The referenced write-up based on the Persona front end code is here: https://vmfunc.re/blog/persona I definitely recommend reading this primary source before drawing conclusions about the code as most of the secondary reporting is quite low quality.
The differences in proclaimed data retention periods is concerning though. The rest is par for the course for KYC/AML.