Retention, Deletion, and Business Closure Policy

A verified account receives a 14-day trial. If trial or complimentary access expires, classroom access pauses for a 30-day recovery window. If paid access ends, a 90-day recovery window applies. A failed renewal may first receive a 7-day renewal grace period. Recovery deadlines use the later applicable access-ending event and are not shortened by an older source.

During recovery, the teacher can view account status, subscribe, export account data, make a verified deletion request, contact support, change language/theme, read legal pages, and log out. Classroom mutations and student access are restricted.

Teacher profile, support, legal acceptance, and entitlement data: retained during access/recovery; then unnecessary identity and content are removed or anonymized, with narrow legal, security, acceptance, and accounting evidence retained. Student identity and enrollment: retained while school-directed use or recovery continues; then names, credentials, and active enrollment are removed or replaced by privacy-safe placeholders.

Mutable class, order, goal, payroll/rent label, account/profile, and upload content covered by the cleanup service: available for export during access/recovery, then scrubbed, anonymized, or deleted. Upload files are deleted after the database cleanup commits and retried safely if storage deletion fails.

Immutable transactions and linked order, payroll, rent, account, and audit history are never silently rewritten as a correction or privacy mechanism. Identifiers are anonymized, but teacher-authored transaction descriptions and student-visible reasons may remain, and pet names or historical pet/accounting records may remain under anonymized identity. Educators must not put unnecessary personal information in ledger reasons. Retained raw authored text is not necessarily privacy-safe. Payment/accounting events and legal acceptance evidence remain only for classroom integrity, transaction support, security, dispute, tax, or legal duties; Stripe/Link independently controls its records.

A verified teacher may request immediate privacy deletion without waiting for recovery to end. Schools, parents, and eligible students may request review, correction, export, stopping collection, or deletion through the educator or [email protected]. Verification is proportionate and does not disclose account existence to an unauthorized person.

The teacher account ZIP includes scoped classroom, student, enrollment, simulated ledger, store, jobs, payroll, rent, goals, settings, subscription, and legal metadata with a manifest. It excludes password hashes, tokens, secrets, join codes, private billing identifiers, and unsafe internal paths.

Backups age out through the verified deployment rotation and are not selectively edited. A restoration must reapply completed or due cleanup before normal use. The public vendor inventory must identify the configured backup processor and location before signup relies on it.

A keyed, non-reversible trial-abuse fingerprint may remain to prevent repeated free trials after anonymization. Narrow records may be preserved for immutable classroom history, security, fraud prevention, legal claims, tax/accounting, or a valid preservation order. An exception does not authorize unrelated use.

For a planned business closure, Andrew Hall will provide reasonable advance notice to schools/teachers when feasible, open a practical export window, stop unnecessary new collection, coordinate configured vendors, and then delete or anonymize data under this schedule.

Emergency, security, legal prohibition, or insolvency may make advance notice or a full export window impossible. The policy does not promise an outcome outside the operator's control; available notice and safe return/deletion remain the goal.

Contact [email protected] for a retention or closure question. The en-US text controls. Material retention reductions or expanded uses require policy review and any notice or renewed acceptance required by law or contract.