Data Retention & Deletion Policy

Last updated: February 2026

This policy describes how long DCM retains data and how deletion requests are handled. If an institutional agreement (for example, a university or district contract) sets different terms, that agreement controls.

1. Default retention periods

Data category	Default retention	Notes
Teacher account data (email, display name, settings)	While account is active	Deleted after verified account closure request.
Classrooms, students, assignments, evaluations	While active	Deleted after classroom/student/account deletion request.
Uploaded files (PDFs/images/rubrics)	While related record exists	Removed with associated entities, subject to purge cycles.
Temporary export artifacts / work files	Up to 30 days	Operational target; may be shorter based on cleanup jobs.
Audit logs (access/action records)	24 months	May be extended for legal, regulatory, or contractual requirements.
Billing/subscription records	Per applicable tax/accounting requirements	Includes Stripe transaction references.

2. Deletion process

Verified deletion requests are generally processed within 30 days.
Deletion includes primary database records and related object storage assets.
Backups may retain data temporarily until backup retention windows expire.

3. Backups and restore

DCM keeps operational backups for service continuity. Deleted data can persist in backups for a limited period, then ages out according to backup retention settings.

4. Third-party processors

DCM relies on third parties for authentication, infrastructure, payments, and monitoring. Those providers process data under their own terms and applicable data processing agreements.

5. Privacy requests

For export or deletion requests, contact: privacy@providencesociety.com.