Consider the following statements regarding the Aadhaar scheme, as settled by the Supreme Court in the Puttaswamy judgment and the Aadhaar Act:

1. Aadhaar related metadata may be retained by a requesting agency for a maximum of three months.

2. The State cannot enter into any contract with a private corporation that would allow sharing of an individual's Aadhaar data with that corporation.

3. Producing an Aadhaar number is mandatory for purchasing an insurance policy.

4. Aadhaar can be made mandatory for availing a benefit or subsidy that is funded from the Consolidated Fund of India.

Which of the statements given above are correct?