Since a few years ago, I delete all user data upon request and after confirming identity.

For #ipregistry, upon account deletion, I store a hash of the email address along with the number of API credits remaining on the account. This ensures that if a new account is created with the same email address, the number of credits is restored.

Regarding chargebacks, in my case, they are rare and not worth spending much time on for now.