Examiners are starting to ask about biometric data retention from our identity verification vendor and i want to compare notes

Came up in our last exam and i get the feeling its heading for the rest of us soon. The examiner didnt care whether the identity verification was accurate. What they pushed on was how long we and the vendor hold the biometric template and the selfie, and whether our retention schedule actually matches what we promise users. Under BIPA and on the GDPR side thats real exposure, and most of the vendor contracts I've read are vague on exactly this point.

The capture and the matching are the straightforward part to assess. Retention and deletion is where the legal risk really sits, and thats the piece the vendor leaves you to define yourself.

How are others handling retention here. are you deleting as soon as the match completes or holding for a fraud window first?