Data Retention & Deletion Policy
Last updated: February 2026
This policy describes how long DCM retains data and how deletion requests are handled. If an institutional agreement (for example, a university or district contract) sets different terms, that agreement controls.
1. Default retention periods
| Data category | Default retention | Notes |
|---|---|---|
| Teacher account data (email, display name, settings) | While account is active | Deleted after verified account closure request. |
| Classrooms, students, assignments, evaluations | While active | Deleted after classroom/student/account deletion request. |
| Uploaded files (PDFs/images/rubrics) | While related record exists | Removed with associated entities, subject to purge cycles. |
| Temporary export artifacts / work files | Up to 30 days | Operational target; may be shorter based on cleanup jobs. |
| Audit logs (access/action records) | 24 months | May be extended for legal, regulatory, or contractual requirements. |
| Billing/subscription records | Per applicable tax/accounting requirements | Includes Stripe transaction references. |
2. Deletion process
- Verified deletion requests are generally processed within 30 days.
- Deletion includes primary database records and related object storage assets.
- Backups may retain data temporarily until backup retention windows expire.
3. Backups and restore
DCM keeps operational backups for service continuity. Deleted data can persist in backups for a limited period, then ages out according to backup retention settings.
4. Third-party processors
DCM relies on third parties for authentication, infrastructure, payments, and monitoring. Those providers process data under their own terms and applicable data processing agreements.
5. Privacy requests
For export or deletion requests, contact: privacy@providencesociety.com.