Veyay retention, deletion, export, and oral-recording schedule
Version: 2026-10-14.3 Status: Candidate schedule for adult accounts, adult-run classes, parent-managed learners and personal-study uploads. Each lane opens only on its own approval. Automatic year-end scheduling for dependent learning is not active.
Every child-data row below is subject to the purpose-limited child-retention rule in the Privacy Notice; account status alone is not a retention justification.
| Category | Active-system behavior | Export | End condition / survivor |
|---|---|---|---|
| Account and role presentation | Kept while account is active | Account profile | Deleted with account, subject to identity/security survivors |
| Independent-adult saved reading | Kept while the account is active unless the adult deletes the account or Cabildo applies a shorter disclosed schedule | Owner-scoped structured saved-reading sessions and complete reader/tutor transcript records | Deleted with the account, subject to the provider, backup, security, and legal-hold survivors below |
| Parent consent and verification | The exact notice version, action, relationship, time and paid-seat verification, kept while the learner account exists | Included in the parent's export | Kept as history, not rewritten, when a seat ends, is refunded or agreement is withdrawn, for as long as the learner's account exists. Deleted with the learner's account, including when Veyay deletes that account under the purpose-limited child-retention rule in the Privacy Notice, and also when the parent's account is deleted. What remains is the parent's own payment-verification record (household, payment reference and time), which names no child |
| Parent-managed learner account | Household link, name and date of birth the parent gives, provisioning record, sign-in block, seat window | Included in the parent's export | Deleted when Cabildo completes a verified parent-requested deletion, or, once the parent deletion control is active for the family lane, when the parent deletes the learner: a recoverable deletion is held for 30 days, during which the learner cannot sign in or use Veyay, and then removed; a permanent deletion, which requires a recent sign-in, is removed at once. The control is not available yet; subject to the survivors below |
| Class and membership | Kept while the class runs (adult-run classes and family learning rooms; school lanes are not covered) | Membership history | Active access ends when the membership, class or grant ends |
| Co-educator access and invites | A co-educator's access is kept while they teach the class; invitations are stored as a one-use code fingerprint and kept as a record after use or revocation | Not a learner export item | Access ends when a co-educator is removed or stops teaching; the invitation record has no learner content |
| Post-class vault (closed until activated) | A learner's own written work and reflections from a class not run by a school, with the class title and dates, copied no earlier than 14 days after the class ends for them; for a child, only on a parent's acceptance of a Terms version carrying the post-class vault section, made before the class ended | The vault's own download (up to 10 in 24 hours), by the owner and, until a child turns 18, by the linked parent | Deleted 12 months after the later of the owner's last sign-in and the last class added, after a notice attempt about 30 days before; deleted with the account; a class or the whole vault may be deleted by the owner (for a child under 13, by the parent; from 13, only by the child), and deleted work is not copied back; limited backup and legal records survive as the Privacy Notice describes |
| Assignment transcript | Retained only where the account/context retention resolver permits | Structured JSON/HTML or other documented format | Follows the class's lifecycle; dependent records follow the year-end rule below once it is operational |
| Observable reasoning events | Assignment/session-scoped rows linked to source events | Separate from grades | Deleted with governing learning record; never promoted to a durable ability profile |
| Teacher-entered grades | Stored as educator-authored record | Labeled teacher-entered | Follows the assigned record/agreement |
| Ordinary voice input | Transcribed, then source audio discarded | Transcript only | Audio has no product retention period because it is discarded |
| Oral-assessment audio | Retained only for a teacher-configured oral assessment. This row describes a closed or separately activated school feature; it does not authorize retained audio in the family lanes this version covers | Included while retained | Deleted when class is archived; transcript and grading record follow their schedule |
| Study-shelf material (personal-study upload) | Extracted text only; the uploaded file is never kept. Kept until the owner or managing parent deletes it or the account is deleted | Included in the owner's or parent's export with its rights record | Deleted on request, with the account, or when an upheld complaint removes it |
| Rights record for an upload | Kept with the material and not edited | Included with the material | Deleted with the material; a complaint case that names the material keeps its own record of the outcome |
| Class material added by a teacher | Kept while authorized and needed for the class | Rights-dependent | Removed on takedown, deletion or class end, or by the teacher when a license ends; citations may survive where lawful |
| Copyright complaint case | Complaint, outcome, strike if upheld | On verified request where lawful | Kept as the record of the complaint and outcome after the material is gone; strikes count for 365 days |
| Support case | Bounded issue metadata; saved-reading text excluded by default | On verified request where applicable | Close when resolved, then delete from the working mailbox within 90 days; provider transport copies may persist under the provider schedule. This is a manual policy enforced through the staffed operations gate. |
| Billing transaction | Seat purchase, renewal, refund, dispute and fulfillment references | Receipt/invoice | The minimum accounting record is kept for at least 7 years after the transaction, and longer for a recorded dispute or legal hold; account content is not part of that survivor. |
| Security/audit record | Event, actor/pseudonymous identifier, purpose, time | Limited by security and legal basis | The account service applies a 24-month ordinary ceiling, with shorter operational logs where possible; a scoped incident or legal hold may extend identified records. The operations gate must prove the ceiling's current enforcement before accounts activate. |
| Generated export/cache | The current owner-scoped source path returns structured data directly | The user-created download | No durable Veyay export cache is established. If a temporary server artifact is later introduced, it must be removed within 24 hours. |
| Provider monitoring copy | Controlled by provider contract and account settings | Not a Cabildo export store | Azure inference is stateless at the model. Automated abuse review does not store prompts; flagged content may be stored for authorized human review under Microsoft's policy, which states no public fixed maximum. Mistral is not an authorized demo fallback. No zero-retention claim applies. |
| Database backups | Supabase daily database backup for the connected Pro organization | Not a user-facing export source | Supabase exposes the last 7 days of Pro daily database backups. Database backups contain storage metadata, not Storage objects. A deleted database row may therefore remain recoverable for at most that rolling window; any restore during it must reapply recorded deletions before user access reopens. That restore/readback exercise is required before a retained-account lane opens. |
| Storage objects | Supabase Storage; separate from database backup contents | Owner-scoped ZIP where a later lane permits | Deletion removes the object through the Storage API before parent rows. Supabase's database restore does not restore a deleted Storage object. Recipient downloads remain outside Cabildo's remote control. |
Deletion behavior
Deletion must remove or sever every active Veyay record reachable from the verified subject, including retained oral audio. It must not silently destroy purchase/audit provenance that law or security requires Cabildo to retain. A surviving record must no longer identify the deleted learner beyond its published and documented basis. Legal holds are exceptional, scoped, recorded, and released. Deleting an active Veyay record does not cause Cabildo to delete a provider's independent abuse-monitoring or human-review copy unless the applicable provider contract and control permit that deletion.
Class archive, learner departure, guardian withdrawal, and contract end each revoke the authority tied to that relationship. They do not automatically mean the same thing as account deletion. The product must state which event is occurring.
For the public demonstration, closing the tab or clearing site data removes the browser copy; Cabildo does not create an account or saved-reading row. For an activated independent-adult account, saved reading remains until account deletion or a shorter disclosed schedule. Ordinary delivery metadata, rolling database backups, downloaded exports, and any Microsoft abuse-monitoring copy follow the separate criteria above.
Year-end rule
The intended dependent-learning default is year-end deletion with parent-only carry-forward. The resolver and deletion machinery exist, but automatic scheduling is not operational today. No public or institutional text may promise automatic year-end deletion until a real scheduled run and readback are recorded for the applicable calendar.
Recording disclosure
Before recording, show whether the feature is transcription-only or a retained oral assessment, who can play the audio, why it is kept, and when it is deleted. Consent to a class or to text processing is not silently reused as consent to retain voice. Recording-law questions remain in the jurisdiction tracker.
Retained oral assessment is not available in the public demonstration or the independent-adult account service. It may not open until the participant state is recorded, the applicable recording rule is dispositioned, and a separate recording choice and deletion test pass.