The European regulation on personal data. It requires a lawful basis for collecting data, limits on what is collected and how long it is kept, and gives people the right to access, correct, and delete their data.
It applies to anyone serving European users regardless of where the company is registered, and the obligations are architectural: deletion and export have to be built, and cannot be improvised when the first request arrives.
We collect only the fields with a stated purpose, implement export and deletion as real features, place consent before any non-essential tracking, and keep a record of what is stored where and for how long.