papers/hanzo-analytics-ml/sections/09-privacy-and-compliance.tex

\section{Privacy and Compliance}


\subsection{Data Minimization}

We apply data minimization principles:

\begin{itemize}
    \item PII hashed with merchant-specific salt
    \item Raw events retained for 90 days only
    \item Aggregated features retained indefinitely
    \item Model training on anonymized data
\end{itemize}

\subsection{GDPR Compliance}

\begin{itemize}
    \item Right to erasure: Customer deletion within 72 hours
    \item Data portability: Export in standard JSON format
    \item Consent management: Granular opt-in/opt-out
    \item Purpose limitation: Analytics use only
\end{itemize}