peerLegal
Data Retention Policy
Last updated: August 4, 2026
This page states how long each category of data lives in Peerfold, in concrete terms. Where retention is bounded by the life of a workspace, deletion of the workspace removes the data (see “Deletion” below).
Short-lived security artifacts
Artifact | Lifetime |
|---|---|
Learner sign-in codes | 10 minutes, single use |
Password-reset links (admins) | 60 minutes, single use |
Learner sessions | 30 days |
Embedded-player sessions | 8 hours |
Support-impersonation sessions | 30 minutes, admin-granted, audit-logged |
OAuth authorization codes (AI assistants) | Minutes, single use; refresh tokens rotate on every use and die when the grant is revoked |
Each lifetime above is when the artifact stops working. A daily sweep then deletes the expired rows themselves, so an expired code, session or grant does not sit in the database indefinitely.
Learning records
Category | Retention |
|---|---|
Learner profiles, enrollments, progress, attempts, credits | Life of the workspace, or until the customer erases the learner |
Issued certificates | Immutable once issued (rendered artifacts are never re-written). On learner erasure the name is redacted; the serial number and public verification survive as the record of issuance |
Assistant transcripts | Append-only, life of the workspace; erased with the learner |
Course content and published revisions | Life of the workspace. Published revisions are immutable by design, so learners always read a fixed revision |
Uploaded media (images, files, video) | Life of the workspace, in Cloudflare R2/Stream |
Commerce orders | Life of the workspace; the financial system of record is Stripe, which retains transaction records per its own legal obligations |
Operational records
Category | Retention |
|---|---|
Audit logs | Life of the workspace. On learner erasure the actor becomes an opaque token. The log’s integrity survives and the identity does not |
CRM sync queue | Delivery rows are kept for the sync-health screen (retry and audit visibility); they carry references and payload snapshots, and go with the workspace |
Outbound webhook delivery records | Kept for delivery debugging; go with the workspace |
Inbound CRM webhook receipts | 30 days. We store the signed deliveries a connected CRM sends us, so a portal that starts sending something unexpected can be diagnosed; they carry a record id and nothing else |
Email sends | We store the send event; message handling at the provider follows Resend’s retention |
Backups
The database runs on Neon with point-in-time recovery. Deleted data leaves the recovery window as it expires. Deletion is complete within that window, and backups are never used to resurrect erased records.
Deletion
Workspace deletion removes the workspace’s learners, content, media, logs and queue rows. Storage is keyed to the workspace, so deletion cascades structurally.
Learner erasure hard-deletes where the record can go, and anonymizes where the record must survive (certificates, audit logs, aggregate analytics, which are learner-blind already). A suppression marker prevents a connected CRM sync from re-creating the learner afterward.
CRM copies written into the customer’s own HubSpot, Day.ai or Salesforce are under the customer’s control; the erasure report tells the customer exactly which records those systems hold so they can be handled there.
Requests
Retention or deletion requests: privacy@peerfold.com. See also the Privacy Policy and the Data Processing Addendum.
Questions? Write to hello@peerfold.com and a person will answer.