Data Retention Policy

Configurable Retention Periods

Each institution controls its own data retention period through the organization settings in the admin dashboard. The default retention period is 12 months, and institutions can configure any period between 1 and 120 months (10 years).

The retention period applies to evidence files attached to finalized submissions (approved or rejected). Active submissions and in-progress reviews are never subject to automated cleanup.

Automated Cleanup Process

Actras runs a scheduled cleanup process that identifies evidence files older than your institution's configured retention period. The process runs weekly and operates as follows:

1. Evidence files attached to finalized submissions are evaluated against the retention period set in your organization settings.
2. Files exceeding the retention period are permanently removed from storage and their database records are deleted.
3. The submission record itself is preserved to maintain aggregate statistics and audit trail integrity.
4. An audit log entry is created for every cleanup operation, recording the number of files removed and the triggering policy.

When a user account is deleted, Actras applies an audit-safe anonymization process:

• Personal identifiers (name, email) are replaced with pseudonymized values that cannot be traced back to the individual.
• Organization memberships and access rights are revoked immediately.
• Personal notifications are permanently deleted.
• Submission records and review decisions are preserved with the pseudonymized identifier, maintaining the integrity of aggregate reports and audit trails.
• An audit log entry records the anonymization event.

This approach ensures compliance with data minimization principles while preserving institutional reporting accuracy.

Data Export Rights

Institutions have the right to export their data at any time. Actras supports the following export mechanisms:

• CSV export: Program-level reports can be exported directly from the admin dashboard in CSV format.
• Full data export: Contact privacy@actras.io to request a complete export of all organizational data.

Service Termination

Upon termination of your Actras subscription, the following process applies:

• You will be given 30 days to export all data.
• After the export window, all data including evidence files, submissions, user profiles, and audit logs is permanently deleted from our systems.
• A certificate of deletion is available upon request.

Related Policies

Questions

For questions about data retention or to request changes to your institution's retention settings, contact your organization administrator or reach out to privacy@actras.io