• Cataloguing requires explicit user consent before any job is prepared.
• Library processing requires an active or trial license before any job is prepared.
• Browser-saved libraries, Drive batches, SSH profiles, credits, and downloads remain in this browser until cleared.
• Uploaded sources, extracted images, manifests, OCR text, QA reports, and generated MARC files expire from production storage after 30 days unless extended.
• Completed downloads expire after 90 days unless attached to an active project or exported by the user.
• Credit ledgers, invoice references, and audit events are retained for 7 years for financial and operational traceability.
• Public quota keys use hashed IP/day records and expire after 32 days.
• Users can export work before deletion and request deletion of library profiles, uploaded sources, generated outputs, and saved batches.

Current Controls

• Use the Clear buttons in Libraries, Settings, and Downloads to remove browser-local data.
• Connector secrets are not stored in the browser prototype.
• Production requires server-side expiry jobs, deletion audit events, backup expiry, and per-organization retention settings before hosting real client data.