> how long they keep it

AFAIR it is not clear, because they write it is "30 days, but ...":

> After 30 days, the data is deleted automatically, except in the rare cases where it's part of a safety investigation or we're legally required to keep it.

So you have a vague clause saying "when" and vague clause saying for "how long". If it will fly I would be surprised.

This is all pretty standard with GDPR.