Full data export (JSON / CSV). 30-day soft-delete with restore window. Per-data-class delete (events / hangar / sharing / org memberships). On user deletion, aggregate stats recompute so org-level num