- Explain/justify why they are storing user’s personal information when asking for it.
- Explain what they’ll use the data they collect for.
- Document the user giving them consent to store their data.
- Provide all stored information (including in-house iterations) on a user, should the user ask for it, in an accessible/standard format.
- Delete all information (including backups) they have on a user, if the user requests they do so, within thirty days.















