Privacy & data retention (review draft)