Data Retention Schedule
This schedule explains how long APERTURESyndicate OÜ ("APERTURESyndicate", "AS", "we", "us") keeps each category of personal data, and what happens when a period ends. It applies across the whole platform and should be read together with our Privacy Policy and GDPR & Your Data.
We follow the storage-limitation principle of the GDPR: we keep personal data only while we have a lawful and proportionate reason to, and then we delete it or strip it of anything that points at you. The minimum age to use our services is 13.
Where a longer period is required by law — Estonian accounting and tax rules in particular — that requirement prevails.
1. The short version
| Data category | Retention | Basis |
|---|---|---|
| Account & profile data | While your account is active; on closure, sign-in details are anonymised at once and the rest is erased within ~30 days | Contract |
| Session IP address & User-Agent | 30 days | Legitimate interest — security & anti-abuse |
| System logs on our servers | 30 days | Legitimate interest — security & operations |
| Technical identifiers in the administrative audit log | 30 days (the audit entry itself is kept longer) | Legitimate interest — security auditing |
| Raw product analytics events | 30 days, then aggregates only | Legitimate interest |
| Aggregate analytics (no link to a person) | Indefinite — no longer personal data | — |
| Resonance listening history | Long-term (see section 6) | Contract — royalties and your own statistics |
| Support requests & attachments | Until you delete them or close the account; closed requests stay as the record of what was agreed | Contract; legitimate interest |
| AI conversation history & memory | Until you delete it or opt out | Contract / consent |
| Billing & invoice records | 7 years | Legal obligation — Estonian Accounting Act |
| Support correspondence | ~2 years | Legitimate interest |
| Age-check flags and their evidence | While the account exists; deleted with it | Legitimate interest — keeping under-age users off the platform |
| Parental-consent record | While the account exists | Proof of consent (GDPR Art. 8 and accountability) |
| Email opt-outs | While the account exists; for an address without an account, a keyed fingerprint of the address | Legitimate interest — keeping the email switched off |
| Rebellion invitations and squads | While the account exists; deleted with it. The "in game" mark lasts about 20 seconds; the game's own files stay on your computer — see the Rebellion Privacy Notice | Contract |
| Rebellion player skin, statistics and privacy switches on our server | Until you reset the skin, delete your Rebellion data in Settings → Privacy, or close your account — they are erased with the account (the skin in the CDN cache, up to an hour after it is replaced or deleted). See the Rebellion Privacy Notice, Section 11 | Contract (skin, privacy switches); legitimate interests (statistics) |
The rest of this page explains the entries that are easy to misread.
2. Account and profile data
Your account and profile stay while your account is active. When you close it, your email address and username are replaced at once, every session is ended, and your profile and content disappear from the product. The remaining records are then erased from our active systems within about 30 days. Closing an account cannot be undone, so export your data first (Settings → Privacy). Records that another line of this schedule requires us to keep, such as invoices, survive the erasure. The skin, statistics and privacy switches of the game Rebellion on our server are erased with the account (Deleting Your Account & Data).
3. Sessions, IP addresses and system logs
Every sign-in creates a session row that records the IP address and browser User-Agent, so that you can see your devices and so we can investigate account takeovers. These technical identifiers are cleared after 30 days by a daily job, in two ways:
- sessions that are already dead — signed out, revoked, or expired — are deleted outright, row and all;
- sessions still alive after 30 days keep working, but their IP address and User-Agent are erased. In your device list, such a session simply loses its label. We do not sign you out just to rotate a log field.
System logs written on our servers are kept for 30 days and then rotated away.
4. The administrative audit log
Actions taken by administrators — granting a role, changing something in the studio — are written to an append-only audit log. Two different periods apply to one entry, and the distinction matters:
- The technical identifiers attached to the administrator's session, their IP address and User-Agent, are erased after 30 days, on the same schedule as everything else in section 3.
- The entry itself — who did what, to what, and when — is kept for longer under our legitimate interest in being able to reconstruct security-relevant actions and investigate incidents. An audit log that deletes itself after a month cannot do its job.
If you exercise your right to erasure, this log is one of the places where a reference to you may survive; how that is handled is explained in GDPR & Your Data.
5. Product analytics
We record events such as "this feature was opened" against your account so we can see what is used and what is broken. These raw events are deleted after 30 days, automatically.
What remains afterwards is aggregate: daily counts per feature, with no user identifier attached. Aggregates are no longer personal data, so we keep them — they are how we compare this month to last year.
6. Resonance listening history — deliberately long-lived
This is the entry most likely to be misread, so we are stating it plainly: your Resonance listening history is not covered by the 30-day rule and is not deleted on that schedule.
Each qualifying play is recorded with the track, the artist, the timestamp, how long you actually listened, and a two-letter country code. It is kept long-term for two reasons that cannot work on a short window:
- Royalties. Artists are paid from stream counts. Deleting the record deletes the basis on which someone was paid, which we cannot do and which accounting rules would not accept either.
- Your own statistics. Streaks, listening minutes, top artists and yearly summaries are computed from the same history.
What this record does not contain is your IP address. Location is stored only as a country code — the coarsest form that still lets an artist see where their listeners are.
You can browse your history in the app, use a private session that keeps a play out of your history (the play still counts for the artist), and hide your statistics from other people in privacy settings. When you close your account, your plays stay in the royalty records but are detached from you: the account identifier on them is replaced with a random one. To have the history itself deleted while you keep the account, delete your Resonance data in Settings → Privacy, or write to us. Details are in the Resonance Privacy Addendum.
7. Support requests, uploads and AI history
Support requests and any files you attach to them stay with your account. Closing a request does not delete it — a support conversation is often the record of what was agreed, so it is kept while your account exists and is removed with it, unless you delete it earlier in Settings → Privacy. Our support team works from a private Telegram group into which requests are mirrored with your nickname; deleting a request here does not remove that copy automatically, so if you want it gone, tell us and we delete it there as well. AI conversation history and memory stay until you delete them or opt out. Deletion is applied in the product immediately, and deleted AI data is then purged from our database.
8. Billing and invoices
Billing and invoice records are kept for 7 years. The Estonian Accounting Act (Raamatupidamise seadus) requires source documents underlying accounting entries to be retained for seven years from the end of the financial year. Because this is a legal obligation, these records survive account closure and an erasure request cannot shorten the period. Card details are held by our payment processor, not by us.
9. Support correspondence and marketing consent
Support email is kept for about 2 years so we can follow up and resolve related disputes, unless a legal hold applies.
We do not send marketing email. Optional notification emails — new followers, new releases, a birthday greeting, the weekly digest — carry an unsubscribe link, and we keep the fact that you switched one off for as long as the account exists, so that it stays off.
10. Deletion, purge and backups
Deletion happens in two steps: the data is marked deleted and vanishes from the product, then it is purged from our active systems after the applicable grace window.
Backups. Database backups run automatically: a full backup every Sunday, a differential one on each of the other days, with continuous archiving of the transaction log in between. They are encrypted at rest and stored in object storage within the European Union, separately from the database server itself. We verify them on a daily automated check, and we have tested a restore end to end rather than assuming it works.
Backups are retained for approximately one month, after which the older sets are removed. That is the outer bound on how long a deleted record can still exist in a backup: once the set that contains it has rotated out, it is gone from our systems entirely. Until then, we do not restore deleted personal data from a backup except where strictly necessary for disaster recovery, and we re-apply pending deletions after any restore.
11. Legal holds
We may keep data longer where we have a lawful reason — a legal or regulatory obligation, establishing or defending legal claims, resolving a dispute, or protecting the safety and integrity of the service. When the hold ends, the data returns to its normal period and is then deleted.
12. Deletion requests
You can ask us to delete your personal data, subject to the exceptions above. How to ask, and what happens to each system, is set out in GDPR & Your Data.
13. Contact
Questions about this schedule, or a request: [email protected]. Company details: Company Registration.
APERTURESyndicate OÜ · Registry code 17384111 · VAT EE102972654 · Priisle tee 8, Lasnamäe linnaosa, Tallinn, Harju maakond, 13914, Estonia.
This schedule is governed by the laws of Estonia, with disputes subject to the courts of Tallinn. The English version is the controlling version.
Version history — v1.3.3 — 2026-10-05 — The Rebellion player skin, statistics and privacy switches are part of the export and are erased with the account: the row in Section 1 corrected, the exception in Section 2 removed. · v1.3.2 — 2026-10-05 — The Rebellion player skin and statistics added to the table in Section 1; Section 2 says they are not yet erased with the account automatically. · v1.3.1 — 2026-10-04 — Rebellion invitations and squads added to the table in Section 1. · v1.3 — 2026-10-01 — Sections 1 and 2 now describe closure as it happens: sign-in details anonymised at once, the rest erased within the window, no undo. Backup schedule corrected to a weekly full backup with a differential one on the other days. Listening history: the claim that you can clear single entries in the app is replaced by how it is actually deleted, and plays are detached from a closed account rather than deleted. Added age-check flags, the parental-consent record, email opt-outs and the Telegram copy of support requests; replaced the marketing-consent entry, as we send no marketing email; removed an unsupported browser measurement window. · v1.2 — 2026-08-04 — Section 10 now describes the backup system that is actually running (weekly full, incremental every other day, continuous transaction-log archiving, encrypted, held in the EU, verified daily, restore tested) and states the concrete retention window of about one month. The previous text said off-site backups were "being set up and not yet fully in place" and declined to give a rotation window — that stopped being true once the system went live. · v1.1 — 2026-07-31 — Removed the "draft, do not rely on it" disclaimer now that the deletion jobs described here actually run; separated the 30-day technical-identifier rule from long-lived listening history; stopped promising a backup rotation window we cannot yet keep. · v1.0 — 2026-06-22.