RepLogix Data Retention Policy

RepLogix follows these core retention principles:

• Data Minimization: We retain only the data necessary to provide, maintain, secure, and improve the Service
• Purpose Limitation: Data is retained only for as long as it serves the purpose for which it was collected
• User Control: Users, schools, and districts may request deletion of their data subject to applicable legal requirements
• Legal Compliance: We comply with FERPA, COPPA, and applicable state student data privacy laws regarding retention and deletion
• Backup Recovery: Data may persist in encrypted backups for a limited period after deletion, as described below

The following retention periods apply to different categories of data within RepLogix:

Note: Full credit card numbers are never stored by RepLogix. Payment credentials are handled by Stripe, which maintains its own PCI DSS-compliant retention practices.

For schools and districts using RepLogix, the following additional student data retention provisions apply:

• Student data is retained only for as long as the school or district maintains an active subscription and the data serves an educational purpose
• Upon subscription cancellation, student data is retained for a 90-day reactivation window, after which it is permanently deleted unless the school or district requests earlier deletion
• Schools and districts may request deletion of student data at any time by contacting RepLogix in writing
• RepLogix will honor data return or deletion obligations under FERPA and the school's or district's Data Processing Agreement (DPA) within 30 days of a written request
• RepLogix does not retain student data after contract termination for any purpose other than as required by law or as described in the backup section below

RepLogix is hosted on infrastructure maintained by Base44, which holds SOC 2 Type II and ISO 27001 certifications. Data is included in encrypted backups as part of standard disaster recovery procedures.

• Backups are encrypted at rest and stored within the United States
• Deleted data may persist in encrypted backups for up to 30 days after deletion before being overwritten
• Backup data is accessible only to authorized infrastructure personnel under Base44's security controls
• RepLogix does not independently guarantee specific backup schedules or recovery time objectives; refer to the Base44 Security Trust Center for details

Users, schools, and districts may request deletion of their data at any time. To submit a data deletion request, contact:

Please include the following in your request:

• Your name and role (coach, admin, athletic director, district administrator)
• Account email and organization name
• Scope of deletion (specific records, all data, or account closure)
• Any applicable DPA or procurement reference number

We will process verified deletion requests within 30 days. Residual data in encrypted backups will be overwritten within the backup retention window described above.

When a user closes their account:

• Account access is revoked immediately
• Active subscription billing is stopped
• User-entered data is retained for 90 days for accidental closure recovery, then permanently deleted
• Billing metadata is retained for 7 years for tax compliance purposes
• De-identified analytics data is retained indefinitely

If RepLogix is subject to a legal hold, litigation, investigation, or regulatory request, data that would otherwise be deleted may be retained until the legal matter is resolved, even if the retention period in this policy has expired.

We may update this Data Retention Policy from time to time. When we make material changes to retention periods, we may notify users through the app, website, email, or account notice. Schools and districts under an active DPA will be notified of material changes that affect student data retention.

For questions about data retention or deletion, contact: