Data retention and deletion schedule

This schedule explains how long EcclesiaOne keeps the main categories of data and how deletion works. The platform is operated by Orravo Web Technologies. It supports the Privacy Policy and the Data Processing Agreement.

Retention is governed by what the data is for, by legal and tax obligations, and, for sacramental records, by the Church's obligation to preserve its registers.

1.How to read this schedule

For each category, the schedule gives the retention period and what happens at the end. Where a tenant controls a record, the tenant's own retention rules may also apply.

We have written this schedule to describe what the platform actually does, not what we would like it to do. Several categories below say that the data is kept for as long as the institution's account is open. That is the honest position: the platform does not run an automatic deletion job for those categories, and the data stays until the institution or the individual asks us to remove it, or until the account is closed and the data is deleted. Where an automatic deletion does run, the schedule says so and gives the period.

2.Schedule

Data category	Retention	Notes
Sacramental and canonical records (baptism, confirmation, communion, marriage, anointing, holy orders, religious profession, funeral)	Permanent	Preserved as part of the Church's permanent register. Not erased on request. Tamper-evident. May be transferred to the diocese or successor institution on tenant exit.
Pastoral and spiritual notes, confession bookings	Kept for as long as the institution's account is open, unless the priest or the institution deletes them	Encrypted so that only the assigned priest can read them. No automatic deletion runs.
Marriage tribunal and vocations records	Kept for as long as the institution's account is open	Sensitive; restricted access. No automatic deletion runs.
Safeguarding clearances	A clearance is valid for 12 months from the date the training was completed, unless a different expiry is recorded. The record itself is kept for as long as the institution's account is open	The holder is warned 30 days before expiry. When a clearance lapses, roles and school-staff assignments that involve contact with children are set to expired automatically. The clearance record is retained as evidence of what was held and when.
Safeguarding incident records	Kept for as long as the institution's account is open	Restricted; may be shared with authorities. No automatic deletion runs, because safeguarding records are normally kept long term.
Adult-minor interaction logs	Deleted automatically on the young person's eighteenth birthday, together with the rest of their minor profile	See the Children's Privacy Notice. If your institution needs these logs to survive that point for safeguarding purposes, export them before the person turns eighteen.
Parental and guardian consent records, and the photo consent ledger	Deleted automatically on the young person's eighteenth birthday, together with the rest of their minor profile	See the Children's Privacy Notice.
Children's non-canonical content (youth forum posts, prayer-wall entries)	Kept until the person, once eighteen, asks for it to be removed. The request is carried out on the next nightly run and cannot be undone	See the Children's Privacy Notice. Canonical records are excluded. Photographs are not covered by this removal.
Account and credential data	Kept for the life of the account. Closing an account disables sign-in and ends every session, but the account record itself is retained until the institution's data is deleted	Passwords are hashed with Argon2id.
Sessions	Expire after 14 days without use, and are extended each time you use the platform. Ended immediately when you sign out, sign out of other devices, or change your password	The expired session record is not swept from the database, but an expired session can no longer be used.
Authentication tokens	Email verification 24 hours; password reset 1 hour; invitations and set-password links 7 days; record-claim links 14 days; mobile access tokens 30 minutes; mobile refresh tokens 60 days	Expired tokens are rejected on use. The expired rows are not swept from the database.
Audit logs	Kept for as long as the institution's account is open	Records who acted, on what, and when, with the values before and after the change in many cases. No automatic deletion runs.
Billing and financial records (subscriptions, invoices, charges)	Kept for the period required by the tax and accounting law that applies to us and to the institution	Legal obligation. No automatic deletion runs.
Donation and giving records, receipts, tax letters	Kept for the period required by financial and tax law	Legal obligation.
School records (enrolment, attendance, grades, discipline, fees)	Kept for as long as the school's account is open, or until the school deletes them	The school controls these records and sets its own rules for them. No automatic deletion runs on the platform's side.
Messaging delivery records (SMS, email, push, WhatsApp)	Kept for as long as the institution's account is open	These records include the message that was sent, so that delivery can be confirmed and failures investigated. No automatic deletion runs, apart from the removal described in the Children's Privacy Notice.
Register images and the raw responses from the recognition provider	Kept for as long as the institution's account is open	See the AI and Automated Processing Notice. No automatic deletion runs. An institution that wants a scan removed can ask us and we will delete it.
Marketplace listings, inquiries, disputes	A listing stops being visible 90 days after it is posted. The records are kept for as long as the institution's account is open	Expiry hides a listing; it does not delete it. Disputes are kept while open and afterwards as evidence.
Error and diagnostic records	Deleted automatically 90 days after the error was last seen	These may include the identifier of the signed-in user, the page that failed, and the technical detail of the failure.
Cookie consent record	1 year	Then the consent banner reappears.
Backups	See section 4	Data you delete may still exist in a backup copy after it has gone from the live platform.

3.Deletion and tenant exit

When a tenant leaves the platform, we mark its account for deletion and hold the data for at least 30 days so that the account can be restored if the departure was a mistake, or while a dispute is settled. Before deletion the tenant can request a full export of its data.

After that period we delete the data, except for records that must be preserved by law or as canonical registers. That deletion is carried out by us on request rather than by an automatic job, so it may take longer than 30 days. If you need confirmation that a deletion has been completed, ask us and we will confirm it in writing. Sacramental records may be transferred to the diocese or successor institution rather than deleted.

When an individual exercises a right to erasure, we delete or anonymize the data we can, subject to the canonical-record preservation rule, legal-retention obligations, and the time it takes for deletions to propagate through backups.

4.Backups

The platform itself does not run a backup schedule. Backups of the primary database are those performed by our database provider under its own service terms, and our administrators can also take a manual snapshot of the database, which is kept until an administrator deletes it.

Data you delete from the live platform may therefore continue to exist in a backup copy until that copy is superseded or removed. We do not restore a backup in order to reinstate data that a person has asked us to erase.

5.Changes

We may update this schedule. When we publish a new version, the version number and date on this page change.

6.Contact

For questions about retention, contact [email protected].