As many people pointed out in the comments here, there are different expectations in this field - there is no common unwritten law about how it should work. If some people make wrong assumptions about it despite having access to the necessary information, it is really their fault. They are not the victims to be saved. If I run a deposit box, I do not offer it for free and I will empty it the moment payment stops. If I run a service with a free plan, I will keep the data as long as possible and will delete it only after economically justified period of inactivity. Contrary to the trials of paid subscriptions, free plans are not meant to be auto-deleted quickly, but since nobody pays for storage, business also cannot take obligation to keep the data of inactive accounts forever.
That said, read the T&Cs and do not assume that your understanding of „morality“ is right.
Interconnectedness of the world today is economically justified, it does not have any morality in it. In the same vein, if we would have to listen to your anti-morality point of view, we should have kept the connections as before even if we contribute to the global warming, to the deaths of many vulnerable people contributed by the rising number of viruses that are spreaded at an accelerated rate, to the number of cyberattacks that have quadrupled. Similarly to economically accessible transit around the world and its complexity, we have the Internet which is clearly becoming more and more prone to breaches exploiting vulnerabilities (log4j literally proved that everything was open for exploitation). Today, while I'm watching a random Romanian TV channel, many psychopaths at a round table are leading you to believe that Covid's risk is self inflicted by people who don't work out & are overweight and that lockdowns are unjust, it is all people's fault, that there's nothing moral in lockdowns and wearing masks, which I strongly disagree with and it is also not supported by data.
If you are triggered by my „anti-morality views“, please re-read my comments again. There are too many attempts in this thread to stretch morality over basic policy and product issues and to shape it into a personal attack on me, I’m going to stop responding to all of them.
If something can be both right and wrong depending on context, it is not guided by morality, it is guided by reason and by data. Some data retention policy can be right for some users and wrong for others. Lockdown can be appropriate solution under certain conditions and an attack to personal freedom in other cases. Neither data retention or hygiene rules are moral or immoral, because there’s no universal judgement for them. If something is highly contextual and disputed, it is better to keep morality off the discussion, otherwise consensus will never be found. It is better to use something people agree on, like human laws or laws of nature.
You have this backwards.
They do not have such legal responsibility - and you are correct that their legal responsibilities are defined by laws, T&C, etc.
However it is for them, not you, to define their moral responsibility.
I believe that if you run (something like a safe deposit box) you have a moral responsibility to (make human decisions about burning the contents).