Effective Date: 1/8/2026
Last Updated: 5/9/2026

1. Purpose

This Policy explains how SchoolFlow retains and deletes information associated with the platform.

SchoolFlow seeks to retain information only for as long as reasonably necessary for the purposes for which it was collected, contractual requirements, legal obligations, legitimate business requirements and security purposes.

2. Categories of Information

Information potentially subject to retention includes:

• Account information;
• School information;
• Student information;
• Teacher and staff information;
• Academic records;
• Financial records;
• Payment information;
• System logs;
• Security records;
• Support communications;
• Billing records; and
• Backup copies.

3. Customer-Controlled School Data

For customer-provided school data, the school/customer generally determines the purposes for which the data is processed.

SchoolFlow processes such information in accordance with the customer's instructions and applicable data-protection requirements.

4. Retention Period

The actual retention period may depend upon:

• The customer's subscription status;
• Legal obligations;
• Financial and accounting requirements;
• Security requirements;
• Dispute resolution;
• Fraud prevention;
• Backup cycles; and
• The customer's instructions.

Retention period shall be 6 months on any of the above cases.

5. Account Closure

Following cancellation or termination, customers should be given an appropriate opportunity to export their data, subject to the customer's subscription and contractual terms.

After the applicable retention period, SchoolFlow may permanently delete customer data.

6. Backups

Deleted information may continue to exist temporarily in backup systems until those backups are overwritten or securely deleted according to SchoolFlow's backup lifecycle.

Backup retention period: 30 days

7. Legal Retention

SchoolFlow may retain certain information beyond ordinary deletion periods where necessary to:

• Comply with legal obligations;
• Establish or defend legal claims;
• Prevent fraud;
• Resolve disputes;
• Maintain financial records; or
• Protect the security and integrity of the platform.

8. Secure Deletion

Where information is no longer required, SchoolFlow will take reasonable measures to securely delete or anonymise it.

9. Customer Responsibility

Customers are responsible for maintaining appropriate copies of information they are legally required to retain.

SchoolFlow should not be treated as the customer's sole archival system unless expressly agreed in writing.