Great points!

I would like to add another point-

We should also consider how our implementation will follow privacy rules and regulations that apply to the business. GDPR, for example.