For credit card transactions, personal information is encrypted and retained only until the chargeback period closes, usually about four months or 120 days. After that, it’s securely deleted since there’s no longer a business need to keep it. This is standard across e-commerce, as chargeback fraud is unfortunately very common.

I’m not going to concede to the idea that these products are or ever will be demonized. Any enforcement action would require an actual change in law, not a bureaucratic reinterpretation. To our understanding our product is fully legal and recognized as such at the federal level. The way your question is framed suggests an unnecessary assumption of guilt. Some people consider cigarettes to be bad, yet no one is calling for a list of customers who buy them. If you have personal concerns about legality, I’d recommend speaking with a qualified attorney.

We don’t remove data to hide anything. Our retention policy exists purely to keep systems efficient and reduce bloat on our end. We maintain a basic sales record for accounting similar to a gas station receipt, which includes the date, item purchased, payment method, and total amount.

With alternative payment methods, customers have much more control over what personal information they provide. For example, privacy-minded buyers may use TOR to visit the site, XMR to pay, Guerilla Mail to confirm, and ship to "Current Resident" at new construction. When paying by card, the billing information must match the card issuer’s records, which naturally reduces privacy to near zero.

Even if we remove your record from our system, your payment provider will still have a record of the transaction on their end. There’s nothing unusual or concerning about that, but if privacy is your top priority, alternative payment methods are the smarter choice. Keep in mind, when that well-known litigious company first came under scrutiny, the authorities didn’t need it's customer database, they simply followed the paper trail through the shipping carriers.

TLDR: 120 days. Good operational security matters more than any company’s policy when privacy is the main concern.