i just have this thing as part of my privacy policy the full thing is ~2.4k words so i just posted the part that relates to what was being discussed here.
We log every single message that you have ever sent to any other person via chatting within the game world, every mail item you've sent to any other player within the game world, on the forums, every comment that you post on any of the blog entries that you have and every post in every forum that you send us. Also we actively hold your email address for password retrieval. Upon leaving us all such information may be deleted after 90 days time although we are not entitled to delete all of your information. The only information that we remove upon your accounts closures is your personally identifiable information such as your username, email, the hashed password, and any other information that you have provided us when you were filling in your profile. All logs that we have collected shall be stored indefinitely.
It pretty much sums up everything within itself in a timely and nice manner and also lets them know that all messages shall be stored for 90 days before being removed. I've set it up to remove all messages after 6 months of nothing bad happening and the reason for this is identifying any sort of bots/harrasment issues so that we can track them back through such time. The information itself is only opened on a case by case basis though so only those who have an active ticket open that relates to such information shall be granted the rights to view a small selection of it. I have access to it though since i'm always there but i don't see any reason why reading people's messages would be in the least bit entertaining so i leave it there until it's needed and then the permission is provided on an as-is basis. Also the player's don't have to know that they're being investigated because then they'll most likely change their mannerisms. Since the logs as i said are only kept for a maximum of six months if the player's are still there. And also catching the person in the act would make it impossible to see. I also have the Staff setup currently in my designs to be able to go "undercover" in teh game world and seem like a normal player and investigate upon them. But mostly, you should put something to what i have if you're planning on using the information for any purpose so that you won't be sued by privacy issues and of course remember that it is illegal to gain information from anyone under the age of 13 years, in the US at least not sure about international laws.