In Europe at least it would probably be a violation of GDPR to not actually delete it on request of the user if it is considered personal data.