docs(governance): add erasure, consent, vendor risk, and retention policies

[ustaxs]

Summary

Adds four data-protection policies under Governance/policies/, closing the governance gaps tracked in #1497, #1498, #1499, and #1500.

Policy	Closes	Covers
DATA_DELETION.md	#1497	How deletion requests are handled, timelines, verification
CONSENT_MANAGEMENT.md	#1498	What requires consent, how it is recorded, how it is withdrawn
VENDOR_RISK.md	#1499	Vetting criteria, risk tiers, review cadence
RECORD_RETENTION.md	#1500	Retention schedule, legal-hold process, disposal rules

What these documents add

Erasure as something the project can evidence. A deletion promise that cannot be evidenced is worse than no promise, so verification is treated as carefully as execution: the clock starts at receipt rather than at completed verification, so a slow identity check cannot extend the deadline; the target is 30 business days with a matching 20-day subprocessor deadline; and completion means the deleted records were queried and return nothing across every store in scope, that anonymisation was verified as irreversible rather than assumed from a missing key column, and that no copy survives in exports, backups, or caches. Two positions are stated plainly rather than left implicit: identity is verified before anything is deleted, because deleting on an unverified request is a denial-of-service attack on a real account and is harder to detect than unauthorised access; and backups are not rewritten to erase one person, because that damages the restore guarantee for everyone — the position is told to the requester instead of claimed as complete deletion. A deletion is not confirmed complete when any part is unknown; an unverifiable subsystem is stated in the confirmation and becomes a tracked follow-up.

Consent with the named failure modes. What requires consent is separated from essential processing, which is not disguised as a consent prompt. A valid request must state the purpose plainly, be freely given, be unbundled per purpose, start un-ticked, and be given by an affirmative action. A countdown that infers consent from not declining is not consent, and "Accept all" with no granular choice is treated as invalid. Records are per purpose, so withdrawing one leaves the others standing, and an unrecorded consent is treated as absent — the project does not rely on something it cannot evidence. Withdrawing must be as easy as giving: a single in-app control plus a written channel, with no penalty and confirmation that it took effect. Where consent is broadened, re-consent is required, and the old consent is not reused.

Vendor risk tiered by consequence. Ten vetting criteria each name the evidence required, with three rules that do the real work: necessity is assessed first, because not using a vendor is the safest option available; a missing answer is a finding, not a silent pass; and self-declared certifications are a starting point, since the assessment is of the service actually used. Tiers are set by consequence rather than preference — a widely used vendor handling children's data is Tier 1, and a build tool holding a repository token is Tier 1 too, because that token can write to the default branch. Every Tier 1 vendor needs a written exit position, and a vendor with no identified alternative is a finding at review rather than an accepted state.

Retention with triggers, not just periods. Every entry in the schedule names the period and the trigger that starts it, because a period without a trigger is unenforceable — a clock that starts when nothing happens never starts. Disposal is separated by method: hard delete, irreversible anonymisation, expiry, backup rotation, statutory retention in isolation, and retention in the public repository for governance records. Legal holds name the role that may issue them, require explicit scope, suspend automated deletion immediately, and are reviewed every 90 days, since a hold that is never released is a defect rather than a permanent condition. The annual review explicitly checks whether each period is still the shortest defensible one, because schedules drift longer when nobody reduces a period.

Notes for reviewers

• Boundaries with existing governance are deliberate. The Privacy Manifest stays authoritative for what is collected, Mobile Telemetry for the telemetry rules, and the Data Processing Register for the per-category records these policies operate on. DPA_TEMPLATE.md continues to set processor obligations; these documents state what the project requires and verify, not what the contract says.
• Forward references. These files link to SUPPORT.md, END_OF_LIFE.md, and COMPATIBILITY.md from docs(governance): add end-of-life, support, compatibility, and data residency policies #1550 and to REVIEW_ETIQUETTE.md from docs(governance): add office hours, review etiquette, audit, and whistleblower documents #1552. The links resolve once those land and can be dropped if you would rather each pull request stand alone.
• Enforcement status is stated in each document. The project operates no backend, so these controls are exercised through the providers in the Data Processing Register and enforced through the DPA. No deletion job exists in this repository; the verification tables are the specification an implementation must satisfy, and the documents say so rather than describing automation that is not there.
• Three positions recur deliberately across the set: a promise the project cannot evidence is worse than no promise; identity is verified before deletion; and retention periods are checked for shortening at review.
• Scope. Each issue adds exactly one new file inside Governance/. No application code, CI, or configuration is touched, and no tests are added or changed.

Closes #1497
Closes #1498
Closes #1499
Closes #1500

[drips-wave]

@ustaxs Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project