Principles
- Minimise; keep only as long as necessary; securely delete or anonymise.
Schedule (summary)
- Account data: active + 24 months.
- Verification outcomes/metadata: 24 months from last verification.
- Photo proofs/liveness: up to 6 months (longer only if dispute).
- Logs and security events: 12 months.
- Cookie consent records: 24 months.