No commercial event will ever destroy your data. Not downgrading, not a trial ending, not cancelling, not going over a plan limit.
Go over a limit and your existing records stay readable and editable — only new ones wait for an upgrade. Downgrade and the features above your tier become read-only, with all your history still there and still exportable. Cancel and you keep read access, and your export, for 90 days.
Deletion happens only when someone explicitly asks for it, and then it takes a request, a confirmation from a second person, a 30-day window you can cancel at any point, and a full export first.