Data Retention Policy

What this covers

This is the written retention policy for Arkansas Serve. It sets out how long each kind of record is kept, what triggers deletion, and how information about children is treated. It expands on section 11 of the Privacy Policy and does not replace it; where the two describe the same thing, they say the same thing.

It is published rather than supplied on request because a retention policy that people cannot read is not much use to them, and because the rules that govern children's information online expect an operator's retention practices to be stated openly.

The principle we apply

We keep a record for as long as it is needed for the purpose it was collected for, and no longer. For most of what Arkansas Serve holds, that purpose is durable: a service-hour record exists so that a school, court, or organization can verify service later, sometimes years later, and deleting it early would defeat the reason the platform exists.

Where a record's purpose has ended — an account nobody uses, an organization that has left the platform, an upload supporting a requirement that no longer exists — the record is deleted. Because Arkansas Serve is operated by one person and runs no automated purge, that judgement is made in the review described in section 6 rather than by a timer.

How long we keep each kind of record

"Retention trigger" is the event that starts the clock. Where the trigger has not happened, the record is kept.

Record	Retention trigger	Kept for
In-app notifications	Creation	30 days, then deleted automatically
Account and profile (name, email, date of birth, phone, school, and the optional home ZIP code)	Account closure, or the annual review finding no memberships and no activity	Until deletion is requested, or the review deletes it
Membership in an organization you joined yourself	You leave the organization	Deleted when you leave
Membership an organization created for you	That organization removes it	Held for the organization; see section 8
Service hours and their review history	Request by the organization that holds them	Kept, so service remains verifiable
Event registrations, shift choices, sign-up answers, attendance	The organization deletes the event, or the annual review	Kept while the event record is kept
Answers to an organization's own intake questions, and any documents uploaded with them	Submission	3 years, then deleted automatically
Requirement statuses and uploaded evidence	The requirement is removed, or the membership ends	Deleted with the requirement or the membership
Guardian records and consent history	See section 4	Consent decisions kept as evidence; contact details deleted on request
Guardian access links and sessions	Issue	Links expire after 7 days, sessions after 30 minutes; both stored only as hashes
Uploaded photos and organization logos	Removal by the uploader or the organization	Kept while displayed
Policy acceptance records	—	Kept as evidence that consent was given at a particular moment
Administrator audit records	—	Append-only; not deleted (section 9)
Operational logs (IP address, browser user agent, request metadata)	Collection	Kept under our telemetry provider's configured retention window, then discarded
Unclaimed organization directory entries	A takedown request, or the organization registering	Removed on request, without an account

Information about children and young people

Information about a person under 18 is kept only for as long as it serves the purpose it was collected for — recording and verifying their service with the organizations they belong to — and is deleted when that purpose ends. It is never kept "just in case", is never used for any purpose beyond operating the platform, is never sold, and is never used to train machine-learning models.

A guardian may ask at any time for the information held about their child or ward to be deleted, by writing to privacy@arkansasserve.com. We act on that request as described in section 7, and a guardian does not need an account to make one.

Two things survive a deletion request, and we would rather say so here than surprise anyone later. The first is the record that consent was granted or withdrawn, and when — kept because a withdrawal that vanished from the record would be impossible to prove afterwards. The second is any record an organization created and holds about a young person's service with it, which that organization deletes on its own schedule, except where section 8 sets a period we apply ourselves (section 8). Both are stripped to the minimum needed to serve their purpose when the rest of a young person's information is deleted.

Where a young person turns 18 and no guardian involvement remains necessary, the guardian contact details held for them are removed at the next annual review.

What deletes itself

One thing on the platform deletes itself on a timer: in-app notifications, after 30 days. Guardian access links and the short sessions they open expire on their own, but expiry stops them working rather than erasing the record of them.

Nothing else is deleted automatically. Member records, service hours, uploads, guardian consents, and audit records are removed by an administrator, by us, or through the review in section 6 — never silently by a background process. This is the same statement made in section 11 of the Privacy Policy.

The annual retention review

Once a year, and after any material change to how the platform handles data, the owner reviews what is held and deletes what no longer has a purpose. The review covers:

Accounts with no organization membership and no activity for 24 months.
Organizations that have left the platform, against whatever was agreed with them at the time.
Uploaded documents supporting requirements that no longer exist.
Guardian contact details for young people who have since turned 18.
Event records for events long past, where no service hours depend on them.

The review is manual, because Arkansas Serve is small enough that a person can do it and careful enough that a person should. The date each review was carried out and what it deleted are recorded internally.

Asking us to delete your information

Write to privacy@arkansasserve.com. As stated in section 12 of the Privacy Policy, we respond within 30 business days with the information we hold about you and how removal will proceed. A guardian may make the request for a child or ward.

We will tell you plainly if part of what you have asked about is a record an organization controls rather than us, and who to ask — we do not use that as a reason to do nothing about the rest.

Records an organization controls

Schools, courts, and organizations frequently have their own retention obligations, and the records they create on Arkansas Serve — roster entries, approved hours, requirement statuses — are theirs to keep or remove under their own schedule. Leaving an organization does not delete them, and we do not override an organization's retention decision about its own records.

One category is an exception, and we set its period ourselves. Answers to an organization's own intake questions, and any documents uploaded with them, are deleted three years after they are submitted — whatever the organization's own schedule says. These are questions an organization wrote itself and may put to anyone, including a minor, and an open-ended lifetime for them is not something we are willing to offer. An organization that needs to hold something for longer should record it as a requirement status, which section 3 covers.

Organizations may ask us to apply their retention schedule in bulk, and we will assist. The Organization Terms & Conditions set out the responsibilities that come with holding those records.

Records we deliberately do not delete

Two categories are kept on purpose, because deleting them would remove the evidence that something happened:

Administrator audit records. Append-only, covering platform administrator activity. Not deleted.
Consent history. Granting, withdrawing, and re-granting are all retained with their dates and the document version in force at the time, along with the IP address the consent was submitted from.

Both hold the minimum needed to serve that evidential purpose.

Backups

Deleting a record removes it from the live service immediately. Residual copies may persist in our hosting provider's platform backups until those backups age out of the provider's retention window. Those copies are not used to serve the platform and are not accessible in ordinary operation; they are restored only in a disaster, and a record deleted at your request is deleted again if a restore reintroduces it.

Changes to this policy

This document carries its own version, separate from the version of the Terms & Conditions and Privacy Policy that users accept at sign-in. Material changes are announced as described in section 23 of the Terms & Conditions: three business days' notice before they take effect.