How long can I legally store abandoned cart data?

As a Shopify store owner, I'm constantly walking a tightrope between collecting valuable customer data and respecting privacy regulations. Recently, I've been concerned about how long I can legally retain information from abandoned carts. Our marketing team wants to use this data for retargeting and recovery campaigns, but I'm worried about potential legal risks. We're collecting email addresses, product details, and browsing behavior when customers start but don't complete a purchase. With regulations like GDPR in Europe and CCPA in California becoming increasingly strict, I need clarity on what's permissible. I can't afford a potential fine or legal challenge, but I also don't want to miss out on recovering potentially significant revenue from abandoned carts. My current process involves capturing customer emails and browsing behavior, and I want to ensure our data retention strategy is both compliant and strategically sound. Understanding the legal boundaries will help me design more effective remarketing strategies while maintaining customer trust and avoiding potential regulatory pitfalls.