Know what exists.
Know what does not.

Current and planned pilot processing

• In the current protected nonproduction candidate, Clerk processes the selected Google or email method, MFA, provider session and its own security signals.
• RebelMarket briefly receives the Clerk subject during that nonproduction access flow and converts it to an environment-bound keyed commitment. The raw subject is not persisted in Marketplace tables.
• Only after separately authorized Production activation would isolated Neon storage hold keyed account and session commitments, security timestamps, encrypted draft revisions and wrapped-key records, distinct verification and rights claims, moderation and publication evidence, exact private-object references, deletion claims, operator duty and authorization commitments, and redacted audit receipts.
• Only after that activation would private creator media use Marketplace-only AWS S3 quarantine and derivative boundaries. AWS KMS would protect draft keys, and the exact quarantined object would be submitted to the configured malware-protection boundary before a bounded safe derivative could be approved.
• Those future Production records would support creator access, private drafting, human review, explicit publication or withdrawal, abuse response, recovery, privacy requests, deletion evidence, security auditing and aggregate pilot measurement. They would not be used for advertising or cross-product tracking.
• Marketplace does not store email, phone, wallet, IP address, user agent, precise location, browser fingerprint, private RAAP memory or advertising identifiers.
• If a future pilot projection is separately approved and published, public discovery would receive only that projection and its safe derivative. Private drafts, original uploads, quarantine objects, provider subjects and operator contact details would never be public.

Retention and control

• Ordinary expired and revoked session records are eligible for purge after 30 days.
• A session commitment copied into deletion-reconciliation evidence is not part of the ordinary 30-day session record. Unresolved evidence remains blocked until a safe terminal result; terminal linked evidence becomes purge-eligible only after every linked authorization has completed its 400-day period.
• Global revocation retains a minimal subject commitment and blocks new Marketplace-session issuance until a future separately reviewed human re-enable ceremony exists. The current candidate has no re-enable route or operator authority and does not purge an active block.
• Abuse attempts are eligible at their exact 30-day retention deadline.
• Private media-grant use evidence is exact-object/version/digest bound and eligible after 30 days. Rejected media and revision keys are eligible only after retention. An active legal hold for the exact account, tenant, draft and revision lineage suspends destructive retention until the hold expires or is independently released.
• A revision can be recorded as deletion-complete only when its exact wrapped-key record is destroyed and the destruction evidence matches.
• Deletion, security, completed recovery, operator-duty and linked authorization evidence may be retained for 400 days in pseudonymous or redacted form. A linked set is eligible only after every receipt and authorization in it has completed its own 400-day period. Completed recovery cases and expired or revoked duty generations are then purged with their exact linked evidence as a complete bounded set. Long-lived workflow history keeps only an unlinkable receipt-scoped actor commitment after the bounded operator link is removed.
• An active, separately recorded operator-evidence hold pauses those bounded purges until its disclosed deadline. The isolated hold-authority boundary may place or extend a hold with a fresh, exact, single-use authorization; placement and purge share the same lock. This candidate has no early-release path.
• Provider backups must remain unreadable to the application after deletion and must reapply the deletion ledger before any restored record can be read.
• Security evidence is append-restricted, pseudonymous, signed with explicit monthly derived key versions and pruned only as a contiguous anchored prefix; it is not advertised as an immutable legal record.

Your pilot controls

• Before admission, each creator receives the authenticated creator-support channel and the name of the human privacy/deletion owner. That channel accepts access, correction, export, restriction, publication-withdrawal and deletion requests without asking for a wallet or copying private content into support notes.
• Control of the selected account method is checked through the creator's fresh MFA-protected Marketplace session. This does not verify real-world identity, creator status, authorship, rights, ownership or publication authority. Recovery is a non-enumerating human ceremony and never restores verification, rights claims or publication approval.
• Browsing, drafting, saving and previewing do not require repeated step-up checks. A fresh check is required only for the exact high-risk approval, publish, unpublish or emergency-takedown action; it expires within five minutes and is consumed once.
• A deletion request immediately denies creator access. Original and derivative objects, caches, queues, indexes, revision keys and backups then follow the evidence-backed deletion process, subject to a disclosed legal hold.
• A creator may withdraw an approved public projection without deleting retained evidence. No pilot consent authorizes a listing, sale, license, wallet action, AI decision or use by RAAP, Rebel Economy Core or Antthony.

Clerk, Neon and the isolated AWS KMS, S3 and malware-protection boundaries are the pilot processors. Their exact Production projects, regions, retention settings and contractual terms must be recorded in the release evidence before the first creator is admitted. If the authenticated request channel or named privacy owner is unavailable, creator admission stays closed.