Data Retention Schedule
How long LeraLink keeps each kind of data, what happens to it afterwards, and who decides.
Last updated: 12 November 2026
How to read this schedule
Where a row says that data is deleted, the platform deletes it automatically. A daily scheduled job removes sign-in and security records whose period has ended. Other scheduled jobs, which run every few minutes, delete expired data packages, carry out account deletions that have come due and remove Conversation Room messages whose term has ended. Periods for data held by Cloudflare or Resend are set by them, as stated in each row. Apart from the platform's record of outgoing email, for which no period has been set yet, two kinds of data are never removed automatically: the knowledge authors publish, and records held under legal hold.
"Who controls it" names the controller under the GDPR:
- SSStudio: SSStudio, trading as LeraLink, for the platform, accounts, security and its own business records.
- Installation: the organisation or person running the installation, for its members, content and communications. SSStudio processes this data on its behalf under the Data Processing Agreement.
Where a period is set by SSStudio for security reasons but the data belongs to an installation's members, both are named.
Schedule
Sign-in and security
| Item | What it is | Kept for | What happens then | Who controls it |
|---|---|---|---|---|
| Sign-in codes | The one-time code sent by email to sign in. A code works once and expires after 10 minutes. | 1 day | Deleted | SSStudio |
| Passkey challenges | The single-use challenge used during a passkey sign-in. It is valid for five minutes, and only its hash is stored. | 1 day | Deleted | SSStudio |
| Passkey enrollment links | A single-use link that lets an administrator add a first passkey. | 30 days after use, revocation or expiry | Deleted | SSStudio |
| Revoked passkeys | The public part of a passkey an administrator has removed. | 90 days after revocation | Deleted | SSStudio |
| Active sessions | A signed-in session. The server stores only a hash of the token, and IP address and browser description only as keyed hashes. | Until sign-out or expiry (see Signing In and Account Security for the limits) | Becomes an ended session | SSStudio |
| Ended sessions | A session that was signed out, revoked or expired. | 30 days after it was signed out or revoked; for a session that lapsed, 30 days after its latest possible end | Deleted | SSStudio |
| Rate-limit counters | Counters that limit repeated attempts, keyed to a hash of an IP address, an email address or a mailbox, or to an account. | 7 days after the counter's window ends | Deleted | SSStudio |
| Bans and blocked addresses | A ban placed on an account or address to stop abuse, with what it changed so that it can be undone exactly. | Until the ban is lifted. If a banned account is erased, the ban keeps only a hash of the address | Removed when lifted | SSStudio for platform bans; Installation for its own |
Accounts and memberships
| Item | What it is | Kept for | What happens then | Who controls it |
|---|---|---|---|---|
| Account | The platform-wide account: email address, name, picture and settings. | Until the person deletes the account | Deleted after a 7-day waiting period, as described in Your Data Rights | SSStudio |
| Membership and profile in an installation | The person's profile, roles, grants, preferences and contact relationship in one installation. | Until the person leaves the installation, is removed, or deletes the account | Profile, preferences, contact relationship, sessions, roles and grants are deleted; the membership itself is kept, marked as removed; the account and other memberships remain | Installation |
| Record of accepted documents | Which version of the Terms of Service and Privacy Statement an account accepted, when and where. | Legal hold (see below) | Kept as evidence, also after the account is deleted | SSStudio |
| Audit record | Who changed people, permissions, ownership, domains or other administrative settings, and when; also sign-in requests and refusals, with a keyed hash of the IP address and of the browser description. Append-only. | Legal hold (see below) | Kept as evidence; after account deletion it keeps the account identifier, not the email address or profile | SSStudio; the installation for acts within its installation |
| Data packages ("Download my data") | The package a person asks for, with the link sent to their inbox. | 7 days | The link stops working and the file is deleted | SSStudio for account packages; Installation for installation packages |
Content
| Item | What it is | Kept for | What happens then | Who controls it |
|---|---|---|---|---|
| Installation content | Pieces, drafts, files, projects, editorial records, comments, newsletters and settings of an installation. | As long as the installation keeps it | Deleted when the installation decides, or at the end of the contract as set out in the Data Export and Exit Policy | Installation |
| Conversation Room messages | Messages and pictures in an installation's Conversation Room. | The term the installation sets for its room | Deleted when the term ends | Installation |
| Published knowledge | Works authors have published, with their credits. | Never removed by an automatic retention job | Removed only by a person with the right to do so. On account deletion it stays under the name it was published with (see below) | Installation |
| Unpublished work of one person alone | Drafts that belong only to the person. | Until the person deletes it or the account | Deleted with the account | Installation |
| AI-written descriptions of concepts and people | Descriptions the knowledge layer computes from published text, marked as machine-made. | As long as the published evidence and the identity exist | Rebuilt or removed with the evidence. When the installation grants a person's request for removal, the text is removed in every language and a mark is left that every automatic process honours | Installation |
| Search index entries | Numerical representations of published text, used for search. Held outside the EU. | As long as the text they represent is published and indexed | Removed within minutes when a Piece is restricted, or when an installation moves to an AI policy that excludes it from the index | SSStudio, on the installation's instructions |
Statistics, communications and business records
| Item | What it is | Kept for | What happens then | Who controls it |
|---|---|---|---|---|
| Anonymous reading statistics | Reading and page-speed events, without cookies and without identifying readers. Held outside the EU. | Up to 3 months | Only totals are kept | SSStudio |
| Outgoing email in the platform | The platform's own record of each message it sends: recipient, content and delivery status. For newsletters it may also record whether a message was opened and which links were followed, to measure reach. | No fixed period has been set yet | Not deleted automatically at present; deletion can be requested at privacy@lera.link | SSStudio; the installation for its own newsletters and notifications |
| Email delivery records at Resend | Records of messages sent through our email provider, Resend. | 30 days, according to Resend's documentation | Deleted by Resend | SSStudio, with Resend as subprocessor |
| Invoices and accounting records | Invoices and the records Dutch tax law requires. | 7 years | Deleted | SSStudio |
Backups and copies
| Item | What it is | Kept for | What happens then | Who controls it |
|---|---|---|---|---|
| Nightly database backups | A checksummed copy of the whole database, stored in the EU. | 30 days | Deleted automatically | SSStudio, on behalf of each installation for its data |
| Point-in-time history | Cloudflare's ability to restore the database to an earlier moment. | 30 days | Falls out of the window | SSStudio |
| Copies from before the EU move | The databases, files and backups as they were stored outside Cloudflare's EU jurisdiction before 3 November 2026. Not written to since. | Until 3 December 2026 | Deleted | SSStudio |
| Copy of LeraLink's own installation on the test environment | A copy of LeraLink's own installation (the Hub), made for testing, with every email address replaced. It holds no other installation's data. | Until it is replaced by the next copy | Replaced | SSStudio |
| Caches | Short-lived copies of configuration and public pages in Cloudflare's network. | Short-lived | Replaced or expire | SSStudio |
Legal hold
Two records are kept under legal hold: the audit record and the record of accepted documents. Legal hold means that no automatic process deletes them, including account deletion.
We keep them because they are evidence: of who had access and who changed it, and of which terms a person agreed to. That evidence protects the people concerned, the installations and SSStudio in a dispute, a security investigation or a request from an authority. The legal basis is SSStudio's legitimate interest, and for some records a legal obligation (GDPR Article 6(1)(c) and (f)).
These records contain as little as possible: identifiers, the act, the time and the context. After an account is deleted, the audit record keeps the account's identifier but not its email address, picture or profile. The records are used only as evidence and for security, never for other purposes.
Deletion requests and retention
When a person asks for their data to be deleted, or deletes their account:
- Data with a short period is deleted at once or within its period.
- Published works and credits stay under the name they were published with. They are part of the public record and of other people's work. What connects that name to a living person goes: email address, picture, public address, biographies, identity keys, reactions, notes, reading history and unpublished work that is theirs alone. Comments stay in their discussion without an author.
- The audit record and the record of accepted documents stay under legal hold, as explained above.
- Backups still hold the deleted data until they expire after 30 days. Backups are not edited.
- Invoices are kept for the 7 years Dutch tax law requires.
- What others already fetched cannot be recalled: a page that was public may be kept in readers' browsers, search engines or archives outside LeraLink's control.
Your Data Rights explains how to make a request.
An installation can delete its own content at any time, and decides how long it keeps its members' data within the limits above. When a customer leaves LeraLink, the Data Export and Exit Policy sets out when its installation's data is deleted.
Changes to this schedule
We announce changes to retention periods under the Change Notification Policy.