01Principles
We follow three principles for personal data:
- Minimize — we collect only what's necessary to provide the service
- Limit retention — we keep data only as long as it serves a stated purpose
- Give you control — you can export or delete most categories yourself from Settings → Data & Export
This policy applies to all personal data we collect, including data you provide directly (e.g. profile) and data collected automatically (e.g. lesson progress).
02Retention schedule
Each category of data has a defined retention period. The clock starts when the category becomes "inactive" (you stop using it, leave a project, cancel your subscription, etc.):
| Data category | Retention | Reason |
|---|---|---|
| Account profile | Account lifetime + 30d | Service operation |
| Learning progress & XP | 1 year after last activity | Resume-where-left-off |
| Project submissions & code | 3 years after submission | Portfolio reference |
| Mentor review threads | 3 years after submission | Educational continuity |
| Mock interview recordings | User-configurable · default 6 months | User preference |
| Mentor session recordings | User-configurable · default 2 years | User preference |
| Activity / event logs | 90 days | Operations & debugging |
| Audit logs (security) | 7 years | SOC 2 compliance |
| Payment records | 7 years | Tax law (IRS, HMRC) |
| Support tickets | 2 years after resolution | Service improvement |
| Anonymized analytics | Indefinite | Re-id not possible |
| Database backups | 35 days rolling | Disaster recovery |
"User-configurable" means you can shorten the retention from your Settings → Data & Export panel — including setting it to 0 (don't record at all).
03Why these durations
Short retentions (≤ 1 year)
Anything that doesn't have a long-term business purpose. Activity logs are 90 days because that's a standard window for incident investigation. Lesson progress drops after a year of inactivity because by then a returning learner will benefit more from a fresh start than from picking up where they left off.
Medium retentions (1–3 years)
Anything tied to your portfolio or in-flight learning. Project submissions stay for 3 years because past projects on your public portfolio are part of what we promised when you submitted them.
Long retentions (7+ years)
Audit logs (7 years) are required by SOC 2 Type II controls. Payment records (7 years) are required by US and EU tax law. We don't decide these durations — regulators do.
Indefinite (with caveat)
Anonymized aggregate analytics — page-view counts, conversion rates per cohort, scroll depth distributions. After anonymization there is no path back to any individual user.
04How deletion works
When a category's retention period expires, we run automated deletion:
- Hard delete for personal data — overwritten in the primary database; tombstoned in object storage; removed from search indexes within 24 hours
- Anonymization for analytics-relevant data — primary keys hashed with a one-way function; PII fields nulled
- Backup purge — backups containing deleted data age out within 35 days of deletion (see Backups)
Deletion is logged in your audit trail (timestamp + category + record count) so you can verify it happened.
05Request earlier deletion
You can request deletion before the scheduled retention period in three ways:
- Self-serve — most categories can be deleted from Settings → Data & Export
- Account-wide deletion — Settings → Danger Zone → Delete account — initiates a 30-day grace period after which everything except legally-required records is purged
- Email request — email aidelearning@proton.me with the category you want deleted. We respond within 5 business days and complete within 30 days as required by GDPR
We can't delete what's under legal hold or what we're legally required to retain (e.g. payment records under tax law). We'll always tell you exactly which records we couldn't delete and why.
06Data export
Before you delete, you may want to export. From Settings → Data & Export you can request:
Exports are generated asynchronously and emailed as a signed download link within 5 minutes. Links expire after 7 days.
07Legal hold
If we receive a valid legal request (subpoena, court order, regulatory inquiry) for specific user data, we may place that data on legal hold — pausing the automatic deletion schedule until the legal matter is resolved.
You'll be notified of a legal hold within 14 days unless legally prohibited from notifying you.
08Backups
We take encrypted database backups daily and retain them for 35 days for disaster recovery. Backups are stored in a different geographic region than the primary database.
When you delete data, the deletion propagates to the primary database immediately. Backups containing the deleted data age out within 35 days. We do not selectively delete from individual backups — that would compromise the backups' integrity for recovery.
If a disaster recovery event restores data we previously deleted, we re-run the deletion within 24 hours of the restore completing.
09Contact
For data retention questions or to file a request: