Data Retention (Draft) RF metrics: 12 months (aggregate after 90d) Personal data (signups): explicit consent; purge on request