Hacker News Reader

The 30 day figure is likely derived from the legal limit under GDPR for a Subject Access Request (one calendar month).

Why commit to a tighter SLA than you legally have to?

Exactly. I’d be surprised if it actually takes 30 days, but there’s no point to them quoting something faster.