This page explains what we keep and for how long, in plain terms. The internal procedure behind it is written and dated; it is not published because it contains operational detail. Deletion of assessment answers, Passports and register records is a manual procedure carried out by the operator; nothing on this page promises an automatic purge of them. The only automatic removals are three short-lived items of the notification service, each marked in its own row below: the notification contact address, the record of notifications sent, and the address an invitation was sent to.
The assessment: what we keep, and for how long
| Data | Kept for | Then |
|---|---|---|
| Your submitted answers | While the Passport they support is valid: 12 months from issue | Deleted by hand at the next quarterly review after they fall due |
| Drafts you never submit | 90 days from the last save | Deleted by hand at the next quarterly review after day 90 |
| Your engagement code record | The life of the engagement and 12 months after the Passport's validity ends | Deleted |
| Routine engagement correspondence, including your contact's name and work email address (in our mailbox only) | No more than 12 months after the engagement closes | Deleted by hand at the quarterly review on or before that date |
| Contractual records, and correspondence relating to a documented legal claim | As long as that is justified, up to 6 years, subject to legal requirements | Deleted |
| Your Decision Passport | Its 12-month validity period | Kept as an archived record so that historic verification still works. It contains no personal data. A Passport withdrawn after release stays on the record, and the verification page shows it as withdrawn. |
| Statistics without identifiers (per check: the result, the region and the school phase only — no school name, code or submission reference) | Indefinitely | — While only a few schools are assessed, region and phase together could single a school out, so we do not analyse these statistics until the numbers make that impossible |
| Your IP address for rate limiting | 10 minutes | Gone |
| Hosting providers' request logs (include IP addresses) | Fly.io: 7 days. Vercel (verification page and website), runtime logs: one day (our Pro plan's retention) | Deleted by the provider |
| Delivery logs of the register's sign-in and notification emails, held by our email delivery provider (Brevo) | One month (the setting of our Brevo account). Brevo does not keep a copy of the emails' content | Deleted by the provider |
| Database backups held by our database provider (Supabase, Pro plan) | Daily backups, each kept for 7 days | A record deleted or redacted in the live database still exists in the backups taken before, until they rotate out; we restore from a backup only to recover the service |
The register: what we keep for a school or trust
These records exist once an organisation is set up on the signed-in register. They are the organisation's own governance record, kept for it under the data processing agreement; none of them is removed by an automatic process.
| Record | What it holds | Kept for | How it ends |
|---|---|---|---|
| Register entries (each AI tool and intended use) | Tool, intended use, who uses it, two yes/no/not-sure answers, responsible role, dates | The life of the organisation's contract | Archived (not deleted) by the organisation when a use ends, so its history stays readable; deleted by hand at the end of the contract under the DPA, or on instruction |
| Assessment attempts | Which engagement code started each attempt and in what order; the result is read from the assessment records above | With the entry they belong to | With the entry |
| Decisions | The decision, the role that recorded it, the date, an optional note, the Passport reference | With the entry; never overwritten — a later decision is a new record | With the entry |
| Actions and their history | What needs doing, the owning role, the due date, open/completed/cancelled, the closing note, and every change of owner or date with its date | With the entry; never overwritten | With the entry |
| Review obligations | The next review date set with a decision (or brought forward by a reported change), and when it was started and completed | With the entry; never overwritten | With the entry |
| Reported changes | Which facts about a tool changed (who uses it, pupil-facing, personal data, the responsible role, whether the use changed — never the text), what else was reported, and what the rules concluded | With the entry; never overwritten | With the entry |
| Memberships | The account identifier our authentication provider issues (not an email address, not a name), the organisation, the role, when it was created, and if removed, when | While the person has access, then as a revoked record for the life of the contract so the organisation can see who held access and when | Deleted by hand at the end of the contract under the DPA |
| Acceptance of the terms on joining | Which document versions the person accepted, and when | With the membership | With the membership |
| Invitations | The organisation, the role, a hash of the link (never the link), the address it was sent to and a hash of that address, when it expires, when it was accepted or cancelled | The address: until the invitation is accepted, cancelled or expires (7 days), then removed automatically, the hash staying; the rest: as a record of who was invited to what | Deleted by hand at the end of the contract |
| Notification contact address | The email address a person signed in with, as our sign-in provider confirmed it — used only for the service's governance emails | While the person belongs to an organisation or has an invitation waiting | Deleted automatically when they no longer do, and at the end of the contract |
| Record of notifications sent | Which notification, about which record, to which account identifier, when, and whether it was delivered — never the email's content | 90 days | Deleted automatically |
| Sign-in account (held by our authentication provider) | The person's email address and sign-in history | While the organisation keeps the person's access | Deleted by hand at the provider on removal or at the end of the contract |
| Redaction records | Which record and which field were redacted, when, for what reason and by which route — never the text that was removed | With the record they refer to | With that record |
| Governance summary downloads | Produced on request from the records above; nothing extra is stored | — | — |
| Support, access and security correspondence | What you write to us and what we answer | 12 months after the matter closes, or as a contractual record (above) | Deleted by hand at the quarterly review |
How deletion happens today
Deletion of assessment answers and register records is carried out by the operator by hand, under a written procedure, not automatically:
- on a quarterly review, the first in January 2027 (the first answers that reach 12 months fall due in September 2027), and
- on request from your organisation, within 5 working days, and
- at the end of an organisation's contract, under clause 8 of the data processing agreement: return by export, then deletion of the register records and sign-in accounts, confirmed in writing.
Each deletion is done one record at a time, checked afterwards, and confirmed to you in writing with the backup caveat above. A read-only tool lists what is due; only a person deletes.
Pupil data or other personal data entered by mistake
The register and the assessment do not need pupil data and say so where text is typed. If pupil names, pupil records, safeguarding case details, health or SEND information or other special category data are entered by mistake, tell us with the subject PUPIL DATA (see contact). We restrict who can see the record, escalate it internally, ask your organisation what it wants done, delete or correct the record as instructed, and record what was done. The same procedure applies to personal data typed into a free-text assessment answer.
Text in a free-text field is removed by a governed redaction that only our operator can carry out. The text is replaced with a fixed marker; nothing else in the record changes, and a decision or an action's history, which nobody can edit in the service, keeps its date, its role and its place in the history. We record which record and field were redacted, when, why and by which route, but never the text itself, and a redaction cannot be undone. The text leaves the live database at once; copies in our database provider's backups expire as those backups rotate (7 days). Where the text has reached a public Decision Passport, the Passport cannot be edited in place: it is withdrawn and the tool reassessed.
Asking for deletion, a copy, or withdrawal
- Delete my school's answers: email contact@viccaone.com with your engagement reference. Done within 5 working days and confirmed in writing.
- Give me a copy first: we export your answers as a JSON file on request before deleting; a trust or school administrator can download the register's governance summary at any time, and the full register is exported on request at the end of the contract.
- Withdraw my school's Passport: we record the withdrawal by hand within 5 working days and confirm it in writing. From then on the result is no longer shown as the school's current Passport in the register or on the assessment page. A Passport that had been released is shown as withdrawn on the public verification page; one that had not been released never becomes public. We check what the verification page shows and tell you.
- Remove personal data typed into a free-text answer or note: tell us which record and which field, without repeating the text; we redact it as described above and confirm in writing, with the backup caveat.
What we never delete by this procedure
Decision Passports. A Passport is the attestation record and contains institutional information only; it is kept so that anyone who was given a verification link can still check it.
Version history: 0.1 (11 October 2026) retention schedule prepared; 0.2 (12 October 2026) public page prepared from the schedule and the dated manual procedure; 0.3 (26 October 2026) the register's record classes, end-of-contract deletion, the pupil-data procedure and the withdrawal check added. 0.4 (1 November 2026) — Vercel's one-day logs and Supabase's 7-day backups stated (Pro plans); Brevo's sign-in email logs added (setting to be confirmed); the statistics claim qualified; the redaction of mistaken free text, its record and its backup caveat; Passport withdrawal for public fields. 1.0 (3 November 2026) — in force: the six-year and archive positions stated as our policy; what the verification page shows for a withdrawn Passport; Brevo's log period to be stated before the first sign-in email is sent. 1.1 (4 November 2026) — Brevo's sign-in email delivery logs: one month, no copy of the content kept. 1.2 (4 November 2026) — governance notification records, the notification contact address, reported changes and the address an invitation is sent to.