A person can requests to delete their data at any time, and also can request to provide all the personal data collected.
It's rather hard to make any online agreement that's more lax than the law in the EU (and call it ToS)