The 30 days thing is likely from GDPR requirements. You cannot keep user data longer than that after they request deletion.