Subject matter: hosted adult business knowledge and learning workspace, authorised public Reader delivery and selected ancillary functions. Duration: the Agreement plus approved restricted offboarding, backup and lawful-retention periods. Frequency: continuous hosting/access, user-triggered interactions and configured scheduled jobs. Nature: collection, hosting, organisation, versioning, retrieval, display, transmission, analysis, assessment scoring/progress recording, support, export and deletion under instructions. Purpose: provide the selected service, protect it and assist the customer; no unrelated advertising or model training.

Data subjects: authorised adult employees, contractors, administrators, invited external learners/readers, business contacts, support correspondents and persons incidentally named in permitted customer content. No intentional children's or excluded sensitive-data processing is authorised. The customer must identify additional categories before use.

Identity/access. Data and authorised purpose: Work identity, membership, invitations, role and federated subject; authentication and permissions. Recipients/access: Authorised administrators and hosting/database/email; identity provider selected by customer.

Content and media. Data and authorised purpose: Knowledge articles, versions, comments, imported source files, assets and publication choices. Recipients/access: Permitted members; public only on instructed publication; hosting/storage and private conversion/scanning.

Learning. Data and authorised purpose: Assignments, enrolments, assessment answers/results, evidence, certificates and progress. Recipients/access: Authorised learning roles and learner; approved customer LRS only when enabled.

Search/feedback. Data and authorised purpose: Search requests, optional normalised-query analytics, pseudonymous visitor keys, feedback/comments. Recipients/access: Requested search processing; authorised dashboards with optional analytics choice.

AI. Data and authorised purpose: Questions/instructions, necessary source excerpts/context, selected source references, feature-specific drafts and provenance. Recipients/access: Authorised feature users and approved model provider only when enabled.

Support/audit. Data and authorised purpose: Necessary support conversations, action/security events, identifiers and bounded diagnostics. Recipients/access: Authorised support/security personnel; approved logging provider.

Connectors. Data and authorised purpose: Authorised source content, source metadata, sync state and encrypted credentials. Recipients/access: Specifically enabled source/destination; credential access restricted.

Customer contact: [CONFIRM: controller/privacy and incident contacts]. Beetl contact: [CONFIRM: monitored privacy and incident contacts]. Intended exports include data and related files needed to interpret the records. Existing owner JSON export, progress export and asset recovery tools require an end-to-end scope test before promising a single complete offboarding package.

Periods below are maximum proposals where marked, not legal conclusions. The customer may need a different lawful period for workforce/compliance evidence. Shorter legal duties prevail. Approval must specify purpose, event starting the clock, deletion mechanism, owner, exceptions and verification evidence per category.

Sessions. Observed application behaviour: Seven-day expiry. Proposed production policy or unresolved decision: Retain configured expiry; test revocation and deployed cookies.

Legal acceptance/account identity. Observed application behaviour: Acceptance retained with user; organisation deletion is not necessarily global user deletion. Proposed production policy or unresolved decision: Define account-closure and narrow legal-proof retention separately; counsel selects claims/limitation period.

Articles/media. Observed application behaviour: Lifecycle retention; deleted articles recoverable for 30 days; learner-evidence protections can block purge. Proposed production policy or unresolved decision: Keep while instructed; complete article/file/evidence deletion map and lawful exceptions.

Optional analytics. Observed application behaviour: Default 365 days. Proposed production policy or unresolved decision: Maximum 365 days from event unless customer selects shorter; confirm scheduled purge.

Article feedback. Observed application behaviour: Default 730 days. Proposed production policy or unresolved decision: Maximum 730 days from submission unless shorter selected; review proportionality.

Stored AI questions. Observed application behaviour: Default 90 days. Proposed production policy or unresolved decision: Maximum 90 days from event; independent provider retention must be separately stated.

Generated drafts/provenance. Observed application behaviour: Feature/project lifecycle. Proposed production policy or unresolved decision: Delete with relevant content/project and organisation, subject to evidenced exceptions; not a blanket 90-day promise.

Learning records. Observed application behaviour: Progress retention configuration exists; inventory notes legacy purge deferred and evidence-specific retentionUntil. Proposed production policy or unresolved decision: No universal 365-day deletion claim; agree per category and fix/manual-verify purge and evidence retention before promising deadlines.

Support conversations. Observed application behaviour: Customer/account lifecycle, shorter final period pending. Proposed production policy or unresolved decision: Proposed 12 months after ticket closure, subject to secure manual/automated deletion implementation.

Operational/security logs. Observed application behaviour: Deployment/provider dependent. Proposed production policy or unresolved decision: Proposed routine logs 30 days and security investigation logs 90 days from event, longer only for documented incident/legal need; verify provider settings.

Copyright/legal cases. Observed application behaviour: No fixed approved period. Proposed production policy or unresolved decision: Counsel defines jurisdiction-appropriate period and review/release of holds; no invented statutory period.

Invoices/tax records. Observed application behaviour: Provider/finance process not verified. Proposed production policy or unresolved decision: Accountant/counsel supplies country-specific statutory periods; retain minimum necessary finance data separately from content.

Offboarding. Observed application behaviour: Owner-confirmed deletion default cooling-off 30 days; export grant valid 10 minutes; object cleanup separate. Proposed production policy or unresolved decision: Proposed export opportunity 30 days after termination; active purge within 30 days of confirmed request including cooling-off, with faster legal erasure route.

Backups and provider residual copies. Observed application behaviour: Production retention/immutability and deletion not proven. Proposed production policy or unresolved decision: Proposed backups expire within 90 days after active deletion; reject or revise proposal if provider evidence cannot support it; provider AI/email residuals separately disclosed.

A purge job, export link or expired session is not by itself evidence of erasure of content, files, derivatives, connector copies, learner evidence or backups. Create a restricted completion record with dates, counts and exceptions; never include private content in logs. Suspend ordinary use of restricted retained copies. Restores must reapply deletions before reopening access. Manual holds need named authority, scope, review and release; no automated legal-hold capability is asserted.