You need financial data of course, but you don't need a record stating I logged in 2 years and 5 months ago at 09:15 in the morning from an iPhone 8 from IP xxx

You need financial data of course, but you don't need a record stating I logged in 2 years and 5 months ago at 09:15 in the morning from an iPhone 8 from IP xxx.xxx.xxx.xxx and used your app for 12 minutes, I have every right to request you to delete that information as it is not necessary for legal defense (chargebacks) or lawful. You might be non-compliant by keeping that information actually.