Hey there, you only half answered the original question from the user called 'Secure'. The following points were raised by them but never addressed:

Data deletion ... if data is deleted, is it permanent? How long are backups retained?

GDPR ... UK GDPR and HK's PDPO are not the same thing. Do you offer a UK GDPR-compliant Data Processing Agreement (DPA)?

Subprocessors ... AWS is mentioned but who else touches the data? Full list please.

Security certifications ... SOC 2 Type II, ISO 27001? Any independent audits? If not, is there a roadmap?

Breach notification ... what's the notification timeline if there's a breach? Is there a formal incident response policy?

Looking forward to your answers on these.