POPIA toolkit part 3: retention, breach register, readiness

- Retention policies (Admin -> Privacy -> Retention) applied by a nightly
  `retention` job: inactive accounts anonymised after 5 years with a
  30-day warning (on by default; never staff roles or people with an
  upcoming registration), form answers, login history, payer details in
  payment notifications, audit/access logs
- User.lastLoginAt (set on login, backfilled) and inactivityWarnedAt
- Breach register (SecurityBreach) with drafts for the people affected
  and the Information Regulator
- Readiness checklist with a score
- Children's/medical flag in the access log; {retention} placeholder in
  the privacy notice
- Unit tests (retention.test.js), e2e (privacy-retention.spec.ts); docs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012mt6TCv85T9VKRq3cV7rXq

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-23, after **1.39.0**. The plan itself is in
+Last updated: 2026-10-23, after **1.40.0**. The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -8,6 +8,7 @@ features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
 | Version | What |
 |---------|------|
+| 1.40.0 | POPIA toolkit part 3 — readiness checklist with score, retention policies + nightly `retention` job (inactive accounts anonymised after 5 years with a 30-day warning, on by default), breach register with notification drafts, children's/medical flag in the access log, `{retention}` in the notice |
 | 1.39.0 | POPIA toolkit part 2 — Admin → Privacy: privacy notice editor (built-in text as the start, placeholders, drafts, numbered versions, re-acceptance after login), operator register, consent log, access log; Information Officer on the contact page |
 | 1.38.0 | POPIA toolkit part 1 — Privacy page (news opt-in + history, download my data, correction and deletion requests), Event update vs News & announcements on every bulk send, unsubscribe links + one-click headers, WhatsApp STOP, one-time news question, Admin → Data requests, thorough anonymising |
 | 1.32.0 | Early-bird ribbon on event cards |
@@ -24,12 +25,7 @@ features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
 ## Next up
 
-1. **1.40.0 — POPIA toolkit part 3** (spec §3 in the roadmap, decisions table): retention
-   policies per data category + nightly job (inactive accounts anonymised after 5 years, **on by
-   default**, warning email 30 days before, never staff/supervisor/admin), breach register with
-   notification templates, children's-data flags in reports, POPIA readiness page with a score.
-   The notice's retention section should then fill in from the policies (a new placeholder).
-2. **1.41.0 + Hub v1** — install/update tooling and the Hope Events Hub (separate repo
+1. **1.41.0 + Hub v1** — install/update tooling and the Hope Events Hub (separate repo
    `joshua/hope-events-hub`).
 
 ## Working on this repo
@@ -144,7 +140,14 @@ features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 - Access log: `utils/accessLog.js` (`logDataAccess(req, { action, what, eventId, records })`).
   **Any new bulk export or list of personal data should call it** and get a label in
   `ACCESS_ACTIONS`. Operators: `Operator` table, seeded in the 1.39.0 migration.
-- e2e: `privacy-notice.spec.ts` publishes a version that needs accepting, then accepts it for all
+- Retention: `utils/retention.js` (policies in AppSetting `retention_policies`, `runRetention`,
+  `preview`, `noticeLines` for `{retention}`), job `retention` (03:30). **Anything new that
+  stores personal data should get a retention rule** (a new entry in `POLICIES` + runner).
+  Inactive = latest of `User.createdAt`, `lastLoginAt` (set on login), registrations/event end,
+  attendee rows, payments. Readiness: `utils/readiness.js`. Breaches: `SecurityBreach`.
+  Admin panels: `components/admin/privacy/{Readiness,Retention,Breaches}Panel.tsx`.
+- e2e: `privacy-retention.spec.ts` runs the retention job on seeded six-year-old accounts
+  (`prepare-db.js` → `retention`); `privacy-notice.spec.ts` publishes a version that needs accepting, then accepts it for all
   seeded users in `afterAll` so later spec files don't meet the prompt.
 
 ## Known gaps / follow-ups