Data Retention Policy
Retention and deletion principles for accounts, results, payments and audit records.
Principles
STONECODE should retain information only for as long as needed for the documented purpose, legal obligations, security investigations, dispute resolution or an approved school instruction. Retention periods must be configured by record type rather than applied indiscriminately.
Suggested categories
Student records should follow the school’s approved academic and legal retention schedule. Payment and tax records should follow applicable financial requirements. Security and audit records should be access-controlled and retained only for the approved investigation and accountability period.
Deletion and school exit
At the end of a school relationship, records should be returned, exported or securely deleted according to the signed agreement, legal holds and the approved schedule. Backups must expire through a documented lifecycle rather than being silently retained forever.