What is collected
Business ledgers may store Stripe event ids, object ids, payment status, amount, currency, livemode, payload hashes, refund records, dispute transitions, tax receipt rows, host remittance rows, and admin audit events.
Business data policy
Necessary records are not attention tracking.
Payments, refunds, disputes, tax receipts, host remittances, and admin audit rows exist so the cooperative can account for money, resolve fraud, and prove operator actions. They do not create ads, paid priority, or social scoring.
Why it is collected
These records support payment reconciliation, refunds, chargeback and fraud defense, tax exports, host remittance tracking, support, and abuse-resistant operator accountability.
What it cannot affect
Business records are not matching signals, search ranking signals, event priority signals, public profile features, ad audiences, or engagement metrics.
Retention
Citizen profile and Constellation state follows the 24-hour deletion contract. Accounting, tax, fraud, chargeback, remittance, and audit rows may be retained as legally or operationally required, with personal fields minimized.
Access
Billing records require admin:billing. Admin APIs return sanitized summaries and exclude raw Stripe payloads, customer reference hashes, and secret values from dashboard responses.
Secret handling
Secret values stay in Infisical by key name and path. Evidence names keys only and must not print, store, or commit secret values.
Invariant guard
No ads, no data sale, no paid matching priority, no public people directory, and no engagement optimization remain binding even when business ledgers exist.
Deletion receipts
Deletion receipts distinguish deleted citizen state from retained business/legal records. Retained rows must not be used to rebuild private profiles or matching vectors.
Source document
The repository policy is docs/trust/business-necessary-data.md. Public pages summarize the same categories, purposes, retention, access, and prohibited uses.