Legal
Data Retention Policy
This page states how long each category of data lives in Peerfold, in concrete terms. Where retention is bounded by the life of a workspace, deletion of the workspace removes the data (see “Deletion” below).
Short-lived security artifacts
| Artifact | Lifetime |
|---|---|
| Learner sign-in codes | 10 minutes, single use |
| Password-reset links (admins) | 60 minutes, single use |
| Learner sessions | 30 days |
| Embedded-player sessions | 8 hours |
| Support-impersonation sessions | 30 minutes, admin-granted, audit-logged |
| OAuth authorization codes (AI assistants) | Minutes, single use; refresh tokens rotate on every use and die when the grant is revoked |
Each lifetime above is when the artifact stops working. A daily sweep then deletes the expired rows themselves, so an expired code, session or grant does not sit in the database indefinitely.
Learning records
| Category | Retention |
|---|---|
| Learner profiles, enrollments, progress, attempts, credits | Life of the workspace, or until the customer erases the learner |
| Issued certificates | Immutable once issued (rendered artifacts are never re-written). On learner erasure the name is redacted; the serial number and public verification survive as the record of issuance |
| Assistant transcripts | Append-only, life of the workspace; erased with the learner |
| Course content and published revisions | Life of the workspace. Published revisions are immutable by design — learners always read a fixed revision |
| Uploaded media (images, files, video) | Life of the workspace, in Cloudflare R2/Stream |
| Commerce orders | Life of the workspace; the financial system of record is Stripe, which retains transaction records per its own legal obligations |
Operational records
| Category | Retention |
|---|---|
| Audit logs | Life of the workspace. On learner erasure the actor becomes an opaque token — the log’s integrity survives, the identity does not |
| CRM sync queue | Delivery rows are kept for the sync-health screen (retry and audit visibility); they carry references and payload snapshots, and go with the workspace |
| Outbound webhook delivery records | Kept for delivery debugging; go with the workspace |
| Inbound CRM webhook receipts | 30 days. We store the signed deliveries a connected CRM sends us, so a portal that starts sending something unexpected can be diagnosed; they carry a record id and nothing else |
| Email sends | We store the send event; message handling at the provider follows Resend’s retention |
Backups
The database runs on Neon with point-in-time recovery. Deleted data leaves the recovery window as it expires — deletion is complete within that window, and backups are never used to resurrect erased records.
Deletion
- Workspace deletion removes the workspace’s learners, content, media, logs and queue rows — storage is keyed to the workspace, so deletion cascades structurally.
- Learner erasure hard-deletes where the record can go, and anonymizes where the record must survive (certificates, audit logs, aggregate analytics — which are learner-blind already). A suppression marker prevents a connected CRM sync from re-creating the learner afterwards.
- CRM copies written into the customer’s own HubSpot, Day.ai or Salesforce are under the customer’s control; the erasure report tells the customer exactly which records those systems hold so they can be handled there.
Requests
Retention or deletion requests: privacy@peerfold.com. See also the Privacy Policy and the Data Processing Addendum.
Questions? Write to hello@peerfold.com and a person will answer.
Contact us