<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Retention Policies — API Reference

## Define Policy

```bash
node scripts/agent.js --action define \
  --purpose "PURPOSE" --period "24 months" --basis "consent"
```

## Scan for Expired Data

```bash
node scripts/agent.js --action scan-expired --policies /tmp/policies.json
```

## Generate Deletion Manifest

```bash
node scripts/agent.js --action deletion-manifest \
  --expired /tmp/expired.json --check-legal-hold true
```

## Verify Deletion

```bash
node scripts/agent.js --action verify-deletion --manifest /tmp/manifest.json
```

## List Standard Retention Periods

```bash
node scripts/agent.js --action list-standards
```

## Standard Retention Periods

| Purpose | Period | Basis |
|---------|--------|-------|
| Transaction records | 7 years | Tax/accounting law |
| Marketing consent | Until withdrawal | GDPR Art. 6(1)(a) |
| Employment records | 6 years post-exit | Employment law |
| Customer support | 3 years | Legitimate interest |
| Website analytics | 26 months | CNIL recommendation |
| CCTV footage | 30 days | Legitimate interest |
| Breach records | 5 years | GDPR Art. 33(5) |

## Data Lifecycle States

| State | Description | Action |
|-------|-------------|--------|
| active | In use for purpose | Normal processing |
| archived | Purpose expired, legal hold | Read-only access |
| deletion_pending | Scheduled for deletion | Legal hold check |
| deleted | Soft deleted | Hard delete scheduled |
| verified_purged | Confirmed removed everywhere | Audit complete |
