The start-up code of conduct and ethics

You may not even have that option:

http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.HU

As for keeping the history for anti-chargeback purposes, it is my understanding that you are allowed to keep username and log in data and your IPSP will have the rest of the information that you'd need to fight a chargeback.

Also, someone requesting deletion of their data would make it pretty easy to fight that chargeback because they're providing you with auxiliary proof (the request itself) that they've been active users of your site.

The patent claim is a good one, I'll have to think about that.

Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way.

For example, Yahoo! claimed that running Geocities cost them tens of millions of dollars annually, and yet, somehow I can maintain a large fraction (how large a fraction we'll never know) of their accounts up and running for approximately $500 / month.

The problem with giving notice is that many people will never get your notice, even when given 6 months ahead of time.

Imagine dropbox shutting down their free accounts overnight. It's technically within their rights. Ditto google docs and a myriad of other services that people come to rely on.

If I'm keeping your username, your login and usage history (likely IP address) to fight the chargeback, I haven't deleted all your data by a long shot.

> Keeping a free service 'up' without allowing new data to be entered in to the system post shutdown without support or development costs a very small fraction of what it would cost to run the service in an active way.

Keeping anything running has cost, you don't just stand up a machine, step back, and hope for the best. There's maintenance, patches, IDS work, etc. Hitting a "read only" flag in your software (presuming it exist) doesn't make the machine invulnerable.

I think you are approaching this in too literal a way.

IPSPs typically log IP addresses, usernames link accounts to payments, and are stored on both sides (with you and with the IPSP) anyway.

But your user uploading pictures, saving content, making spreadsheets and so on, that user data is the data that is most likely most relevant to the user.

Their email address is relevant too, if you plan to use it. If you delete their account but keep a log that the account was deleted at the request of email address 'x' mailing you from IP address 'y' and that that user had at the time of deletion logged a grand total of 64 hours on your service over a period of 90 days then that's just fine as far as I read the law.

Yes, there is a cost to keeping a free service alive post shutdown. And you probably should factor that cost in to your business plan when you start. And if maintaining a service in such a way that users can get their data out post shutdown (and possibly a migratory service or a deal with 'web.archive.org' to archive the site, which, ironically may be in violation of several countries' laws) is too expensive then you can wonder if that service is viable to begin with. Typically those costs are a very small fraction of what it would cost to run a service in an active mode.

I currently host 3 projects that are officially 'dead', their creators no longer felt that they were going to spend another dime on them and I feel that to do right by the users the small amount of money that it takes to 'keep the lights on' is far outweighed by the benefit to the users.