Data Retention & Deletion Schedule

1. About This Schedule

This Data Retention and Deletion Schedule explains how long Superhive Pty Ltd trading as Superadjust ("Superadjust", "we", "us", "our") retains different categories of information, and what happens to information when an account is cancelled or terminated.

This Schedule supplements the Privacy Policy and the Data Handling Schedule (which forms part of the School Services Agreement). If there is any inconsistency between this Schedule and the Privacy Policy or the Data Handling Schedule on the subject of retention, the more protective of personal information prevails.

2. Principles

Our retention practices are designed around the following principles:

• Necessity: we retain personal information only for as long as reasonably necessary for the purposes described in the Privacy Policy.
• Legal compliance: we retain information for the period required by Australian privacy, tax, accounting and business record-keeping laws.
• User control: we provide schools and users with reasonable opportunity to export their content before deletion.
• Operational integrity: we retain limited operational and audit logs to support security, dispute resolution and service operation, and we anonymise these where possible.
• Backups: we maintain backups for security and recovery purposes, but those backups follow a controlled rotation and are not used for active access to deleted information.

3. Active Accounts

While an account or subscription is active, customer content is retained in production and is accessible to authorised users in line with their role and the account configuration.

4. Failed Payments

If a paid subscription enters a failed-payment state, the account remains accessible for a grace period of up to 60 days. During the grace period we may attempt to recover payment, notify the relevant account contact, and limit or move the account into a read-only state. If payment is not received within the grace period, the subscription may be cancelled and the account may move into the cancellation lifecycle below.

5. Cancellation Lifecycle

When an account is cancelled or the underlying agreement is terminated, customer content moves through the following lifecycle:

Stage 1 — Read-only export window (90 days): from the cancellation or termination date, customer content is retained in a read-only export state for 90 days. During this window authorised users may sign in to export their content, content cannot be created or edited, and AI features are unavailable.

Stage 2 — Deletion warning (14 days): approximately 90 days after cancellation, we send a deletion warning to the relevant account contact by email and, where reasonably practical, also through an in-app notification on next sign-in. The deletion warning explains that final deletion will occur in 14 days.

Stage 3 — Final deletion (Day 104): approximately 104 days after cancellation, customer content is scheduled for permanent deletion from production systems. After final deletion, customer content is no longer accessible to anyone, including school administrators, coordinators, teachers or Superadjust personnel. Limited residual copies may persist in encrypted backups for a short, time-limited period before being overwritten in the ordinary course of backup rotation. Billing, tax and business records relating to the cancelled account are retained as described in section 8.

6. Backups

We maintain backups of production data for security, business continuity and recovery purposes. Backups are encrypted at rest using industry-standard protocols, are stored in Australia in line with our hosting region, and follow a controlled rotation. Any backup containing customer content from a deleted account is overwritten or destroyed in the ordinary course of that rotation, generally within 35 days of final deletion.

Backups are not used to provide ongoing access to deleted accounts and are not searchable or exportable for individual records once an account is finally deleted.

7. Audit Logs

Superadjust retains operational and security audit logs to support service operation, security investigations, dispute resolution and legal compliance. These logs may include authentication events, administrative actions, access events involving customer content, billing and subscription change events, configuration changes, and integration and export events.

Audit logs are retained for up to 7 years from the date of the relevant event. Where these logs relate to a deleted account, identifying information about individuals is anonymised so that the logs cannot reasonably be used to identify an individual after deletion.

Audit logs are accessible only to a limited set of Superadjust personnel for legitimate operational purposes.

8. Billing, Tax and Business Records

We retain billing, invoicing, tax and business records for the period required by Australian tax, accounting and business record-keeping laws. This is generally at least 7 years from the end of the financial year to which the record relates.

Where a record contains personal information, we limit our use of that record to the purposes for which it was retained (such as tax, audit and dispute resolution).

9. AI Processing Logs

Where a user uses AI-assisted features, the input may be sent to a third-party AI service provider hosted in Microsoft Azure infrastructure in the Australia East region. We do not store raw AI prompts in our backend as a separate persistent record. Operational logs that may contain prompt content are retained only for the period necessary for security, error monitoring and service operation, generally up to 30 days.

AI outputs that are saved by a user inside the platform are stored alongside other customer content and follow the customer content lifecycle in section 5.

We do not use customer data to train AI models and we do not intentionally permit customer data to be used to train AI models.

10. Marketing and Waitlist Contacts

Marketing and waitlist contact records are retained while the contact is active and we have a basis to communicate (for example, an active opt-in or relevant business relationship). When a contact unsubscribes, we honour the unsubscribe within five business days, retain limited information for up to 30 days after unsubscribe to ensure the unsubscribe is reflected across our systems, and then remove the contact record from active marketing systems.

Some metadata may persist longer in audit or compliance records, in line with the Spam Act 2003 (Cth).

11. Support Ticket History

Support tickets and related communications are retained for 3 years or for the lifetime of the related account, whichever is shorter. Tickets may be retained for longer where reasonably required for security, audit, legal compliance or dispute purposes.

12. Authentication and Account Access Information

Authentication metadata (such as email addresses, password hashes and session tokens) is held by our authentication provider in Australia. This information is retained for the lifetime of the account and is deleted when the account is finally deleted, in line with section 5.

13. Requests to Delete Information Sooner

A school may request earlier deletion of its account and content, subject to the school confirming that it has completed all required exports, any legal or audit obligations that require retention, and the request being made by a person with authority to act on behalf of the school.

A teacher with a personal account may also request earlier deletion. Earlier deletion requests should be sent to privacy@superadjust.com. Where deletion is granted earlier than the standard cancellation lifecycle, billing, tax and audit records are still retained as described in this Schedule.

14. Children's Information

Information about students is held inside the platform. Students do not log in or create accounts. Schools and authorised users remain responsible for entering, maintaining and arranging deletion of student information through their account workflows. Information about students is subject to the customer content lifecycle in section 5.

15. Updates to This Schedule

We may update this Schedule from time to time. Material changes will be communicated in line with the Privacy Policy and the School Services Agreement. The effective date at the top of this Schedule will reflect the most recent change.

16. Contact

Questions about this Schedule can be sent to privacy@superadjust.com.