◇ Could this help me?
Yes. The underlying point is sound and rarely stated: an app that works is not the same as a business that is protected, and the three gaps named are real ones that builders discover only after an incident. Treat the specific dollar figures and legal characterizations as one practitioner's summary rather than as advice, since insurance terms and privacy obligations vary by jurisdiction and by what the product actually does, and confirm the specifics with a qualified professional. The engineering half, building deletion into the data model before it is requested, is worth acting on immediately. This is a general practice.
Review this application and produce two lists. First, an inventory of every category of personal data it collects, where each is stored, how long it is retained, and whether a complete deletion is technically possible today, including copies in backups, logs, and third-party services. Second, a plain-language summary of what the privacy policy would have to say to match that inventory honestly. Flag every mismatch between the two.