Right-to-erasure under GDPR Article 17 says we have to delete your data when you ask. It doesn't say we have to delete it the second you click the button — and almost every user who clicks that button has a moment, three days later, where they realize they wanted one specific invoice they forgot to export. Today InvoiceUp gives you a 30-day grace period before the cascade fires, plus a real purge across every store the moment it does.
Most SaaS account deletes hit the user record and stop. The orphaned data — invoices, attachments, audit-trail entries, share-link tokens, sanctions cache, weekly digest queue — sits in the database forever, technically deletable but not actually deleted. We swept all of it. The cascade now covers audit-trail, share-link tokens, sanctions screening cache, weekly digests, and — the one most apps quietly miss — every PDF and attachment your account ever uploaded to Vercel Blob storage. Gone means gone.
Zero days is what most regulators ask for and what most users regret within seventy-two hours. Ninety days is what most enterprise tools default to and what makes your erasure request feel like it didn't happen. Thirty days lines up with the GDPR Article 12(3) response window we already operate against, leaves room for honest mistakes, and is short enough that no auditor reads it as a delay tactic. You can also fire it immediately if you really want — the grace period is the default, not a wall.
Compliance done right doesn't mean fastest possible delete. It means the user actually got what they asked for, with a brief window to change their mind.
Open Settings → Account → Delete and the new flow walks through what's about to leave: profile, invoices, clients, attachments, audit log, every share link you minted. We send a confirmation email when the cascade actually fires — not when you clicked the button, but when the data is gone — so there's no ambiguity about state. Until that email lands, one click in your account undoes the whole thing.
This is the unglamorous compliance work that doesn't market well and matters anyway. Every Dekimu app gets the same shape; InvoiceUp went first because it touches the most stores. miniterms and the Hub follow on the same pattern over the next two weeks.