I think it should be longer than 45 days, but months and months isn't necessarily needed. How about an option to retain X records per customer? If you don't want to do that, I'd say 60 days minimum.