It's scary that this data can be kept for years without the user being aware of it. If this data was breached it would be worse than Ashley Madison. I suggest

It's scary that this data can be kept for years without the user being aware of it. If this data was breached it would be worse than Ashley Madison. I suggest there should be laws that say users should be given the option to delete data older than x months selectable by the user. It seems obvious that sensitive data should not be kept indefinitely after following https://haveibeenpwned.com https://haveibeenpwned.com .