Data Retention Policy

1. Our approach

LibraHub retains information for service delivery and necessary account administration, security, billing and legal purposes. This policy covers information held through www.librahub.online and should be read with our Privacy Policy.

Retention depends on the type of record, the library's instructions, its account status, a verified deletion request and any applicable legal obligation. We seek to delete or anonymise information when it is no longer needed for these purposes. Subscription expiry alone does not establish a deletion date.

2. Records and retention

Library and membership records

Student, staff, seat, shift, attendance and fee records are retained while needed to operate the workspace and during any authorised closure process. Removing an individual's access or allowing a membership to expire does not necessarily remove related financial or attendance records.

Unverified registrations

Abandoned, unverified owner registrations are eligible for scheduled cleanup after the configured period, which defaults to 72 hours. The cleanup excludes registrations with payments in a paid, captured or authorised state. Eligibility is not an exact deletion deadline: completion depends on the maintenance job and its review conditions.

Authentication and recovery information

Verification codes, login challenges and reset links have their own validity limits. Expiry stops a credential from being usable; associated records or security events may remain until cleanup or a necessary investigation is complete.

Subscription, invoice and payment records

Relevant records are kept for applicable accounting, tax, reconciliation, chargeback and dispute requirements. We do not promise to erase records that must legally be retained when a workspace closes.

Support and communication records

Messages, tickets and delivery information are retained as needed to resolve the issue, maintain service history and handle related complaints or disputes. Relevant records are reviewed for deletion or anonymisation when those purposes end.

Security and audit records

Records may remain for detecting misuse, investigating incidents, demonstrating authorised actions or meeting legal requirements. Retention is assessed according to the record, the investigation and any applicable requirement.

Exports, uploads and backup copies

Export availability follows the expiry shown for the generated file, where provided. Uploads, backups and provider logs follow their applicable storage and deletion processes; see sections 4 and 5 below.

Where a fixed period is not stated, the criteria above determine retention. Contact support for information about a particular category or request. A waiting period or expired download link is not proof of permanent erasure.

3. Workspace deletion

1. Request: an authorised library owner can open Privacy & Data, confirm the workspace identity and re-authenticate to submit a deletion request. If the control is unavailable, contact support.
2. Waiting period: this in-app flow schedules the request with a 30-day waiting period. The owner can cancel while the request remains in a cancellable state; contact support if help is needed.
3. Review: an authorised reviewer checks identity, authority, legal holds, unresolved records and any needed export. Approval is a review decision, not confirmation that data has been erased.
4. Completion: after the waiting period and required checks, deletion must be completed through the applicable operational process. Ask support for the request status, expected next steps and any retained-record exceptions.

A library's subscription cancellation and its workspace deletion are separate. If a different closure flow shows a specific retention period or date, review those details before confirming. Do not assume that an expired account or a cancelled subscription has already been erased.

Students and staff should first ask their library to correct or delete library-managed records. We may need the library's instructions or evidence of your authority before acting, subject to applicable law.

4. Data exports

Request any needed export before completing workspace closure. Exports are subject to authorisation, available technical facilities and restrictions needed to protect other users and confidential security information. Credentials, recovery secrets and payment-provider secrets are not part of an ordinary data-access export.

Self-service export may be unavailable where the deployment does not support secure export storage or processing. Contact support.librahub@gmail.com for assistance rather than assuming that an export has been generated. Follow any download expiry shown for an available file and keep the downloaded copy secure.

5. Backups and provider-held copies

Live database records, uploaded media, email delivery records, payment records and backups are held in different systems. A deletion in one system does not instantly delete all copies in other systems.

Where backups are maintained, their retention depends on the configured backup job and hosting provider. Residual copies may remain until their scheduled expiry or required retention ends, and may need to be retained longer for a lawful hold.

Backup copies are intended for recovery and necessary security or legal purposes, not routine use of a deleted workspace. If a backup is restored, completed deletion requests must be taken into account before the affected records return to ordinary use.

Providers such as Razorpay may independently retain payment records to meet their own obligations. Cloudinary, Brevo, hosting and scheduling providers may hold service-specific copies or logs. We coordinate requests within our control and explain relevant provider limitations; we cannot promise to override a provider's mandatory retention duties.

6. Exceptions and legal holds

Some records may be retained to meet tax or accounting duties, respond to lawful orders, investigate fraud or security incidents, resolve payment disputes or establish, exercise or defend legal claims. The scope and duration depend on the applicable requirement.

Retention for an exception should be limited to relevant records and access appropriate to that purpose. Where permitted, we will explain the exception when responding to a deletion request. Once the reason ends, the records should be reviewed for deletion or anonymisation.

7. Copies outside LibraHub

Libraries and users may hold downloaded reports, screenshots, exported files, receipts or emails outside the platform. They are responsible for those copies and for removing them when no longer needed. Uninstalling the PWA or clearing browser storage removes local material according to the device settings; it does not delete server-side records.

On shared devices, sign out and remove downloaded personal files. Your library may have its own retention obligations for records it controls.

8. Requests and updates

For retention, export or deletion questions, email support.librahub@gmail.com with your registered email, library name and request details. Do not include passwords or OTPs. Our contact address is LibraHub, Koderma, Jharkhand 825410, India.

We verify identity and authority, assess applicable requirements and explain the next steps or relevant exceptions. Requests are handled within applicable legal time limits. Updates to this policy will be dated above, with notice of material changes where required.