Skip to main content

TierSphere

Data Return and Destruction Procedure

This procedure describes the default handling process when a customer agreement ends or a district requests return, deletion, or both for protected data.

1. Confirm Scope and Instruction

  • Confirm the requesting party is authorized to issue the return or deletion instruction.
  • Confirm the scope of data involved, requested export format, target delivery channel, and timing requirements.
  • Review any customer-specific agreement terms that override the default workflow below.

2. Return Data When Requested

  • An organization's admins and owners can download the organization's own records at any time, free on every plan: one ZIP file with a CSV for each kind of record (people, programs, events, attendance and hours, payments and connections to other organizations). Each person can also download a copy of their own records from their account settings.
  • Where the agreement asks for something else, prepare an export in a mutually agreed format such as CSV or JSON where technically appropriate.
  • Deliver the export through a secure channel approved by the customer.
  • Record the data sets included, export date, delivery method, and receiving contact.

3. Delete Active Customer Data

  • After confirmed return, or after a direct deletion instruction when no return is requested, TierSphere staff carry out the deletion within 30 days unless the agreement requires a different timeline. It is not a self-service button.
  • The organization is closed at once: it no longer appears anywhere in TierSphere and the people in it can no longer reach it.
  • People's personal information is erased or de-identified: names, contact details and the free text they wrote are removed, a birth date is kept only as its year, their profile photo and the files attached to their posts and questionnaire answers are deleted, and the account can no longer sign in. De-identified records that other organizations' counts rely on (for example attendance hours at another organization's event) can remain without anyone's name.
  • Records under a legal hold are kept until the hold is released, and we tell you which records a hold covers.

4. Backup Handling

  • Operational backups retained for disaster recovery are not restored for normal business use after contract termination.
  • Backup copies age out according to the normal retention cycle and are deleted in the ordinary course.

5. Completion Record

  • Record the date the request was received.
  • Record the export or deletion completion date.
  • Record the responsible operator and any exceptions.
  • Confirm completion back to the customer when required by agreement.

Related Policies

Review our Student Data Privacy and Privacy Policy pages for broader privacy commitments.