CommonGage Data Retention and Deletion Policy
Last updated: 2026-06-29
Principles
CommonGage retains data only as long as needed to provide the service. When a district's contract ends, or upon a verified deletion request, CommonGage will delete the district's data promptly and completely.
Retention Periods by Data Type
| Data Type | Retention Period | Basis |
|---|---|---|
| Active tenant data (events, deliverables, users, schools, zones) | Duration of active contract | Service delivery |
| Expired invite tokens | 30 days after expiry | Audit trail |
| Used invite tokens | 90 days after use | Audit trail |
| Cloudflare Worker logs | 7 days (Cloudflare platform default) | Operational debugging |
| Neon query logs | 7 days (Neon platform default) | Operational debugging |
Contract Termination and Offboarding
When a district's contract ends:
- Grace period: Data is retained for 30 days after contract end to allow the district to export any needed records.
- Export window: Upon request during the grace period, CommonGage will provide a data export in CSV or JSON format covering events, deliverables, and school/zone structure.
- Deletion: At the end of the grace period (or sooner upon district request), CommonGage will delete all data associated with that tenant from the production database.
- Confirmation: CommonGage will provide written confirmation of deletion within 10 business days of the deletion being completed.
- Backups: Any database backups containing the district's data will be purged or overwritten within 30 days of the deletion date, in accordance with Neon's backup retention policy.
Data Deletion Requests (In-Contract)
Districts may request deletion of specific data types during an active contract (e.g., removing a staff user's account, deleting a specific event). CommonGage will honor such requests within 5 business days. Bulk deletion of a district's entire dataset during an active contract will be treated as an offboarding request (see above).
Student Data
CommonGage does not store student education records. If a district identifies that student PII has been inadvertently transmitted to CommonGage (e.g., via an iCal feed with student-identifiable event descriptions), CommonGage will work with the district to identify and delete the affected records within 72 hours of the request.
Staff Account Deletion
When a staff member leaves a district and an admin removes their account:
- The user record is deleted from the
userstable immediately. - Any data the user created (events, flags, engagement support records) remains associated with the district tenant and is not deleted, as it represents the district's operational record.
Subprocessor Retention
Data shared with subprocessors for service delivery (Anthropic for classification, Neon for storage) is subject to each subprocessor's own data processing terms:
- Neon: Data is retained in accordance with the Neon Data Processing Agreement. Point-in-time recovery backups are retained for up to 30 days.
- Anthropic: Event data sent for classification is not retained by Anthropic for training purposes under the API terms. Each request is stateless.
Policy Review
This policy is reviewed annually or when a material change to the data model or subprocessor list occurs.