The policy states that personal data is retained for as long as needed to provide services or fulfill collection purposes, with extensions permitted for legal obligations and dispute resolution, and that aggregate data may be retained indefinitely for research and service development.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision does not specify fixed retention periods for any data category, relying instead on purpose-based criteria and a list of factors. The authorization to retain aggregate information beyond stated retention periods for research and development purposes, without a defined timeline, creates an open-ended data retention authorization.
Interpretive note: The absence of specific retention periods for defined data categories creates ambiguity regarding actual deletion timelines, which may vary from the policy's stated purpose-based criteria depending on internal operational practices.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →The agreement states that personal data retention is governed by purpose-based criteria rather than fixed periods, and that aggregate data may be retained beyond the standard retention period for research and service improvement. Under these terms, users cannot determine a specific deletion timeline for their personal data from the policy text alone.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →"We will retain your Personal Information for as long as we need it to provide you with access to our Services or to fulfill the purposes for which it was collected, as described in this Privacy Policy, unless a longer retention period is required by law or necessary to resolve disputes and enforce our agreements. Where we process Personal Information for marketing purposes, we process the data until you ask us to stop and for a short period after this request (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing so that we can respect your request in the future. We may retain aggregate information beyond the retention period for research purposes and to help us develop and improve our Services.Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR's storage limitation principle, which requires that personal data not be kept longer than necessary for the specified purpose, and CCPA's data minimization expectations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision does not specify fixed retention periods for any data category, relying instead on purpose-based criteria and a list of factors. The authorization to retain aggregate information beyond stated retention periods for research and development purposes, without a defined timeline, creates an open-ended data retention authorization.
The agreement states that personal data retention is governed by purpose-based criteria rather than fixed periods, and that aggregate data may be retained beyond the standard retention period for research and service improvement. Under these terms, users cannot determine a specific deletion timeline for their personal data from the policy text alone.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.