Automated retention policy for AI conversation history

GDPR Article 5(1)(e) requires that personal data not be kept longer than necessary for the processing purpose — the storage limitation principle. CCPA §1798.100 creates parallel expectations. AI conversation history is one of the richest stores of personal data an application can accumulate: it contains exactly what users said, in their own words, about their problems, intentions, and circumstances. Without an automated retention policy, this data accumulates indefinitely, increasing the blast radius of any future breach and the scope of any regulatory discovery request. ISO/IEC 27001:2022 A.8.10 (Information Deletion) codifies this as a formal control requirement.

Set up an automated cleanup on a 30–90 day cycle. For Supabase/PostgreSQL, pg_cron is the lowest-friction option:

-- Run in Supabase SQL editor after enabling pg_cron extension
SELECT cron.schedule(
  'delete-old-conversations',
  '0 2 * * 0',
  $$DELETE FROM conversations WHERE created_at < NOW() - INTERVAL '90 days'$$
);

For Vercel deployments, use a cron route:

// app/api/cron/cleanup-conversations/route.ts
export async function GET(req: Request) {
  if (req.headers.get('Authorization') !== `Bearer ${process.env.CRON_SECRET}`) {
    return new Response('Unauthorized', { status: 401 })
  }
  const cutoff = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000)
  await db.conversation.deleteMany({ where: { createdAt: { lt: cutoff } } })
  return Response.json({ ok: true })
}

Document the retention period in your privacy policy. Choose a period appropriate to your product — 30 days for ephemeral support chats, 90 days for productivity tools where users reference past sessions.