Data controller / processor: OMNIA Inclusion Ltd (registered in England & Wales, company no. 17228173). Registered office: 169 High Street, Marske-by-the-Sea, Redcar & Cleveland, TS11 7LN, United Kingdom.
Version: 1.1 Last reviewed: 2026-06-01
OMNIA enforces these retention windows automatically via a daily retention
sweep (/api/public/hooks/retention-sweep, scheduled by pg_cron at 02:00 UTC).
A summary row is written to system_audit_logs after every run.
| Data | Retention | Trigger | Rationale |
|---|---|---|---|
Pupil record (students) | While on roll + 7 years after leaving | Manual erasure or DSAR | KHDA / Ofsted SEND record-keeping guidance |
Inclusion plans (plans) | Same as pupil record | Cascade with pupil | Statutory SEND record |
PEEPs (peeps) | Same as pupil record | Cascade with pupil | Health & safety record |
Referrals (referrals) | Same as pupil record | Cascade with pupil | Safeguarding audit |
Parent voice — pending (parent_voice_requests) | 30 days from creation | Token expiry | Limit attack surface |
| Parent voice — submitted / expired / revoked | 365 days | Daily sweep | Long enough to merge into next plan cycle |
Plan share-link views (plan_share_views) | 180 days | Daily sweep | Audit window for "who saw what" |
Plan share links (plan_share_links) | While not revoked + linked to pupil retention | Manual / cascade | Allows re-issue |
Audit log (audit_logs) | 730 days | Daily sweep | KHDA inspection cycle (2 yrs) |
System audit log (system_audit_logs) | Indefinite | — | Tamper-evident operational log |
| Pupil photos (Storage) | Same as pupil record | Cascade with pupil | — |
Discovered SharePoint files (pupil_discovered_files) | While pupil on roll | Cascade with pupil | Index only — original lives in SharePoint |
Available interventions (available_interventions) | Duration of subscription + 90 days after termination | Manual deletion or subscription termination cascade | School-configured intervention register including staff names as personal data |
Assessment import scores (student_assessments) | Duration of subscription | Manual erasure or pupil/subscription cascade | Scores from GL, Lexia, Nessy, Sparx, Doodle, and other platforms. Raw import files are not retained after processing. |
Plan target rationale (plan_targets.rationale) | Same as parent plan record | Cascade with plan | AI-generated contextual rationale per target. Permanently stored as professional accountability record. Visible to SENDCo and above only. |
Demo access codes (demo_access_codes) | 10 days from generation (automatic expiry) | Automatic; manual revocation available | Not pupil data. Redemption tracking logs retained 90 days. |
Contact form submissions (contact_submissions) | 2 years from submission | Manual deletion by superadmin | Enquiry data from landing site. Not pupil data. |
| Lexia demographic fields (DOB, gender, race from Lexia CSV) | Zero — stripped immediately on import, never stored | Server-side on import | PII stripping enforced in Edge Function before any database write. |
Right to erasure
Erasure on parent / pupil request is performed via the Erase pupil record admin action on the pupil page. This bypasses the schedule above and removes the data immediately, leaving an audit trail row containing the reason.
Retention sweep details
Implemented in src/routes/api/public/hooks/retention-sweep.ts. The endpoint
is gated by the CRON_SECRET bearer token. The pg_cron job is registered
separately via the Supabase data tools.
AI prompt / response retention
- Standard mode (Lovable AI Gateway): OMNIA does not persist prompts or responses beyond the request lifecycle. Upstream model providers may retain text that has passed through OMNIA's PII scrubber (best-effort, not a guarantee of full de-identification — see DPIA) per their own published retention policy; OMNIA's upstream agreement excludes use of school data for model training.
- BYOK mode (opt-in, available to every school): prompts and responses are governed by the school's direct relationship with its chosen AI provider (Anthropic or Azure OpenAI). OMNIA holds no copy. The school controls retention and any opt-outs through its provider console.