Version 1.0 · Effective: October 11, 2026. Also serves as SMC's "Personal Data Retention and Destruction Policy" under the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
1. Purpose and scope
This policy sets how long Space Made Code LLC keeps personal data processed through Stylium (website, wardrobe app, sign-in pages, mobile apps, support channels) and how it is deleted. It applies to all systems and providers listed in our DPA, Part B.
2. Principles
- We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.
- When the period ends, we delete the data, destroy it so it cannot be recovered, or anonymise it so it can no longer identify anyone.
- Users can delete most data themselves at any time.
3. Retention schedule
| Data | Where | Retention | Trigger and method |
|---|---|---|---|
| Account (name, email, sign-in identifiers) | Clerk, Supabase | Until account deletion | Self-service deletion: Clerk identity deleted; database row anonymised |
| Clothing photos | Supabase Storage (private) | Until the piece or account is deleted | Permanent deletion of storage objects |
| Wardrobe details, outfits, plans, trips, events, saved looks, preferences, notes | Supabase | Until removed or account deletion | Permanent deletion |
| City-level location | Supabase | Until changed or account deletion | Overwrite / deletion |
| Precise browser location | Not stored | Used once to find the nearest city | — |
| Daily look suggestions | Supabase | 3 days | Daily automated purge |
| AI usage records (no content) | Supabase | 90 days | Daily automated purge |
| Upload safety-check records | Supabase | 24 hours | Daily automated purge |
| Rate-limit counters | Supabase | 24 hours | Automated purge |
| AI consent records | Supabase | Until account deletion [counsel: consider 3 years as proof] | Deleted with account |
| Data sent to Anthropic | Anthropic | 30 days; flagged content up to 2 years | Provider deletion |
| Web billing records (invoices, amounts, taxes, billing address, tax ID) | Stripe, Supabase | 10 years after the end of the year of the transaction | Deletion after period; kept after account deletion |
| Store transaction identifiers (App Store / Google Play) | Supabase | Until account deletion, then anonymised for reconciliation | Anonymisation |
| Support emails and contact-form messages | Google Workspace, Resend | 24 months after the conversation ends | Manual deletion every 6 months |
| Waitlist entries | Clerk waitlist, Resend | Until launch invitation is used or 12 months after launch, or earlier unsubscribe | Deletion |
| Marketing consent and unsubscribe records | [Email tool] | 3 years after consent ends | Deletion |
| Privacy requests and responses | Google Workspace | 3 years after closure | Deletion |
| Copyright / DSA notices and decisions | Google Workspace | 3 years | Deletion |
| Security incident and breach register | Internal | 5 years | Deletion |
| Server and request logs | Vercel, Supabase, Clerk | Provider default (typically up to 30 days) [confirm per plan] | Provider rotation |
| Backups | Supabase | [7 days — confirm plan] | Automatic expiry |
4. Account deletion process
- User selects *Delete account* in Settings → General → Your data and confirms.
- Live web subscriptions are cancelled immediately in Stripe (if this fails, deletion stops and the user is told).
- The Clerk identity is deleted.
- The user record is marked and content and photos are permanently deleted; the user row is anonymised.
- Any failed step is completed by the daily maintenance job and Clerk's
user.deletedwebhook. - Billing records required by law are kept separately for the period above.
- Store subscriptions are not cancelled automatically; the user is told to cancel in the store.
5. Periodic review
The owner of SMC reviews retention every 6 months (KVKK periodic destruction interval) and records: what was deleted, by which method, and when. Records of these reviews are kept for 3 years.
6. Legal holds
If data is needed for a legal claim, investigation or authority request, its deletion is suspended for that data only, for as long as necessary, and the reason is recorded.
7. Responsibilities
Data protection responsibility: Ahmet Talha Turkmen, managing member, legal@spacemadecode.com.
8. Review
This policy is reviewed at least yearly and whenever a provider or feature changes.