Data Retention and Deletion Policy
Effective Date: 11/06/2025
App Name: What's the Move
Company Name: What's the Move
Contact Email: wtm@whatsthemove.live
Business Address: TBD
1. Purpose
This Data Retention and Deletion Policy ("Policy") explains how What's the Move ("the Company," "we," or "our") manages the storage, retention, and deletion of user data collected through the What's the Move mobile application ("the App").
The purpose of this Policy is to ensure that personal and technical data are retained only for as long as necessary to fulfill legitimate business purposes, comply with applicable laws, and protect user privacy.
2. Scope
This Policy applies to all user data collected, processed, or stored by What's the Move in connection with the App, including personal, behavioral, technical, and anonymized data.
It governs data handling throughout the full information lifecycle—from collection and active use to archival, anonymization, and deletion.
3. Principles of Data Retention
Our data management practices are guided by the following principles:
- Purpose Limitation: Data is collected only for clear, lawful, and disclosed purposes.
- Data Minimization: We collect only the minimum amount of data required to deliver App functionality.
- Limited Retention: Personal data is retained only as long as necessary for service delivery or legal compliance.
- Security and Confidentiality: Data is protected against unauthorized access, loss, or misuse.
- Transparency: Users are informed about how long their data is kept and how it can be deleted.
4. Categories of Data and Retention Periods
| Data Type | Description | Retention Period | Disposition |
|---|---|---|---|
| Account Information | Name, email, username, profile details | Retained while account is active; deleted within 30 days after verified deletion request | Secure deletion from production and backup systems |
| Authentication Data | Login credentials, session tokens, device identifiers | Retained for up to 90 days for security auditing | Automatically purged or anonymized |
| Event and Attendance Data | Event participation records, RSVP history | Retained for 12 months following event completion | Anonymized for analytics |
| Location Data | Geofencing and event check-in coordinates | Retained for 30 days after collection | Permanently deleted thereafter |
| Media and Uploaded Content | Photos, videos, or shared event media | Retained while account is active | Deleted upon account or content removal |
| Messaging and Communications | Direct or group in-app messages | Retained for 90 days for moderation and support | Securely deleted thereafter |
| System and Analytics Logs | Crash logs, diagnostic data, usage metrics | Retained for 6–12 months in anonymized form | Automatically purged or overwritten |
| Legal and Compliance Data | Data retained to comply with legal obligations or law enforcement requests | Retained as required by applicable law | Deleted after obligation expires |
5. Data Deletion Procedures
When data reaches the end of its retention period or a user submits a verified deletion request, the following steps occur:
- Verification: The requester's identity is confirmed using registered account details.
- Assessment: The request is reviewed to ensure compliance with legal or operational retention requirements.
- Execution: Data is securely deleted from active systems, backups, and cloud environments using industry-standard deletion protocols.
- Confirmation: Users receive confirmation once deletion has been completed.
- Anonymization (if applicable): Some information may be converted into non-identifiable form for aggregate analysis.
6. Exceptions to Deletion
Certain data may be retained beyond normal retention periods under the following circumstances:
- To comply with a legal obligation, court order, or regulatory requirement;
- To investigate or prevent fraud, abuse, or security incidents;
- To enforce the Terms of Service; or
- To maintain anonymized records for analytical or research purposes.
In all cases, retention is limited to the minimum period necessary to satisfy these requirements.
7. Anonymization and Aggregation
What's the Move may anonymize or aggregate data to evaluate trends, improve services, and support internal analytics.
Anonymized data is stripped of personal identifiers and cannot be used to identify individual users. Aggregated datasets may be retained indefinitely for legitimate business and product improvement purposes.
8. Account Deletion Requests
Users may request account deletion at any time by contacting wtm@whatsthemove.live.
Upon receipt of a verified request:
- The account will be deactivated immediately;
- Personal data will be deleted or anonymized within 30 days; and
- Confirmation of deletion will be provided to the user once complete.
If deletion cannot be completed due to an outstanding legal or compliance requirement, the Company will inform the user of the reason and timeline for completion.
9. Data Storage and Security
All data is stored on secure servers and protected through technical and organizational measures, including encryption, access control, and regular security reviews.
Backups containing user data are encrypted and automatically purged according to the same retention schedule as production data.
10. Legal and Regulatory Compliance
This Policy is designed to comply with applicable privacy and data protection laws within the United States, including but not limited to:
- The Virginia Consumer Data Protection Act (VCDPA);
- The California Consumer Privacy Act (CCPA) and similar state privacy frameworks;
- Applicable U.S. federal data protection standards; and
- Relevant app marketplace and cloud service security requirements.
11. Policy Review and Updates
The Company reviews this Policy periodically to ensure continued compliance with evolving legal, technical, and operational standards.
Updates will be posted within the App and on the Company's website, and the "Effective Date" will be revised accordingly. Continued use of the App after an update constitutes acceptance of the revised Policy.
12. Contact Information
Questions or requests regarding data retention, deletion, or privacy practices should be directed to:
What's the Move
Email: wtm@whatsthemove.live
Address: TBD
13. Acknowledgment
By using What's the Move, users acknowledge that they have read and understood this Data Retention and Deletion Policy and consent to the retention and deletion practices described herein.