Retention Policy

1. Principles

We retain personal data for a stated period where one has been approved, or otherwise for no longer than needed for the service, account, security, dispute or legal obligation. We review necessity and minimize access while data remains retained.

2. Accounts and events

• Account and profile data remains while the account is active and during deletion processing, then only as needed for legal, fraud-prevention or dispute records.
• Published events remain until the organizer removes or archives them, a lifecycle rule applies, or moderation requires action. Related historical transaction and admission records may be preserved separately.
• Authentication, invitation and permission records remain as needed to secure accounts, investigate abuse and demonstrate access decisions.

3. Plans, orders and admissions

Subscription, checkout, order, refund, coupon and admission records remain for fulfilment, reconciliation, chargebacks, safety, accounting, tax and legal claims. The applicable statutory period depends on the record and obligation; account or plan closure does not automatically erase it.

4. Analytics and diagnostics

Event engagement and operational analytics remain while useful for organizers, service measurement, security and dispute handling. We may aggregate or de-identify data when individual detail is no longer needed.

Google currently publishes product-specific Firebase periods: Crashlytics begins deletion from live and backup systems after 90 days; Performance Monitoring keeps IP-associated events for 30 days and installation-associated or de-identified data for 60 days; Remote Config keeps a Firebase installation identifier until a deletion request and may take up to 180 days to remove it. These are provider periods, not a promise that all iErasmus telemetry is deleted on those dates. Google Analytics retention depends on account configuration and has not yet been verified for this service. The operator's own operational schedule must be confirmed before final publication.

5. Contributions and optional protected documents

Agreement contributions remain while they are reviewed and, if accepted, while their source and provenance are needed. Rejected, duplicate or withdrawn material is removed when no security, rights or legal hold requires it.

If the protected student-card feature is enabled, card images, review evidence and device-security records follow the retention disclosed in that flow. Until an approved operational schedule is shown there, no shorter automatic deletion period should be assumed.

6. Backups and legal holds

Deleted data may remain temporarily in restricted backups until normal overwrite. A dispute, fraud investigation, payment issue or lawful request may require a targeted legal hold. Access remains limited and the hold ends when its purpose ends.

7. Deletion requests

Use in-app account deletion where available or contact privacy@ierasmus.app. We will delete or de-identify data unless a lawful reason requires specific records to remain, and will explain applicable limits when responding.