Data Deletion & Retention Policy

1. Scope

Grace Unworthy Ministries, LLC ("we," "our," or "us") operates multiple web properties and services. This document applies to the properties listed in our Covered Properties notice, which is incorporated by reference.

This policy explains how to ask us to delete your personal information or your account, what we can delete, what we must keep, and how long the process takes. It supplements our Privacy Policy and applies across all of our properties and services, including The Story Haven and its mobile applications.

This policy describes what our systems support today. Where a data protection law such as the GDPR, the CCPA/CPRA, or a similar state privacy law gives you additional rights, we honor those rights within the statutory deadlines described in Section 11.

2. How to Submit a Deletion Request

Please include the following so we can locate your records:

• Your full name as it appears on the account
• The email address associated with the account, sent from that address where possible
• The sign-in method you use (email and password, Google, Apple, Facebook, or another provider)
• Which services the request covers, or a statement that it covers all of our services
• Whether you want a copy of your data before deletion (see Section 9)
• A statement confirming that you understand deletion is permanent and cannot be reversed once completed

If you are submitting a request as an authorized agent on behalf of another person, tell us so in your message and be prepared to provide proof of your authority and the account holder's verification.

3. Identity Verification

To protect account holders, we verify identity before deleting anything. Verification is proportionate to the sensitivity of the data and generally involves one or more of the following:

• Confirming that the request comes from, or can be confirmed at, the email address on the account
• Asking you to confirm details we already hold, such as the approximate account creation date or a recent order
• Where you no longer control the account email, asking for additional information sufficient to establish that the account is yours

If we cannot verify your identity to a reasonable degree of certainty, we will tell you and will not delete the account. Verification typically adds one to three business days to the process.

4. What We Can Delete

On a verified request, we can delete or irreversibly de-identify the following, subject to the retention rules in Sections 5 and 6:

• Profile and account information: your name, display name, profile photo, bio, mailing address, phone number, and stored preferences
• Credentials and linked identities: your password hash, session and refresh tokens, and social sign-in identifiers linking your account to Google, Apple, Facebook, or another provider
• The Story Haven content: your posts, comments, reactions, follows, group memberships, direct messages, uploaded images and audio, and related community activity
• Learning data: course progress, lesson and step completion, quiz and assessment responses, and achievement records
• Marketing and contact records: newsletter subscriptions, drip sequence enrollments, SMS opt-ins, and inbox or CRM contact records, other than the suppression record described in Section 5
• Device tokens: push notification tokens for mobile and web devices
• Support correspondence: support tickets and message history, other than records we must keep for a dispute or legal obligation

Copies present in encrypted database backups are removed on our normal backup rotation rather than immediately. See Section 7.

5. What We Retain

In addition, we may retain:

• Suppression records: a minimal record of your email address or phone number on our do-not-contact list, so that we can honor your opt-out and avoid contacting you again
• Safety and abuse records: records of policy violations, bans, fraud, or abusive behavior, so that the conduct is not simply reset by deleting and re-creating an account
• Legal hold material: data relevant to an actual or reasonably anticipated legal claim, investigation, or regulatory matter, for as long as the matter requires
• Aggregated and de-identified data: statistics and analytics that no longer identify you and are not re-identified
• Content of shared conversations: messages you sent to another member may remain visible in that member's copy of the conversation, and content others have quoted or replied to may persist in their posts
• Third-party provider records: records independently retained by providers such as our payment processor or email delivery provider under their own legal obligations

6. Consequences of Deletion

• You will lose access to all courses, digital content, and downloads associated with the account, including content you purchased
• Course progress, assessment results, achievements, and certificates will be lost
• Store credits, points, and any promotional balances will be forfeited and have no cash value
• Your Story Haven profile, posts, comments, and messages will be removed from the community
• Active subscriptions will be cancelled. Cancellation is governed by our Refunds & Cancellations Policy, and we do not guarantee a refund for the unused portion of a billing period. If you want to request a refund, do so before submitting a deletion request.
• If you wish to use our services again in the future, you will need to register a new account from scratch

We do not currently offer a self-service deactivation or "pause" option as an alternative to deletion. If you simply want to stop hearing from us, you can unsubscribe from our emails, reply STOP to our texts, or ask us at [email protected] to stop contacting you, without deleting your account.

7. Timeline

Once we receive your request, our process generally runs as follows:

• Acknowledgement: we confirm receipt of your request, typically within one to five business days
• Verification: we verify your identity, which usually takes another one to three business days
• Deletion from primary systems: we delete eligible data from our production databases and application storage within thirty (30) days of verification, where technically feasible. If a request is unusually complex, we will tell you and may extend this period as permitted by applicable law.
• Media and file storage: uploaded images, audio, and documents held with our storage and media providers are removed as part of the same process, though cached copies at content delivery edges may take additional time to expire
• Backups: encrypted database backups are purged on their normal rotation, generally within ninety (90) days. We do not restore a backup solely to remove an individual record; if a backup is restored for disaster recovery before it rotates out, we re-apply completed deletions.

We will confirm by email once deletion from our primary systems is complete.

8. Cancelling a Deletion Request

You may cancel a pending request by emailing [email protected] from the same address you used to submit it, before we complete the deletion. Once deletion has been carried out, it cannot be reversed, and we will not be able to restore your account or content. If you are unsure whether your request has already been processed, contact us and we will tell you its status.

9. Requesting a Copy of Your Data

You may ask us for a copy of the personal information associated with your account before requesting deletion, or independently of any deletion request. Email [email protected] with "Data Export Request" in the subject line.

• Exports are prepared by our team on request. We do not currently offer a self-service data download portal.
• We provide a reasonable export of the account data we hold, typically in a structured, machine-readable format such as JSON or CSV
• We verify your identity for an export request using the same process described in Section 3
• We do not include information that would reveal another person's personal data, or material we are prohibited from disclosing

We recommend requesting and reviewing an export before asking us to delete your account.

10. Third-Party and Social Login Data

Deleting your account with us removes the connection between your account and any social sign-in provider you used, but it does not delete data held by that provider. If you signed in with Google, Apple, Facebook, or another service, you must contact that provider separately to review or remove data held on their side, and to revoke our application's access from your account there.

Similarly, our service providers — including our payment processor, email delivery provider, SMS provider, and error monitoring provider — may retain records independently under their own retention schedules and legal obligations. We instruct providers to delete data where we are able to do so, but we do not control their independent retention. See our Privacy Policy for the categories of providers we use.

11. Response Times & Statutory Deadlines

We aim to acknowledge every privacy request within one to five business days. Where a data protection law sets a specific deadline for responding to a rights request, we meet that deadline:

• CCPA/CPRA and comparable U.S. state laws: we confirm receipt within ten (10) business days and respond substantively within forty-five (45) days, with one additional forty-five (45) day extension where reasonably necessary and where we notify you of the extension
• GDPR and UK GDPR: we respond within one (1) month, extendable by up to two (2) further months for complex or numerous requests, with notice to you — see our GDPR & UK GDPR Privacy Notice for the full rights and transfer notice
• Other jurisdictions: we respond within the period required by the applicable law

We do not charge a fee for a reasonable request. We may decline or charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive, and we will explain our reasoning if we do. You may also have a right to appeal a denial or to complain to your supervisory authority.

12. Related Policies

• Privacy Policy — what we collect, why, and how long we keep it
• GDPR & UK GDPR Privacy Notice — EU, UK, and Swiss data protection rights and transfers
• Refunds & Cancellations Policy — cancellations, refunds, and auto-renewal
• Security Policy — how we protect data in our systems
• The Story Haven Community Guidelines — content and moderation on The Story Haven
• Terms of Service — the agreement governing your use of our services

13. Changes to This Policy

We may update this policy as our systems and legal obligations change. Material changes will be reflected in the "Last Updated" date shown at the top of this page.

14. Contact

To submit a deletion or export request, or to ask a question about this policy, contact our privacy team: