RETENTION — recycle bin / recovery vault

Soft-delete is 30 days visible, then 30 days backend-only vault. Empty moves to vault (does not bypass retention). Recovery restore needs MFA + dual approval. Legal holds override TTL. Final purge shreds wrapped DEKs; vault is never client-readable.

Retention matrix

Sensitive categories

Religious declarations, photographs, location, church and contact data are primary modules — align retention with Privacy Notice, consent versions and country law (e.g. India DPDP, Nigeria NDPR).

Data categoryRetentionAction on expiryBasis