DISCLAIMER §8: document auto-delete behaviour

DISCLAIMER.md

@@ -126,6 +126,19 @@ personally-identifiable, or regulated information to a public
 deployment.** Host a private instance for any such material. See
 [`ACCEPTABLE_USE.md`](ACCEPTABLE_USE.md) §1.7.
 
+By default, the web interface deletes the uploaded source file, rendered
+page images, and intermediate artefacts from the server **as soon as the
+report is generated**. Only the verdict markdown (and its download copy)
+remains, in a session-scoped location that is pruned after the retention
+window (24 h by default). This auto-delete is on by default and can be
+disabled per-audit via the "Delete uploaded file…" checkbox in the GUI.
+It is a best-effort *operational* control on the application layer; it
+does **not** displace platform-level retention, backup, caching, or
+logging behaviour of the underlying hosting infrastructure (Hugging
+Face Spaces, browser-side caches, CDN edges, etc.). Treat the
+auto-delete as a sensible default, not as a cryptographic guarantee of
+irreversibility.
+
 ## 9. Inheritance to forks
 
 This DISCLAIMER, in unmodified form, must accompany every distribution,