As already started, we keep it as long as necessary to perform the service, specifically from the time we get user consent to the time that consent is revoked (via api, web, or a revision signature).