On school and workplace learning platforms you were never the customer: the institution bought the system, so deletion is its call, and a request to the vendor is usually redirected. The main record stays long after you have gone, with no period named.
Special-category records, often about a child. Worth keeping.
Academic and safeguarding records are kept for years, sometimes for life.
Enrolment may verify identity; a learning app often asks for little.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A school or university record follows you into adulthood: grades, discipline, special-needs assessments, family circumstances. One breach took the records of more than sixty million students at once.
You were never the customer
The school, college or employer bought the platform, so they are the customer and you are not. Deletion is their call, and a request to the vendor is usually sent straight back to them. Under 13, the school's consent even stands in for a parent's.
They keep how you worked, not just how you did
Policies here list conduct notes, browsing history and screenshots, message content, and how each question was answered. Watched exams add the room, the screen, your face and a photo ID.
It stays long after you have gone
Most policies name no period at all and keep the main record as long as they judge necessary. The few numbers that appear cover small pieces, like a video call. The award never goes: exam boards and universities keep it so the qualification can always be checked, and a school file about you can run for decades.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
The list understates it for a school or university: the record covers behaviour, needs and family circumstances, and it was written about you by other people.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Special-needs and welfare flags sit in the file.
Pastoral and safeguarding notes touch on it.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
Child-protection and vulnerable-adult records are kept for decades.
The award is a register entry, kept so the qualification can always be verified.
Tax and company law makes them keep billing and payment records.
One stolen contractor login exposed more than sixty million students across thousands of districts; the ransom was paid, then the districts were squeezed again. A vendor was ordered to delete the models it had built on school-consented data, and European schools were told that handing student data over to improve the product had no lawful basis.
Ed-tech has shared pupil data with advertisers and brokers.
Coursework and behaviour train learning and proctoring models.
Anonymised is their word. A pupil is singled out by school, year group, and date of birth, the same few fields the first re-identification study used (Sweeney, 2000).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“acting as the agent of the parent and consenting on the parent's behalf”
Data is taken from a child under 13 without anyone ever asking the parent. The school gives the consent, and in some policies the act of buying the product is the consent.
THE MOVE A request asks for everything held on the child and who authorised it. The reply goes on your record.
“retention and deletion is at the direction of the school”
No limit set by the vendor on how long the record lives. If the school never says delete, it stays. A deletion request sent to the vendor turns into a referral back to the school.
THE MOVE A request establishes, in writing, where the deletion power actually sits. The reply, or the referral, goes on your record.
“facial detection, not facial recognition”
During an exam a proctoring service tracks the face and eyes continuously, while wording it to stay clear of the laws that govern biometric data. In the same market, identity checks elsewhere admit to generating biometric face data, which policies say is deleted within two years.
THE MOVE A request names the exam recording held on the student and asks how long it is kept. The reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →