Wendel, Inc.
Retention + Deletion
Effective: May 16, 2026Last revised: May 16, 2026Version: 0.1 (draft)
§1Purpose
Wendel maintains the following retention defaults so that Schools can provide accurate, FERPA-aligned records of student engagement without accumulating data beyond its useful lifetime. Schools may override any default in their data-processing agreement.
§2Default retention windows
| Record category | Default retention | Rationale |
|---|---|---|
| Student profiles (name, email, grade, school) | Length of enrollment + 1 academic year | Records may be needed to verify involvement for college applications. |
| Attendance + check-in events | Two academic years | Required for FERPA-aligned proof of student engagement. |
| Announcements | Two academic years | Searchable history for advisors and members. |
| Audit log entries | Seven years | Matches the FERPA seven-year retention standard for institutional records. |
| Generated exports (CSV, PDF) | Thirty days from generation | Avoids stale snapshots persisting beyond their useful window. |
| Uploaded files (PDFs, images) | Until manually deleted by an officer or School admin | Club-controlled. Subject to the File scanning + allow-list policy. |
| Push device tokens | 180 days of inactivity, or sooner if delivery fails three times | Limits push fan-out to live devices. Swept nightly. |
| QR / NFC nonces (jti) | Until expiry, then 30 days for replay protection. | Short-lived. Swept nightly. |
| Announcement read state | 365 days | Older read receipts no longer drive unread badges or analytics. Swept nightly. |
| Rejected reimbursement requests | 180 days | Approved + paid requests are kept as part of the budget ledger. Rejected ones age out. Swept nightly. |
§3School-controlled overrides
A School may, by written instruction, shorten any default retention period for its tenant. Lengthening a retention period beyond the default requires a written amendment to the data-processing agreement and may incur additional storage fees. Where a School instruction conflicts with applicable law, Wendel will follow the more protective standard.
§4School-year rollover
Wendel exposes a one-click School-year rollover action to School admins. Running rollover advances the active academic year label (e.g.
2026-27 → 2027-28) and is written to the audit log. Rollover does notdelete any historical attendance, membership, announcement, or file record; it only changes what downstream "this year" filters consider in-window.§5Deletion + export on request
On written request from a School admin or a guardian / Eligible Student, Wendel will:
- Provide a machine-readable export of the requestor's records within thirty (30) days.
- Delete the requestor's Personally Identifiable Information from the active Services within thirty (30) days of confirmation.
- Purge backups containing the deleted records within ninety (90) days, the cycle of our backup rotation.
§6Audit + security logs
Audit log entries documenting access to or modification of Personally Identifiable Information are retained for seven (7) years from the date of the underlying action, irrespective of other retention windows. Security telemetry (e.g. failed sign-in attempts, rate-limit triggers) is retained for ninety (90) days.
§7Contact
Retention questions and deletion / export requests may be directed to privacy@trywendel.com.