[Documentation][Privacy][P2] Define PII Retention and Deletion Policy for Applications/Contacts

[AnshRaj112]

Backlog ID: ISSUE-EXS-065

Source: EXSOLVIA_GITHUB_ISSUES.md / EXSOLVIA_TECHNICAL_AUDIT.md

---

Title

[Documentation][Privacy][P2] Define PII Retention and Deletion Policy for Applications/Contacts

Type

Documentation

Repository

@EXSOLVIA-frontend

Ownership

Documentation + Security

Area

Data Privacy

Priority

P2

Severity

Medium

Labels

documentation security P2

Epic

EPIC-12 Scalability & Production Readiness

Description

No retention policy, export, or delete flow for applicant/contact PII.

Current Behavior

Data kept indefinitely.

Expected Behavior

Written retention policy + implementation issues for delete/export if required.

Why This Matters

Privacy risk and operational liability; audit says do not claim GDPR compliance.

Affected Files

• Privacy policy pages
• models Application/ContactInquiry

Affected Functions / APIs

• Future delete/export APIs

Evidence From Audit

Audit Data Privacy gaps.

Risk / Impact

Indefinite PII retention.

Recommended Direction

Policy first; then implement admin delete/export.

Acceptance Criteria

• Retention periods documented
• Deletion responsibilities assigned
• Follow-up implementation tickets filed if code changes required

Testing Requirements

• Regression test

Dependencies

• None
• Blocks: ISSUE-EXS-066

Estimated Complexity

Medium

Priority Reason

Privacy program gap.

Notes

Legal compliance not claimed by technical controls alone.