Privacy and data retention
Last updated: September 2026
Who processes your data?
Wana Lab is the data controller for your training data. All data is hosted in the European Union.
What data and why?
- Training tracking (basis: contract) — progress, scores, certificates.
- Email reminders (basis: consent) — can be turned off at any time.
- Anonymized analytics (basis: consent).
- Answers to practical exercises are corrected on our servers, without being sent to any AI service, and are never used to train AI models.
Retention periods
| Learner account (name, email) | Account lifetime + 3 months |
| Progress, scores, attempts | Account lifetime + 12 months |
| Answers and prompts entered in practical exercises | 90 days, then automatically erased (GDPR data minimisation, Art. 5) |
| Certificates (verification data) | 5 years |
| Billing data | 10 years (legal obligation) |
| Technical logs | 12 months |
On expiry, data is irreversibly deleted or anonymized.
The texts (prompts) you type in labs may contain personal data. Under the GDPR data-minimisation principle, they are automatically erased every day once they are older than 90 days. Only the exercise score and date are kept.
Your rights
Access, rectification, erasure, portability, objection and consent withdrawal. From your dashboard, you can export your data (JSON) or delete it. For any other request: dpo@wanalab.eu. You may also contact your national data protection authority.