Data retention and account removal — owner review required

Active profiles, content, learning records and messages remain while needed for the account. Account removal revokes login, anonymizes profile and authored text, closes the creator space, cancels bookings and queues current uploads for physical removal. Other people’s contributions are preserved behind the closed space and remain available through their own export. Opaque identifiers remain to preserve relationships. Notifications and analytics expire after 90 days. Completed job payloads are cleared after seven days; failed or blocked jobs expire after 30 days and must be requested again. Audit history is retained for 365 days. Consent history remains while consent is active and for at least 365 days from the recorded event. Closed safety cases, appeals and ordinary requests are retained for 365 days after resolution; unresolved cases await human review. Erasure receipts and opaque tombstones remain to prevent backup resurrection. Encrypted backup copies and object versions require an operator-managed 30-day expiry policy; restoring them requires replay of the latest independent erasure ledger before traffic or email resumes. These operational defaults require owner review, provider configuration and completion of the privacy notice before public launch.