A conversation is deleted after a privacy request. Which assumption should an operator avoid?

1. Assuming conversation lifecycle controls matter
2. Checking project retention configuration
3. Auditing external logs for retained sensitive content
4. Assuming every separately stored file, vector-store item, or external copy is automatically removed