# Data retention policies Human Guide

## What This Is For
Data retention policies define how long each category of data is kept, when it is archived, and when it is purged. It gives the agent a clearer input/output frame for data retention policies: what context to ask for, what decisions to make, and what usable artifact to return.

Use this as a human-readable version of the Data retention policies agent skill. It is meant for marketers, operators, founders, and other non-coders who want the workflow without reading agent-specific implementation instructions.

## When To Use This
- Use this when you need a repeatable process for data retention policies.
- Use this when the task needs judgment, examples, constraints, or a clear output format rather than a one-off prompt.
- Use this when you want to hand an AI assistant enough context to produce a usable marketing artifact.

## When Not To Use This
- Do not use this when you only need a quick factual answer.
- Do not use this when the work depends on private data you cannot share with the assistant.
- Do not use this as a replacement for legal, compliance, financial, or medical review.

## What You Need Before Starting
- The goal or business outcome you want.
- The audience, customer segment, or market context.
- Any source material the assistant should respect, such as notes, briefs, examples, URLs, or brand guidance.
- Constraints such as tone, length, channel, deadline, region, or approval requirements.
- A clear definition of what a good final answer should look like.

## Step-By-Step Workflow
1. State the job clearly: "Use the Data retention policies guide to help me with..."
2. Add context: audience, goal, offer, channel, source material, and constraints.
3. Ask the assistant to identify missing inputs before producing the final output.
4. Have the assistant follow the skill-specific guidance below.
5. Review the result against the final checklist and ask for revisions where needed.

## Skill-Specific Guidance
- When implementing GDPR data minimization requirements for a new or existing e-commerce platform
- When legal or compliance teams request a documented data retention policy
- When preparing for a data protection audit or SOC 2 Type II assessment
- When storage costs are growing due to uncontrolled data accumulation
- When a customer submits a Subject Access Request and you need to know exactly where their data lives
- Go to **Settings → Customers → Customer privacy**
- Shopify automatically sends `customers/data_request` and `customers/redact` webhooks to any installed apps when a customer requests their data or deletion
- For your own app or custom code, register webhook handlers for these events
- Open a customer record → **More actions → Anonymize this customer**
- Shopify replaces PII with anonymized placeholders while keeping order records
- This is irreversible — confirm before proceeding
- Go to **Customers → Export** to download customer data as CSV for archival

## Decision Points And Nuance
The original skill emphasizes: Overview, When to Use This Skill, Core Instructions, Step 1: Document your retention schedule first, Step 2: Platform-specific retention configuration, Shopify, WooCommerce, BigCommerce, Custom / Headless, Best Practices.

Use these questions to steer the work:
- What is the intended audience or buyer?
- What source material must be preserved?
- What should the assistant optimize for: clarity, persuasion, accuracy, speed, creativity, or conversion?
- What examples represent the desired quality bar?
- What should the assistant avoid?

## Common Mistakes
- **Key principle**: Never delete what the law requires you to keep. For orders, anonymize the customer's PII (name, email, address) while preserving the financial record (amounts, tax, payment method brand/last 4).
- Do not delete orders (required for tax records). Instead, anonymize PII while keeping financial data. Install **WooCommerce GDPR** (WebToffee) which adds an "Anonymize" action to orders.
- // Paginated delete — avoids table locks
- **Document before implementing** — legal, compliance, and engineering must agree on the retention schedule; unilateral engineering decisions create compliance gaps
- **Anonymize financial records, never delete them** — orders must be retained for the tax statutory period; replace PII fields with anonymized placeholders
- **Keep a separate, append-only retention audit log** — this is your evidence for compliance auditors; never delete from this log
- **Run purge jobs in small batches off-peak** — use `SELECT ... LIMIT n` batches to avoid table locks that impact live traffic
- **Handle cross-service deletion as a checklist** — purges spanning multiple services (database, email platform, analytics) must be resilient; log completion for each system separately

## Copy-And-Paste Prompt
```text
Use the Data retention policies human guide.

My goal:
[Describe the business outcome]

Audience:
[Describe who this is for]

Context and source material:
[Paste notes, examples, links, or existing copy]

Constraints:
[Tone, length, channel, timeline, must-include items, must-avoid items]

Before producing the final output, ask me for any missing information that would materially improve the result.
```

## Final Checklist
- [ ] The output matches the original goal.
- [ ] The audience and context are reflected in the answer.
- [ ] Important constraints and source material were preserved.
- [ ] The assistant made the relevant decisions explicit.
- [ ] The final artifact is ready to use, review, or hand to the next person.

## Source
This guide was generated from the finsilabs/awesome-ecommerce-skills skill entry for `data-retention-policies`.

## Source Skill Notes
These notes preserve the nuance from the original skill. Use them as supporting reference when the workflow above feels too generic.

# Data Retention Policies

## Overview

Data retention policies define how long each category of data is kept, when it is archived, and when it is purged. E-commerce stores must balance legal obligations (tax records must typically be kept 5–7 years) against privacy regulations (GDPR's data minimization principle requires deleting data that is no longer needed). The right approach depends on your platform — Shopify handles some retention automatically, while WooCommerce/custom stores require explicit implementation.

## When to Use This Skill

- When implementing GDPR data minimization requirements for a new or existing e-commerce platform
- When legal or compliance teams request a documented data retention policy
- When preparing for a data protection audit or SOC 2 Type II assessment
- When storage costs are growing due to uncontrolled data accumulation
- When a customer submits a Subject Access Request and you need to know exactly where their data lives

## Core Instructions

### Step 1: Document your retention schedule first

Before configuring any tool, document a retention schedule. Legal, compliance, and engineering must agree before implementation. This Register of Processing Activities (RoPA) is required under GDPR Article 30 for large processors and recommended for all:

| Data Category | Retention Period | Action After Period | Legal Basis |
|--------------|-----------------|---------------------|-------------|
| Orders (financial records) | 7 years | Anonymize PII; keep financial data | Tax law (US IRS, EU VAT) |
| Invoices | 7 years | Archive to cold storage | Tax compliance |
| Customer accounts | 3 years after last activity | Delete | Legitimate interest |
| Sessions / login logs | 90 days | Delete | Legitimate interest |
| Marketing email consent | Until unsubscribe | Delete on unsubscribe | GDPR consent |
| Abandoned cart data | 30 days | Delete | Legitimate interest |
| Fraud/security logs | 90 days | Anonymize | Legitimate interest |
| Analytics events | 13 months | Aggregate then delete | Legitimate interest |

**Key principle**: Never delete what the law requires you to keep. For orders, anonymize the customer's PII (name, email, address) while preserving the financial record (amounts, tax, payment method brand/last 4).

### Step 2: Platform-specific retention configuration

---

#### Shopify

Shopify stores order data indefinitely by default and handles platform-level data retention for infrastructure components.

**Customer data export and deletion (GDPR compliance):**
Shopify provides built-in GDPR webhooks:
1. Go to **Settings → Customers → Customer privacy**
2. Shopify automatically sends `customers/data_request` and `customers/redact` webhooks to any installed apps when a customer requests their data or deletion
3. For your own app or custom code, register webhook handlers for these events

**Manual customer anonymization:**
1. Open a customer record → **More actions → Anonymize this customer**
2. Shopify replaces PII with anonymized placeholders while keeping order records
3. This is irreversible — confirm before proceeding

**Automated email list cleanup:**
Use Klaviyo (or your email provider) to automatically suppress or delete contacts who haven't opened an email in 12+ months. Most email providers have "sunset" automation features built in.

**Data export for archiving:**
1. Go to **Customers → Export** to download customer data as CSV for archival
2. For orders: **Orders → Export**
3. Store exports in encrypted cold storage (e.g., AWS S3 with Glacier lifecycle policy)

---

#### WooCommerce

WooCommerce does not enforce data retention automatically. You need to configure it via plugins and scheduled tasks.

**WooCommerce's built-in cleanup:**
1. Go to **WooCommerce → Status → Tools**
2. Use **Clean up WooCommerce sessions** to delete expired session data
3. Use **WooCommerce tracker cleanup** to clear tracking data

**GDPR / data retention plugin:**
Install **WP GDPR Compliance** or **GDPR Cookie Consent** (by WebToffee):
1. Go to **WP GDPR Compliance → Settings → Data Retention**
2. Configure retention periods per data type
3. The plugin creates scheduled cleanups via WP-Cron

**Manual scheduled cleanup (WP-Cron):**
```php
// Add to your theme's functions.php or a custom plugin