Data Retention and Deletion Policy

We keep data only as long as it is needed to provide Beadbar, then delete it. A job runs every day to carry out the scheduled deletions below. If it fails, we are alerted and fix it.

Data	Why we keep it	When it is deleted
A child’s details, lesson records, skills checklist ticks, weekly plans, notes, and family reports with each finalized version	So guides can plan and track progress	At once when the school deletes the child, or with the school
Lesson marks that staff removed	So a mistaken removal can be undone	Kept archived and restorable for 2 years after removal, then deleted. Deleted at once with the child or the school
All of a school’s or family account’s data, except sales-tax exemption certificates (below)	To provide Beadbar to the school or family	30 days after a head of school asks to delete the school (the school can download its data, and cancel the request, until then), or when the period the school sets after its contract ends runs out (0 to 60 days; 60 unless the school chooses less). The contract ends the day the paid plan ends
Staff membership, classroom assignments, training progress, and presentation sign-offs	So each person sees the right classrooms and can be trained	When the person leaves the school, or with the school. Records a staff member made stay with the child
Your account: name, email address, state, favorites, Google sign-in details	To sign you in	At once when you delete your account
An account with no school that nobody has signed in to for about 2 years	No longer needed	We email a warning after about 23 months without a sign-in, then delete it 30 days later if nobody signs in
Sign-in sessions (IP address, browser)	To keep you signed in	When the session ends, at most 30 days after your last visit, or when you sign out
Sign-in codes	To sign you in	Stop working after 10 minutes; deleted by the next daily job
Two-step sign-in: passkeys and backup codes (unreadable form)	To check your second step at sign-in	When you remove a passkey, turn two-step off, or delete your account. A setup that was started but not finished is deleted after a day
Record of who opened or downloaded children’s records and reports (who, which child, what, when; no content)	So a head of school can see who looked at a child’s records	After 1 year, or with the school. Deleting a child leaves only an ID number in older entries, never a name
Counts of recent sign-in attempts and invites sent (by IP address, email address, or account, stored as scrambled codes)	To block repeated attempts and unwanted email	After 1 day
Family access (a family member’s link to a child)	So the family can see the child’s progress	When the school removes it, the family member leaves, or the child or school is deleted
Family invites (email address, child)	So a family member can join	Links stop working after 14 days; the invite record is deleted 30 days after that, used or not
Staff invites (email address, role, classrooms)	So staff can join	Links stop working after 14 days; the invite record is deleted 30 days after that, used or not
Change log entries	So a school can see who changed a record	With the school
The plan, its status, and Stripe’s account numbers for a paid plan	To know what the school or family has paid for	With the school or family account. Stripe keeps its own payment records (billing name, email, address, invoices) as tax and financial laws require
A school’s sales-tax exemption certificates: the organization’s name and address, reason for exemption, state, exemption ID number, and the signer’s name and title	Tax law requires us, as the seller, to keep them to show why we charged no sales tax	While the certificate is in effect. After the school revokes it, or the school is deleted, kept 5 years, then deleted. This is the one school record kept after a school is deleted; nobody at the school can see it then
Charter plan waitlist: name, email address, and school name	To tell you when the Charter School plan opens	2 years after you last joined the waitlist, or sooner if you ask
Records of which documents a person accepted	To show what was agreed	While the account exists. After the account is deleted, until 3 years after the acceptance. A school’s acceptance of the School Data Agreement is deleted with the school
Emails we sent	Our email service keeps them for troubleshooting	Within 45 days
The copy the Record screen keeps on a staff member’s device	So recording works without a connection	When they sign out on that device, or, if their session ended another way or they deleted their account, the next time that device opens Beadbar online
Backups	To recover from mistakes or failures	Deleted data is gone from backups within 7 days
Deletion records (what was deleted, when, at whose request, and how many records; no names or content)	To confirm a deletion when asked	Kept while we operate Beadbar

If the law requires us to keep something longer, such as under a court order, we keep only that data, only as long as required, and tell the school unless the law forbids it.

Asking for deletion

Staff whose role allows it delete a child in Beadbar, and a head of school deletes the school. Anyone can delete their own account from Your account. A school’s only head of school must first make someone else head, or delete the school. Parents ask their child’s school. You can also write to privacy@aprative.com. When asked, we confirm a deletion in writing.

Change log

Version	Date	Change
1.0	2026-09-25	First version for the pilot.
1.1	2026-09-26	Added paid-plan billing records.
1.2	2026-09-27	Added sales-tax exemption certificates, kept 5 years after they end, including after the school is deleted.
1.3	2026-09-27	Added skills checklist ticks.
1.4	2026-09-27	Finalized versions of family reports are kept with the report and deleted with it.
1.5	2026-09-28	Sign-in and invite limit counters also count by email address and account.
1.6	2026-09-30	Added two-step sign-in details and the record of who opened or downloaded children’s records.
1.7	2026-10-03	A school is deleted 30 days after a head of school asks (was 7); the contract ends the day the paid plan ends; the charter plan waitlist; when the Record screen’s copy on a device is cleared.