Data retention policy
How long we keep each category of data, why, and exactly what happens when you delete your account.
Effective Version 1.3
1. How this policy is enforced
The periods in this document are not an intention — they are configured in the system itself. Every record subject to expiry is stored with an expiry timestamp, and the database removes it on its own once that time passes. No human step is involved.
Deletion is asynchronous. Amazon DynamoDB typically removes expired records within 48 hours of the expiry timestamp; during that short window the record is already unreachable through the application.
Periods run from the record’s creation date, not from when it was last opened. Re-reading an old analysis does not restart its clock.
2. Retention schedule
| Data category | Retention period | Reason |
|---|---|---|
| Sign-in account (email, name, language, internal identifier) | For as long as the account exists | Performance of the contract (Art. 6(1)(b) GDPR). Deleted immediately when you delete your account. |
| Learning profile (display name, plan, streak, accuracy, games played) | For as long as the account exists | Performance of the contract. Deleted immediately when you delete your account. |
| Saved vocabulary and spaced-repetition progress | For as long as the account exists | Performance of the contract. Deleted immediately when you delete your account. |
| Devices with “Words on your lock screen” turned on (push notification address, time zone, time window and frequency) | 90 days without activity | Performance of the contract (Art. 6(1)(b) GDPR): without it we cannot send the notices you turned on. Unlike the other rows, this period runs from the device’s last activity (a notice accepted by the push service, or opening Lehrito on it). Deleted immediately when you turn it off or delete your account, and within 24 hours after your paid access ends. |
| Writing history: the text you wrote and its AI feedback | 24 months (730 days) | Data minimisation (Art. 5(1)(c) and 5(1)(e) GDPR). Expires automatically 24 months after it is saved, even on an active account. |
| Pronunciation history: the target text and the transcript of your speech | 24 months (730 days) | Data minimisation. Expires automatically 24 months after it is saved. We never store or transmit audio — the transcript is produced in your own browser. |
| Monthly and daily AI usage counters, and lock-screen notification usage counts (notices sent and tapped, turned on and off) | 90 days | Enforcing plan limits and preventing abuse (Art. 6(1)(b) and 6(1)(f) GDPR); for the notification counts, legitimate interest in knowing whether the feature is used (Art. 6(1)(f) GDPR). |
| Lifetime free-allowance counter | For as long as the account exists | Abuse prevention: if it expired, the free trial could be reset indefinitely. |
| Record of your acceptance of the terms (document version and timestamp) | Account + 3 years | Accountability (Art. 5(2) and Art. 7(1) GDPR): we must be able to show which text you accepted. |
| AI-generated dictionary entries | Indefinite | Not personal data. Stored per word rather than per user and shared across all accounts. |
| Licences, classes and academy records (including student email addresses) | Term of the academy’s contract | Performance of the academy’s contract; the academy is the controller for these records. Deleted when the contract ends. |
| Enquiries sent through the academies form (name, email, phone) | 24 months (730 days) | Pre-contractual steps at the data subject’s request (Art. 6(1)(b) GDPR). Expires automatically after 24 months, and can be deleted sooner at any time. |
| Academy audit log (actor, subject, event, notes) | 3 years (1,095 days) | Legitimate interest (Art. 6(1)(f) GDPR): evidencing who granted or revoked each licence. The period mirrors the standard limitation period under § 195 BGB. |
| Licence activation links and invitations | 72 hours | Security: the link stops working once the period elapses. |
| Invoices and payment records | 10 years | Legal obligation (§ 147 AO, § 257 HGB). Held by Stripe as an independent controller; overrides the right to erasure under Art. 17(3)(b) GDPR. |
| Technical server logs (CloudWatch) | 30 days | Legitimate interest: security and fault diagnosis. Email addresses are masked before they are written. |
| Transactional emails sent (activation, receipts, notices) | Not retained by us | Delivered through Amazon SES and not archived by us. |
3. What happens when you delete your account
You can delete your account at any time from My profile → Danger zone. There is no grace period and no recycle bin: deletion is immediate and irreversible.
A single operation removes:
- Your entire sign-in account, including your email address and name.
- Your learning profile and statistics.
- All of your saved vocabulary.
- Your entire writing history, including the original texts.
- Your entire pronunciation history, including the transcripts.
- All of your usage counters.
- The devices where you turned on words on your lock screen.
- Any active subscription is cancelled immediately so that you cannot be charged again.
4. What survives deletion, and why
Erasure is not absolute. Art. 17(3) GDPR recognises exceptions, and two of them apply here:
- Invoices and payment records. German commercial and tax law requires these to be kept for ten years (§ 147 AO, § 257 HGB). They are held by Stripe as an independent controller. What we do delete is the link between your account and that record.
- Data managed by your academy. If you access Lehrito through a licence from a language school or college, that institution’s licence records and audit trail belong to the institution, not to your personal account. Deleting your Lehrito account does not dissolve your school’s records — for that, contact the academy directly.
5. Changes to this policy
Any change to these periods is published here with a new version and effective date. Where a change shortens a period, it applies to data already stored.
If anything in this document does not match what you observe in the product, we want to know: write to seguimiento@profesorlehrer.com.