Data Retention & Deletion Policy
Last updated: March 25, 2026
1. Purpose
This policy defines how long Ludwitt retains different categories of data, when and how data is deleted, and the procedures for post-termination data destruction. It applies to all data collected through the Ludwitt platform, including data from institutional customers. This document is intended for university procurement teams, compliance officers, and data protection personnel.
2. Active Account Data
The following data is retained for the duration of an active user account, unless otherwise specified.
| Data Category | Examples | Retention Period | Justification |
|---|---|---|---|
| Account credentials | Email, hashed password, OAuth tokens | Duration of account | Required for authentication |
| Profile information | Display name, avatar, preferences | Duration of account | User-controlled |
| Learning progress | Accuracy rates, XP, difficulty levels, streaks | Duration of account | Core product functionality |
| Problem attempts | Answers submitted, correctness, timestamps | Duration of account | Required for adaptive learning algorithms |
| Achievement data | Badges, milestones, leaderboard position | Duration of account | Gamification features |
| Credit transactions | Deposits, usage, balances | Duration of account + 7 years | Financial record-keeping requirements |
| Subscription data | Plan type, billing cycle, Stripe IDs | Duration of subscription + 7 years | Financial/tax requirements |
3. Sensitive Data (Enhanced Protection)
Sensitive data receives additional encryption and access controls beyond standard protections.
| Data Category | Examples | Retention Period | Protection |
|---|---|---|---|
| Date of birth | Used for COPPA age verification | Duration of account | AES-256-GCM encrypted at rest |
| Parental consent records | Consent status, parent email | Duration of minor's account + 3 years | Encrypted, audit logged |
| FERPA audit logs | Data access records (who accessed what, when) | 3 years from creation | Immutable, append-only |
4. Transient Data (Short-Term)
The following data is ephemeral and retained only for the minimum period required for system operation.
| Data Category | Examples | Retention Period | Notes |
|---|---|---|---|
| AI API payloads | Questions and answers sent to Anthropic | Zero — not persisted | Processed in-memory only |
| Session tokens | Firebase Auth tokens | 7 days maximum | Auto-expire, cleared on logout |
| Rate limit counters | Request counts per user | 1–60 minutes | Redis TTL-based |
| reCAPTCHA tokens | Anti-abuse verification | Duration of request | Not stored |
5. Infrastructure & Operational Data
Operational infrastructure generates logs and diagnostic data that are retained on defined schedules.
| Data Category | Examples | Retention Period | Notes |
|---|---|---|---|
| Server logs | Vercel function logs | 30 days | Metadata only, no request bodies |
| Error reports | Sentry error captures | 90 days | May contain stack traces; PII scrubbed |
| Database backups | Daily Firestore snapshots | 30 days rolling | Encrypted, same access controls as production |
| CI/CD logs | GitHub Actions run logs | 90 days | No user data |
6. Institutional Post-Termination Deletion
Upon termination or non-renewal of an institutional contract, Ludwitt follows a structured, phased deletion process. Institutions can request data export at any time during the active contract period via /api/data-export/download.
| Phase | Timeline | Actions |
|---|---|---|
| Notification | Contract end date | Institution notified of upcoming data deletion |
| Grace period | 30 days post-termination | Institution can export all data (final opportunity) |
| Primary deletion | 31–60 days post-termination | All student records, progress data, analytics, and org configuration deleted from production database |
| Backup purge | 61–90 days post-termination | Data removed from all backup systems as backups rotate (30-day rolling backups) |
| Certification | Within 90 days | Written proof of deletion provided to institution |
7. Deletion Certification
Upon completion of data destruction, Ludwitt provides the institution with a signed Certificate of Data Destruction containing:
- Date range of the deletion process
- Categories of data deleted
- Systems from which data was removed (production, backups, logs)
- Confirmation that no copies remain in any Ludwitt-controlled system
- Confirmation that sub-processors have been notified (where applicable)
- Name and title of certifying officer
Institutions may request a deletion certification at any time by contacting dpo@ludwitt.com. Certifications are provided within 90 days of contract termination.
8. Individual User Deletion
Users can delete their account at any time through self-service options:
- Settings → Account → Delete Account in the platform UI
- API endpoint:
DELETE /api/user/delete-account
Deletion Cascade Scope
When a user account is deleted, the following data is removed:
| Data | Action | Timeline |
|---|---|---|
| Account credentials | Deleted from Firebase Auth | Immediate |
| Profile information | Deleted from Firestore users collection | Immediate |
| Learning progress | Deleted from all progress subcollections | Immediate |
| Achievement data | Deleted from achievements collection | Immediate |
| Credit balance | Zeroed, remaining balance forfeited | Immediate |
| Credit transaction history | Anonymized (userId removed), retained for financial records | Immediate anonymization, 7-year retention |
| Subscription data | Cancelled in Stripe, record anonymized | Immediate |
| FERPA audit logs | Retained (regulatory requirement) | 3-year retention |
| Uploaded files | Deleted from Firebase Storage | Immediate |
| Organization membership | Removed from org member lists | Immediate |
9. Automated Compliance Deletion
A daily automated process runs at 3:00 AM UTC via the/api/compliance/deletion-process endpoint to enforce retention schedules:
- Process any pending deletion requests
- Remove expired data per retention schedules
- Clean up orphaned records
- Verify deletion completeness
This automated process ensures that data retention schedules are enforced consistently, even if manual deletion requests are not submitted. All automated deletions are logged for audit purposes.
10. Data Subject Rights
Right to Access (GDPR Article 15 / FERPA)
- Users can export all their data via Settings → Account → Export My Data
- API endpoint:
GET /api/user/export-data - Export format: JSON
- Response time: Immediate (automated)
Right to Erasure (GDPR Article 17)
- Users can request deletion through the platform UI or by emailing dpo@ludwitt.com
- Response time: Within 30 days
- Exceptions: Data required for legal obligations (financial records, audit logs)
Right to Rectification (GDPR Article 16)
- Users can update their profile information at any time through account settings
- Institutions can request corrections to student records via their admin dashboard
Right to Data Portability (GDPR Article 20)
- Data export available in machine-readable JSON format
- Institutional bulk export available in CSV and JSON
- Anonymization option available for research use
11. Sub-Processor Data Handling
The following table describes how each sub-processor handles data retention.
| Sub-Processor | Data Received | Their Retention | Our Control |
|---|---|---|---|
| Anthropic | Educational content only (no PII) | Zero (stateless API) | API terms prohibit retention |
| Stripe | Payment information | Per Stripe's retention policy | We do not store card numbers |
| Google/Firebase | All platform data | Our retention policy applies | We control deletion |
| Vercel | Request logs (metadata) | 30 days | Automated rotation |
| Daily.co | Video/audio streams | Duration of session only | No recording by default |
| Sentry | Error reports | 90 days | Configurable, no PII in reports |
12. Policy Enforcement
- This policy is enforced through automated processes (daily deletion cron), Firestore security rules, and application-level controls
- The Data Protection Officer (dpo@ludwitt.com) is responsible for policy compliance
- This policy is reviewed and updated annually or when significant changes occur
- Institutional customers are notified 30 days in advance of any material changes to this policy
Related policies: Privacy Policy, Data Processing Agreement, Student Privacy Policy, AI Transparency & Student Data.
For data retention inquiries, contact dpo@ludwitt.com.