately soft-deleted (PII anonymized)
You will receive a confirmation email within 24 hours

Blockers that prevent deletion: Active contracts, pending payments, escrow holds, unresolved disputes, active subscriptions, or open venue bookings. You must resolve these before deletion.

If you encounter issues deleting your account, contact us at cooper@plugverse.app with your account email and we will assist you.

7. Third-Party Data Retention

PlugVerse uses third-party services that have their own data retention policies:

Stripe: Payment data is retained per Stripe's Privacy Policy (typically 7+ years for fraud prevention)
Supabase: Authentication records are deleted when you delete your account. Database records follow PlugVerse's retention policy.
Azure Blob Storage: Media files (photos, videos) are immediately deleted when you delete your account.

8. Changes to This Policy

We may update this Data Retention Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

9. Contact Us

If you have questions about this Data Retention Policy or wish to exercise your data rights, please contact us:

PlugVerse

Email: cooper@plugverse.app

Address: 127 S Sycamore St, Charlotte, NC 28202

Phone: (980) 272-1831

This Data Retention Policy is part of our commitment to transparency and compliance with GDPR, CCPA, and other privacy regulations.