Update: There is no such guarantee. Cloudflare does label some providers as ZDR. Others are non-ZDR (such as Exa). Cloudflare itself may be retaining request and response data.
I had “[allegedly] ‘some guy’” in mind but maybe some ZDR promise from a megacorp would theoretically be just as good or better.