Session replay logs keep 90 days of taps, chat keeps 7

Most regulated operators now retain session replay logs for 90 days, while live chat transcripts get wiped after 7. That gap isn't an accident or a rounding error — it's a deliberate split between data the compliance team treats as evidence and data the support team treats as a liability. If you've ever asked a casino to produce the chat where an agent promised you a bonus, you've probably already run into the wrong side of it.

The 90-versus-7 split shows up across a surprising number of operators, and it tends to be consistent even when almost everything else about their data policies differs. Two brands with completely different bonus structures, different licensing jurisdictions, and different payment stacks will often land on the same numbers. That consistency is worth understanding, because it tells you what each type of record is actually for.

What session replay actually captures

Session replay isn't video. It's a reconstruction — DOM snapshots, click coordinates, scroll depth, keystroke timing (usually not the keys themselves), and network events stitched back together so an analyst can watch a ghost of your session play out. On a casino, that means every spin button press, every bet slip edit, every time you opened the cashier and closed it again without depositing.

The retention period sits at 90 days for a few reasons that stack on top of each other:

• Dispute windows. Card chargebacks typically have to be raised within 120 days under most card scheme rules, and payment processors often want evidence faster than that. A 90-day log covers the realistic dispute period without holding data indefinitely.
• Bonus abuse investigation. Multi-accounting and matched-betting rings are usually detected weeks after the fact, once patterns emerge across a cohort. You need the raw session data to prove that two "different" accounts were operated by the same hands.
• Regulatory minimums. Several licensing regimes require operators to retain records relevant to player disputes for at least three months. Ninety days clears that bar with a small margin.

The practical effect is that if you dispute something 100 days after it happened, the operator may genuinely have nothing to show you. Not because they're hiding it — because the retention policy already deleted it. That cuts both ways: the same policy that protects them from a stale complaint also means they can't defend themselves against one.

The keystroke question

One thing worth flagging: replay tools can be configured to capture input values or to mask them. Masked by default is the norm in regulated markets, but "by default" is doing real work in that sentence. If you're entering card details, a national ID number, or a self-exclusion request into a form, whether that field is masked depends on how the operator configured the tool — and configuration drift between environments is common.

Why chat gets seven days

Live chat is the opposite problem. It's high-volume, low-signal, and full of things nobody wants on the record.

A mid-sized operator might handle 40,000 to 60,000 chat sessions a month. Storing all of that for 90 days is technically trivial but legally expensive — every transcript is discoverable, and transcripts are where agents say things they shouldn't. "I'll credit you the bonus manually" said by a junior agent at 3am becomes a contractual argument six weeks later.

Seven days covers the operational need: resolving an in-flight issue, letting a supervisor review a flagged interaction, and giving QA something to score. After that, the transcript's value drops off a cliff while its risk stays flat.

There's a second reason, less discussed. Chat transcripts frequently contain player-typed personal information — addresses, partial card numbers, medical context volunteered during a responsible gambling conversation. Deleting fast is a defensible privacy position. Keeping them for 90 days is harder to justify to a data protection authority, particularly in jurisdictions where storage limitation is an explicit principle rather than a suggestion.

The exception that proves the rule

Chat isn't always seven days. Two categories routinely get pulled out and kept longer:

1. Responsible gambling interactions. If a player discloses harm or requests a limit change, that transcript often gets tagged and retained under a different policy — sometimes years, because regulators want to see how the operator responded.
2. Complaints and escalations. Anything that becomes a formal dispute gets exported out of the chat system and into a case management tool, where the retention clock resets.

So the real picture is messier than "seven days." It's seven days for routine chat, and something much longer for the small fraction that matters. The 7-day figure is the default, not the rule.

What this means when you have a problem

The asymmetry creates a specific practical hazard: the evidence you'd most want as a player is the evidence that disappears fastest.

Session replay proves what you did. Chat proves what you were told. If an agent misstates a wagering requirement and you play on that basis, the replay will show you spinning — it won't show why you thought the terms were different. And by the time you've waited three weeks for a complaint to go through the operator's internal process, the transcript is long gone.

A few things follow from that:

• Screenshot anything that matters at the time. Not because the operator will lie, but because they may have nothing left to check against.
• Ask for the transcript reference number during the chat itself. Most platforms assign one. It's the only way to anchor a later dispute to a specific conversation.
• If you escalate to a regulator or ADR body, do it early. The dispute window and the retention window are not the same length, and the shorter one usually wins.

There's a counterargument worth taking seriously: long chat retention would make agents more guarded, and guarded agents resolve fewer problems. Some operators have told me they deliberately keep transcripts short so support staff feel able to be candid and flexible. That's a real trade-off, not a corporate excuse — though it's also convenient for the operator, which is exactly why it deserves scrutiny rather than acceptance.

The part nobody's settled

The interesting question isn't whether 90 and 7 are the right numbers. It's whether the split survives the next few years.

Regulators in several markets are moving toward longer retention requirements for anything touching player protection, and AI-assisted support tools are pushing in the opposite direction — an LLM that summarises every chat and stores the summary rather than the transcript changes the retention calculus entirely. A summary is smaller, cheaper, and arguably more discoverable, because it's already been interpreted.

If that becomes standard, the seven-day window stops being a real deletion. The transcript goes, the summary stays, and the summary is the version a regulator or a court will read. Whether that's better or worse for players depends entirely on who writes the summarisation prompt — and right now, that's the operator, with no disclosure requirement and no standard format.

So the honest answer to "how long does the casino keep your data" is: long enough to defend themselves, short enough to avoid explaining it. The 90-day replay log and the 7-day chat are two different answers to two different questions, and neither one was designed with you in mind.

If you're gambling more than you intended, or a dispute has you stressed about money you can't afford to lose, the retention policy is not the thing to fix first. Most regulators publish a self-exclusion register and a complaints route that don't depend on the operator's own records at all — and those are worth knowing about before you need them.