Data Retention Policy

1. Purpose

This Internal Data Retention Schedule establishes how StrmFarm manages, retains, archives, and securely deletes information collected throughout the operation of the platform.

The objectives of this Schedule are to:

• Protect user privacy.
• Support playback verification.
• Maintain platform security.
• Preserve financial and campaign records.
• Enable fraud investigations.
• Meet legal and regulatory obligations.
• Ensure operational continuity.
• Reduce unnecessary data retention.

Retention periods represent operational standards and may be extended where required by law, litigation, security investigations, fraud investigations, contractual obligations, or legitimate business purposes.

2. Data Classification

Platform information is classified according to operational sensitivity:

Public Data

Information intentionally made available to users (public artist profiles, album information, track metadata, public playlists, public campaigns).

Internal Operational Data

Information used for platform functionality (user profiles, playback sessions, campaign records, discovery signals, recommendation data, analytics).

Confidential Data

Sensitive operational information (authentication credentials, security logs, verification systems, fraud detection data, administrative records, internal investigations).

3. Account Information

Account information is retained while an account remains active.

Following account deletion:

• Accounts enter a 30-day soft deletion period during which users may restore their account.
• After the retention period expires, eligible personal information is permanently deleted unless continued retention is required for legal, security, fraud prevention, financial, or regulatory purposes.

4. Authentication & Identity Records

Authentication information is retained only as long as reasonably necessary to maintain platform security (login history, refresh tokens, password resets, session records, security audit events).

Identity verification records associated with artist verification may be retained for longer periods to protect rights holders and prevent fraudulent claims.

5. Playback Verification Records

Playback verification data forms the foundation of StrmFarm’s trust model.

Verification records (playback sessions, heartbeat validation, verification decisions, session integrity events) may be retained for extended periods to support platform audits, fraud investigations, reward verification, and financial reconciliation.

6. STRM Points, Rewards & Financial Records

Financial integrity requires longer retention periods for STRM Point balances, reward distributions, campaign settlements, treasury records, withdrawal requests, ledger entries, and refund records.

7. Campaign Records

Historical campaign information (submissions, approval history, budget allocations, reward distributions, cancellation history, refund calculations) may be retained even after campaign completion or account deletion where necessary for operational, financial, or legal purposes.

8. Analytics & Platform Improvement Data

Analytics (feature usage, application performance, error reporting, crash diagnostics) are retained only as long as reasonably necessary to improve the Services and evaluate platform performance.

9. Fraud Prevention & Security Logs

Security and fraud-related records (security investigations, fraud investigations, verification anomalies, enforcement history) are retained longer than ordinary operational data to support repeat offender detection and legal defense.

10. Customer Support Records

Support records (email correspondence, support tickets, appeal requests, bug reports) are retained as long as necessary to resolve issues, improve services, or satisfy legal obligations.

11. Backup & Disaster Recovery

StrmFarm maintains secure backups (daily, weekly, monthly archival backups) to protect against accidental loss or service interruptions.

12. Data Deletion & Disposal

When information reaches the end of its retention period and no longer serves a legitimate purpose, StrmFarm securely deletes or anonymizes the data where appropriate.

13. Legal Holds & Exceptions

StrmFarm may suspend normal deletion schedules when information is required for active litigation, law enforcement requests, government investigations, copyright disputes, or fraud investigations.

14. Policy Review & Governance

This Data Retention Schedule is reviewed periodically to ensure alignment with privacy obligations, security practices, platform architecture, and legal requirements.