1. Purpose & Scope
This Log and Data Retention Policy defines the technical standards, legal bases, retention intervals, and deletion procedures for all digital records, access telemetry, and prompt audit trails collected across ModStudio AI systems. It operates in conjunction with our Terms of Service and Privacy Policy.
2. Security & Access Logs (Law 5651 / GDPR Art. 32)
To guarantee system integrity, prevent unauthorized intrusion, defend against distributed denial of service (DDoS) attacks, and comply with mandatory telecommunications and cybercrime statutes (including Turkish Law No. 5651 on Internet Publications and Cybercrimes), our edge infrastructure logs incoming network traffic.
Access log entries contain:
- Source IP Address and originating port;
- Exact Timestamp synchronized via Network Time Protocol (UTC);
- HTTP Method & Target URI (e.g.,
POST /v1/ai/chat); - HTTP Response Status Code (e.g., 200, 401, 402, 429);
- User-Agent String and client identification headers;
- Session Identifier or User ID (where an authenticated token is presented).
Statutory Mandate (Law 5651)
Under Law 5651 and related regulations, internet service providers and hosting hosts are legally required to maintain time-stamped access traffic logs for a minimum duration of 12 months up to 24 months, sealed with cryptographic hashes to ensure data integrity during formal judicial requests.
3. Prompt & Output Audit Logging
Because ModStudio AI generates functional software code (Java, Kotlin, JSON datapacks, and scripts), maintaining an unalterable audit trail of generative requests is essential to prevent illegal exploitation.
User Attribution & Auditability
Every prompt submitted to our AI chat or mod architecture pipeline, along with the corresponding tool calls and output blueprints, is cryptographically tied to the authenticated User ID and preserved in our audit ledger. Users cannot selectively erase audit records associated with active or past billing cycles.
These audit logs are maintained for the following legitimate and legal purposes:
- Abuse & Exploit Monitoring: Reviewing queries flagged by automated heuristics for cheat creation, server-crashing bytecode, or malicious backdoors;
- Compliance with Law Enforcement Subpoenas: Responding to lawful court orders, criminal investigations, or intellectual property infringement inquiries;
- Token & Billing Dispute Resolution: Verifying token consumption metrics in the event of credit refund or billing discrepancy claims.
4. Financial & Transaction Logs
Records concerning credit package purchases, Paddle webhook receipts, and balance adjustments are recorded in an immutable ledger (credit_transactions table in Cloudflare D1). Each transaction record includes:
- Internal transaction ID and authenticated User ID;
- Credit delta (positive for purchases, negative for spend);
- Remaining credit balance after operation;
- Reason code (
purchase,spend,refund); - Unique Paddle idempotency key (
paddle:txn_id) preventing replay attacks; - Unix timestamp of execution.
Financial transaction records are preserved for a statutory period of 7 to 10 years in compliance with international commercial law, tax reporting mandates, and corporate audit standards.
5. Retention Schedule Matrix
| Log Category | Data Included | Operational Hot Storage | Cold Compliance Archive | Legal Basis |
|---|---|---|---|---|
| Access & HTTP Logs | IP address, timestamp, HTTP verb, route, user agent, status | 30 days | 12–24 months | Law 5651 / GDPR Art. 6(1)(c) |
| Rate Limit Records | Rate key, request counts, window expiration timestamp | 1 to 60 minutes | None (auto-purged) | GDPR Art. 6(1)(f) / Security |
| AI Prompt History | Prompt text, project context, tool arguments, User ID | 90 days | 12 months | AUP Enforcement / Security |
| AI Token Telemetry | Input/output token counts, execution latency, model name | 180 days | 24 months | Billing & Contract Fulfillment |
| Credit Ledger | User ID, amount, balance, reason, Paddle idempotency key | Active life of account | 7–10 years | Tax & Commercial Accounting Law |
| Auth Session Logs | Session IDs, token expiry, revocation status | 30 days | 12 months | GDPR Art. 32 / Security |
6. Abuse & Malware Detection Heuristics
Our server-side ingestion pipeline scans prompt inputs and generated outputs against known patterns associated with malicious activities:
- Attempts to generate obfuscated class loaders or bytecode injection;
- Known server denial-of-service crash packets;
- Automated botting scripts or cheat frameworks.
When an automated safety violation is triggered, a high-priority incident log is generated and retained indefinitely in our security vault to protect the platform and multiplayer gaming communities.
7. Storage Security & Hashing
All log data is treated with enterprise-grade security:
- Zero Plaintext Storage of Secrets: Passwords, API tokens, and webhook secrets are never logged in plaintext. Authorization tokens are logged only as truncated hashes (e.g.,
access_hash); - Encryption at Rest & in Transit: Logs are encrypted in transit via TLS 1.3 and stored in encrypted Cloudflare D1 volumes and cold object stores;
- Strict Access Boundaries: Log access is restricted exclusively to authorized Site Reliability Engineers and Legal Compliance personnel under multi-factor authentication (MFA).
8. Log Deletion & Anonymization Routine
When the retention period for a log record expires:
- Automated scheduled cron workers (such as our worker scheduled maintenance jobs) execute hard deletes on expired records (e.g., expired rate limit counters, revoked session rows older than 30 days);
- Archived telemetry logs are irreversibly purged or aggregated into fully anonymized statistical metrics stripped of all IP addresses and User IDs;
- Account deletion requests submitted under GDPR or KVKK will immediately purge profile details, but mandatory statutory logs (Law 5651 access records and financial tax transactions) will be retained until the expiry of their respective statutory retention periods as permitted under GDPR Article 17(3)(b).
For questions regarding log records, contact [email protected].