| Anonymous reading and technical operation | IP-derived security signals, logs, browser/device metadata, and page requests. | Legitimate interest in secure operation, troubleshooting, and abuse prevention. | Security logs and IP hashes: normally 90 days, with longer retention only for specific abuse, disputes, or legal requirements. |
| Account, sign-in, and profile | Vipps identifiers, verified name, profile slug, display name, profile settings, and account status. | Contract for account features; legitimate interest in security and abuse prevention. | For as long as the account exists, then deletion or anonymization unless legal requirements require retention. |
| Texts, uploads, and publishing | Uploaded files, manuscripts, metadata, source information, revisions, publication status, and rights notes. | Contract and the user's publication choices; legitimate interest in rights documentation. | Until the user deletes content or the account, with rights/abuse logs retained where necessary. |
| Comments, reactions, chat, notes, and feedback | User content, messages, reactions, attachments, timestamps, and sender profile. | Contract for the features; legitimate interest in moderation, security, and support. | Quick notes until deletion; support/feedback normally 24 months; chat/comments until deletion or account closure. |
| AI-assisted features | Prompts, selected text, uploaded material, and context the user actively sends to the AI feature. | Contract or consent/opt-in where user-uploaded material is processed by an AI vendor. | Only as long as necessary for the feature, troubleshooting, and the vendor's agreed processing period. |
| Advertising and consent | Consent status, TCF signals, ad events, and technical ad identifiers when advertising is enabled. | Consent. Consent documentation is stored to demonstrate compliance. | Consent logs for at least 13 months or until they are no longer necessary. |
| Premium and payment | Customer identifier, subscription status, payment events, receipts, and refund history. | Contract, legal obligation for accounting/tax, and legitimate interest in fraud prevention. | Accounting/payment records normally 5 years after the end of the financial year. |