Data Retention Schedule — ThinkKits Security

Data Retention Overview

ThinkKits maintains a comprehensive data retention schedule that balances operational needs, legal requirements, and privacy protection. Our retention policies comply with FERPA, state privacy laws, and industry best practices.

Session Data

90 Days

User session logs, login history, and temporary authentication tokens for security monitoring and troubleshooting.

Examples: Login timestamps, IP addresses, browser information, session tokens

Search & Usage Logs

1 Year

Platform usage patterns, search queries, and feature utilization data for product improvement and analytics.

Examples: Search terms, page views, feature usage, performance metrics

User Account Data

Lifetime + 30 Days

User profiles, preferences, and account settings retained during active subscription plus 30 days after deletion for recovery.

Examples: Profile information, saved schools, preferences, subscription history

Analytics Data

2 Years

Aggregated usage analytics and performance metrics for business intelligence and product optimization.

Examples: User engagement metrics, feature adoption rates, performance statistics

Financial Records

7 Years

All financial transactions, invoices, and payment records maintained for tax compliance and audit requirements.

Examples: Invoices, payments, refunds, tax records, subscription history

Student Data (FERPA)

45 Days Max

Educational records purged within 45 days of district deletion request, in full compliance with FERPA requirements.

Examples: Student demographics, assessment data, educational records (district-provided only)

FERPA Compliance Notice

ThinkKits processes only publicly available NCES school-level data and does not access, store, or process student education records as defined under FERPA. We are not a "school official" under FERPA. Districts may request deletion of any district-submitted account data at any time, and we will comply within 45 days.

Detailed Retention Schedule

This comprehensive table outlines retention periods, legal basis, and deletion procedures for all data types processed by ThinkKits.

Data Type	Retention Period	Legal Basis	Deletion Trigger	Deletion Method
User Account Information	Lifetime + 30 days	Contract performance, legitimate interest	Account deletion + 30 days	Automated purge with audit log
Authentication & Session Data	90 days	Security monitoring, fraud prevention	Rolling 90-day deletion	Automated purge, daily cleanup job
Search & Usage Logs	1 year	Product improvement, analytics	Rolling 12-month deletion	Automated archival and deletion
Platform Analytics	2 years	Business intelligence, compliance	Rolling 24-month deletion	Automated archival with summary retention
Customer Support Data	3 years	Customer service, quality assurance	Rolling 36-month deletion	Manual review and automated deletion
Marketing & Communication Data	3 years	Marketing consent, relationship management	Consent withdrawal or 3 years	Automated deletion with consent tracking
Contract & Legal Documents	7 years	Legal compliance, contract enforcement	Contract end + 7 years	Manual review and secure archival
Financial & Billing Records	7 years	Tax compliance, audit requirements	Tax year end + 7 years	Secure archival with audit controls
Educational Records (FERPA)	45 days max	District contract terms, data retention policy	District request or service termination	Immediate secure deletion with verification
Backup & Archive Data	Same as source + 90 days	Business continuity, disaster recovery	Source retention + 90 days	Automated purge with source data

Data Deletion Procedures

Automated Deletion Systems

ThinkKits employs automated systems to ensure consistent application of retention policies. Daily cleanup jobs identify and purge data that has exceeded retention periods, with full audit logging of all deletion activities.

Deletion Request Process

Request Verification: Verify identity of requesting party and authority to request deletion
Scope Assessment: Identify all data types and locations affected by deletion request
Legal Review: Confirm legal basis for deletion or any retention requirements
Technical Execution: Execute deletion across all systems and backups
Verification: Verify complete deletion and document compliance
Confirmation: Provide written confirmation to requesting party within 5 business days

Emergency Deletion Procedures

For urgent deletion requests (security breaches, legal orders, FERPA violations):

Immediate Response: Begin deletion within 1 hour of verified request
System-Wide Purge: Delete from production, staging, backups, and logs
Vendor Coordination: Request deletion from sub-processors if applicable
Audit Documentation: Comprehensive audit trail of emergency deletion
Legal Notification: Notify legal counsel and relevant authorities if required

Compliance Framework

Regulatory Compliance

FERPA Compliance

Family Educational Rights and Privacy Act compliance for educational records processing and retention.

• Educational records deleted within 45 days of request
• School official designation maintained
• No redisclosure without consent
• Audit trail for all educational record access

GDPR Compliance

General Data Protection Regulation compliance for EU customers and data subjects.

• Right to erasure (right to be forgotten)
• Data minimization and purpose limitation
• Automated deletion systems
• Cross-border transfer safeguards

State Privacy Laws

Compliance with California CCPA, Virginia CDPA, and other state privacy regulations.

• Consumer deletion rights honored
• Sale of personal information prohibited
• Data processing transparency maintained
• Opt-out mechanisms provided

Tax & Financial Compliance

IRS and state tax authority requirements for business record retention and audit support.

• 7-year retention for tax records
• Audit trail preservation
• Financial transaction documentation
• Revenue recognition support data

Data Subject Rights

Individual Privacy Rights

Under various privacy laws, individuals have rights regarding their personal data processed by ThinkKits:

Right to Access: Request copies of personal data we process
Right to Rectification: Request correction of inaccurate personal data
Right to Erasure: Request deletion of personal data under certain conditions
Right to Portability: Request personal data in machine-readable format
Right to Restrict Processing: Request limitation of data processing activities
Right to Object: Object to processing based on legitimate interests

Educational Records Rights (FERPA)

For educational records processed under FERPA, additional rights apply:

Right to Inspect: Parents/eligible students may inspect educational records
Right to Amend: Request correction of inaccurate educational records
Right to Control Disclosure: Control disclosure of educational records to third parties
Right to Deletion: Schools may request deletion of educational records at any time

Automated Deletion Systems

System Architecture

ThinkKits employs automated systems to ensure consistent and reliable data deletion according to our retention schedule:

Daily Cleanup Jobs

Schedule: Daily at 2:00 AM UTC
Function: Identify and delete data exceeding retention periods
Audit: Complete audit log of all deletions with timestamps and data counts

Weekly Archive Jobs

Schedule: Weekly on Sundays at 1:00 AM UTC
Function: Move aging data to archive storage before deletion
Verification: Data integrity checks and successful archive validation

Monthly Compliance Reports

Schedule: First Monday of each month
Function: Generate comprehensive compliance reports for internal review
Distribution: Legal, Compliance, and Executive teams

Data Deletion Verification

All automated deletions include verification steps to ensure complete removal:

Primary Database: Data removed from production PostgreSQL and Neo4j instances
Search Indexes: Data purged from Pinecone vector databases and search indexes
Backup Systems: Data removed from all backup and archival systems
Log Files: Related log entries purged or anonymized as appropriate
Sub-Processors: Deletion requests sent to relevant sub-processors

International Data Considerations

Cross-Border Data Transfers

ThinkKits processes data primarily within the United States, with limited international data transfers:

Data Location	Sub-Processors	Data Types	Legal Basis	Retention Impact
United States	Railway, Neo4j, Pinecone, Stripe, Clerk, most others	All primary platform data	Domestic processing	Standard retention schedule applies
European Union	UptimeRobot (monitoring)	Website monitoring data only	Standard Contractual Clauses	GDPR deletion rights apply
Canada	Shopify (e-commerce)	Order and shipping information	PIPEDA compliance	Canadian privacy law requirements

International Deletion Coordination

For data deletion requests affecting international sub-processors:

Coordinated Deletion: Simultaneous deletion requests sent to all relevant sub-processors
Verification Requirements: Confirmation of deletion from international processors
Documentation: Audit trail of international deletion compliance
Timeline: Account for longer processing times due to international coordination

Data Deletion Requests

Need to request deletion of your organization's data or have questions about our retention policies?

Request Data Deletion Contact Privacy Team

Last Updated: February 2026 | Next Review: May 24, 2026 | Questions about this schedule?