Data Retention Policy

1. Policy Overview

IEPVue is committed to responsible data stewardship and the privacy rights of individuals, particularly children under 13. This Data Retention Policy describes what personal information we collect, how long we retain it, and the procedures we follow to securely delete data when retention periods expire.

This policy is required by the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments, which establish stringent requirements for data minimization, retention limits, and deletion procedures for operators serving children under 13.

All retention periods referenced in this policy are measured from the date data is collected, unless otherwise specified. Deletion timelines apply to both active accounts and accounts that have been cancelled or suspended.

2. Retention Schedule by Data Type

IEPVue retains personal information only for the duration necessary to provide our services and comply with legal obligations. The following schedule details retention periods for each category of data we collect:

3. Deletion Procedures

Automatic Deletion

IEPVue employs automated systems to delete data at the end of each retention period without manual intervention. Automated deletion applies to:

• Chat data (12-month deletion cycle)
• Analytics and usage data (12-month deletion cycle)
• Support tickets (12-month post-closure deletion)
• System logs and audit records (12-month rotation)
• Authentication tokens (24-hour session expiration)

Automated deletion processes run on a recurring schedule and verify successful deletion to ensure no residual data remains.

Account Cancellation & Deletion

When a user cancels their account:

1. Account enters 30-day grace period; user can reactivate without data loss.
2. At end of grace period, account is marked for deletion (soft delete).
3. Account Information is permanently deleted 18 months after cancellation.
4. Student Profiles are permanently deleted 12 months after cancellation, with final purge at 18 months.
5. All associated chat data, analytics, and support records are purged on schedule.

Deletion from Backup Systems

IEPVue maintains backup systems for disaster recovery and business continuity. Deleted data is removed from:

• Production databases (immediate cryptographic deletion)
• Backup snapshots (excluded from new backups within 24 hours)
• Archive storage (purged according to data classification retention schedule)
• Transaction logs (purged when no longer required for audit compliance)

4. Exceptions to Deletion

Legal & Regulatory Requirements

We may retain data longer than specified in this policy if required by law, including:

• Tax Code: Payment and subscription records retained for 7 years per IRS requirements.
• FERPA (Family Educational Rights & Privacy Act): Educational records held longer if required by state law.
• State Laws: Some states require longer retention of certain student data; we comply with the most restrictive requirement.
• Legal Process: Data subject to litigation hold or law enforcement request is retained pending resolution.

De-Identified Data

Data that has been anonymized and de-identified such that it cannot reasonably identify an individual may be retained indefinitely, including:

• Aggregated usage statistics
• De-identified feedback and feature requests
• Anonymized performance metrics and analytics

Ongoing Services

Data necessary to provide active services or fulfill user requests is retained for the duration of the engagement, even if the standard retention period would expire sooner.

5. Data Portability & Export

Parents and guardians have the right to request a copy of their personal information and their child's information before deletion occurs. To request a data export, email [email protected] with "DATA EXPORT REQUEST" in the subject line.

To request a manual export, users may contact us at the address provided in Section 7. We will provide a complete data export within 10 business days of request at no charge.

6. Annual Review & Updates

This Data Retention Policy is reviewed annually to ensure compliance with evolving COPPA requirements, state privacy laws, and industry best practices. We may update retention periods if:

• Legal requirements change
• Our service offerings change
• New security or privacy best practices emerge

Parents and guardians will be notified of material changes to this policy via email and updated notice on our website. The effective date will be updated to reflect any policy changes. Continued use of IEPVue following notification constitutes acceptance of policy updates.

7. Contact Information

For questions about this Data Retention Policy, data deletion requests, export requests, or concerns about our data handling practices, please contact: