Tech giant said it would delete entries for locations deemed ‘personal’ or sensitive, but 18 months later, it’s still retaining data in some cases