Data retention
Effective / published version: 2026-10-01
This policy covers this product when provided through a school-managed LearnSys account, including students under 18. IGEARS TECHNOLOGY LIMITED provides LearnSys. The school determines the educational purposes, authorised users and school-record arrangements; iGears provides processing and support within the agreed school service. Public demos accept fictional data only. Separate consumer apps, Poe tools and Tutor Centre Cloud have their own policies.
EduFlow handles selected teaching text, submissions and authorised documents. The text-processing sections apply to these tools. English voice assessment is a separate learning feature with its own English product policy.
School records: review thresholds, not automatic erasure
The school documents the purpose, period and review trigger for each enabled data category. Current product defaults flag archived educational/identity records for review after 730 days, core operations after 365 days, admissions after 183 days and financial categories after 2,555 days. They run from the relevant archive/review basis, not automatically from the pupil’s birth, submission or leaving date.
These are configurable product review defaults, not statutory retention periods and not automatic erasure of active student records. A school may use different justified periods and must tell families the applicable schedule. No longer needed records should be removed or appropriately de-identified, subject to lawful retention.
AI text and school learning records
Text requests specify no training and no persistent provider content storage. The school AI usage ledger keeps references, feature/provider, status, time, character counts and cost metadata, not prompt or response bodies. Submitted work and saved feedback in the learning module are separate school records. Provider-side no-retention settings and actual logs must be confirmed for each deployment; request flags alone do not prove enforcement.
What removal may leave behind
A reviewed student removal deletes that student’s approved operational/learning records and private files, while retaining required financial and programme-usage totals with direct identifiers removed. This is de-identification, not guaranteed irreversible anonymity: some financial links can remain until the school’s applicable retention period ends. The school must state the continuing reason and review date.
Other children’s records and shared family accounts remain. Shared class documents, free text and files already exported or independently kept by the school need a separate school review; automated name matching cannot reliably remove every reference. Where the school independently maintains other copies, including its own backup arrangements, their retention and erasure must be explained by the school.
Access, correction, deletion and help
Contact the school office or its designated privacy contact through an existing verified private channel. Identify the student using the school reference, explain the records or activity concerned, and state whether you seek access, correction, removal or withdrawal of an optional permission. The school checks identity and any parental/guardian authority before disclosure.
Under Hong Kong’s Personal Data (Privacy) Ordinance, statutory access and correction requests are generally to be complied with within 40 calendar days of receipt, subject to the applicable requirements and exceptions. If unable to comply in time or lawfully refusing, the responsible data user must give the required written notice and reasons within that period. An internal review does not restart the statutory clock.
Deletion is reviewed against the purpose and any continuing retention duty; it is not an unconditional promise to erase every record immediately or within the access-request deadline. The school should explain any retained category, reason, review date and progress. See this product’s retention and deletion pages.
If you cannot identify the school contact, email [email protected] with the school name and a short description only. Do not send student records, passwords, invitation codes or identity documents in ordinary email or the public quotation form. Suspected exposure should be reported promptly through these channels without forwarding the exposed records. You may also contact the PCPD about privacy concerns.