Affirm Privacy Notice

Retention & Deletion · Company practice

Personal information is kept as long as necessary or as law requires, with no fixed period

Affirm retains personal information for as long as necessary to complete the purposes for which it was collected, or as may be required by law. The Notice says individual pieces of information may exist in different systems used for different business or legal purposes, a different maximum retention period may apply to each use case, and where information is stored in combination the maximum period may be determined by the purpose of that information set.

Supporting quotations

Affirm will retain your Personal Information for as long as is necessary to complete the purposes for which it was collected, or as may be required by law.

Individual pieces of information such as those listed above may exist in different systems that are used for different business or legal purposes. A different maximum retention period may apply to each use case of the information. Certain individual pieces of information may also be stored in combination with other individual pieces of information, and the maximum retention period may be determined by the purpose for which that information set is used.

Qualifications & exceptions

• Retention is purpose-based or legally required.
• Different maximum periods may apply to different systems and use cases.

Not stated here

• The Notice states no fixed retention period for any data category.

Retention & Deletion · Company practice

Retention length weighs business purpose, legal duties, privacy impact and system design

Affirm says it uses four criteria to determine retention length: the business purposes for which the information is used and the time needed to achieve them; whether retention is required for legal obligations or contractual commitments, to defend potential legal claims, or to investigate theft or other policy violations or unlawful activity, ensure a secure online environment or protect health and safety; the privacy impact of ongoing retention on the consumer; and how information is maintained and flows through its systems and how best to manage its lifecycle given the volume and complexity of its infrastructure.

Supporting quotations

We utilize the following criteria to determine the length of time for which we retain information:

The business purposes for which the information is used, and the length of time for which the information is required to achieve those purposes;

Whether we are required to retain the information type in order to comply with legal obligations or contractual commitments, to defend against potential legal claims, or as otherwise necessary to investigate theft or other activities potentially in violation of Affirm's policies and procedures applicable to you or against the law, to ensure a secure online environment, or to protect health and safety;

The privacy impact of ongoing retention on the consumer; and

The manner in which information is maintained and flows through our systems, and how best to manage the lifecycle of information in light of the volume and complexity of the systems in our infrastructure.

Qualifications & exceptions

• Criteria are stated as factors, not fixed periods.