Privacy Guideline

Privacy and data protection - GDPR, CCPA, consent. Use when handling user data.

Privacy Guideline

Tech Stack

  • Analytics: PostHog
  • Email: Resend
  • Tag Management: GTM (marketing only)
  • Observability: Sentry

Non-Negotiables

  • Analytics and marketing must not fire before user consent
  • PII must not leak into logs, Sentry, PostHog, or third-party services
  • Account deletion must propagate to all third-party processors
  • Marketing tags (GTM, Google Ads) must not load without consent
  • Conversion tracking must be server-truth aligned, idempotent, and deduplicated

Context

Privacy isn't just compliance — it's trust. Users share data expecting it to be handled responsibly. Every log line, every analytics event, every third-party integration is a potential privacy leak.

The review should verify that actual behavior matches stated policy. If the privacy policy says "we don't track without consent," does the code actually enforce that? Mismatches are not just bugs — they're trust violations.

Driving Questions

  • Does the consent implementation actually block tracking, or just record preference?
  • Where does PII leak that we haven't noticed?
  • If a user requests data deletion, what actually gets deleted vs. retained?
  • Does the privacy policy accurately reflect what the code actually does?
  • How would we handle a GDPR data subject access request today?
  • What data are we collecting that we don't actually need?

Added: September 23, 2026 · Last updated: September 24, 2026

View on GitHubDownload

Files (1)

Jurisdiction
General
Practice area
Data protection
License
MIT
Author
SylphxAI
Source
general/data-protection/skills/privacy

Test Privacy Guideline

Ask a legal question — get an answer generated live from this skill’s instructions.

Sign in to test this skill.

Related skills

개인정보처리방침 생성기

MITGeneralData protection

데이터 유형, 관할권, GDPR 및 컴플라이언스 고려사항, 법률 검토가 필요한 조항을 다루는 상세한 개인정보처리방침을 초안 작성합니다. 개인정보처리방침 작성, 데이터 보호 문서 업데이트, 또는 컴플라이언스 준비 시 사용하세요.

$privacy-legal:dpa-review

Apache-2.0GeneralData protection

Review a Data Processing Agreement against your DPA playbook — auto-detects whether you're processor or controller and applies the right half of the playbook. Use when the user says "review this DPA", "check this data processing addendum", "customer sent their DPA", "is this DPA okay", or attaches a DPA.

$privacy-legal:dsar-response

Apache-2.0GeneralData protection

Walk through a Data Subject Access Request (or deletion, portability, correction request) and draft the response — verify identity, locate data system-by-system, assess exemptions, draft the acknowledgment and substantive response letters. Use when a DSAR comes in, the user pastes an access/deletion/portability/correction request, or says "DSAR came in", "access request", "right to be forgotten", or "someone wants their data".

AI Vendor Privacy Due Diligence

Apache-2.0GeneralData protection

Determines controller-processor relationships for AI services and conducts privacy due diligence. Covers SaaS AI (processor), embedded AI (joint controller), API-based AI (assessment framework), and vendor risk assessment. Keywords: AI vendor, controller-processor, due diligence, SaaS AI, joint controller, Art. 28.

Anonymization as Retention Alternative

Apache-2.0GeneralData protection

Evaluates anonymization as a retention alternative under GDPR Recital 26, applying the WP29 Opinion 05/2014 techniques including randomization and generalization. Validates anonymization effectiveness using k-anonymity, l-diversity, and t-closeness metrics. Activate for anonymization, de-identification, k-anonymity, retention alternative queries.

Applying Privacy Design Patterns

Apache-2.0GeneralData protection

Systematic application of the eight privacy design patterns per Hoepman: minimize, hide, separate, abstract, inform, control, enforce, and demonstrate. Covers pattern selection methodology per processing activity, mapping to GDPR principles, and practical implementation guidance for privacy-by-design system architecture.

Privacy Guideline · ThomasMore AI