Last updated: April 10, 2026.
1. Overview
This policy describes how Prometheus Works LLC (“Seedling”) retains and protects personal data collected through the Seedling platform. It applies to all data subjects whose personal data is processed by Seedling, including Space owners (Curators), program participants, and platform administrators.
2. Data retention periods
| Data type | Retention period | Reason |
|---|---|---|
| Account data (name, email) | Duration of account + 90 days after deletion | Account recovery window |
| Authentication tokens (Clerk) | Managed by Clerk per their policy | Delegated to identity provider |
| Space and program content | Duration of account + 90 days after deletion | Operational continuity |
| Application data (questionnaire responses) | Duration of Space account | Program records |
| Payment records | 7 years from transaction date | Tax and accounting law; aligned with Stripe retention policy |
| Zoom OAuth tokens | Until integration is disconnected or Space account is deleted | Required for ongoing integration functionality |
| Zoom attendance data | Duration of Space account | Program attendance records |
| Google Calendar OAuth tokens | Until integration is disconnected or Space account is deleted | Required for ongoing integration functionality |
| SAI conversation messages | 30 days from last activity, then automatically deleted | Debugging and support purposes only |
| SAI event logs (DynamoDB) | 90 days | System debugging and monitoring |
| Inbound email records | 90 days | Inbox functionality |
| Session state (DynamoDB) | 30 days (TTL-based) | Active session management |
| Infrastructure logs | 90 days | Security monitoring and incident response |
3. Data protection measures
In transit: All data transmitted between users and the platform, and between the platform and third-party services, is encrypted using TLS 1.2 or above. No Zoom data or OAuth tokens are transmitted over unencrypted connections.
At rest: Personal data and OAuth tokens are stored in PostgreSQL on AWS RDS with encryption at rest enabled. DynamoDB tables storing session and event data use AWS KMS encryption in production. S3 buckets use server-side encryption.
Access controls: Application backend is the only layer with access to stored OAuth tokens and personal data. Tokens are never exposed to client-side code or logged in plaintext. Database access is restricted by VPC security groups and requires SSL.
OAuth token handling: Zoom and Google OAuth access tokens are stored encrypted and refreshed automatically server-side. Refresh tokens are rotated on each use. Tokens are deleted immediately upon integration disconnect.
4. Data deletion
Upon account deletion, the following data is deleted immediately: account profile, Space memberships, SAI conversations, active session state, and all OAuth integrations (including associated Zoom and Google tokens). Payment records are retained for the legally required 7-year period even after account deletion, in anonymized or minimized form where possible.
Users may request deletion of their data at any time by contacting dpo@prometheusworks.co.
5. Third-party data processors
Data shared with third-party processors (Stripe, Zoom, Google, Clerk, Mailjet, Anthropic, AWS) is subject to each processor’s own retention and deletion policies. Seedling does not control data retained by third-party processors beyond what is governed by our data processing agreements with them.
6. Policy review
This policy is reviewed annually or following any significant change to the platform’s data handling practices.
Contact: dpo@prometheusworks.co.