Regulations such as the GDPR call for you to possess a lawful basis for amassing own details from a end users, and you have to make clear just as much in the privacy policy. based on the GDPR, data retention should not exceed the required time with the applications it absolutely was at first acquired for. Detailing the safety measures in place to