Data journey
Trace one field through six stages
Use actual configuration and provider accounts. If a stage is unknown, record it as an unresolved risk rather than filling the map with an assumption.
- 01
Collection
- Data
- Fields, files, identifiers and automatically observed device or usage data
- Purpose
- The exact user or operational need served
- Privacy risk
- Collecting more than the product needs or surprising the user
- Control
- Minimize fields, separate required from optional and explain the purpose at the relevant moment
- 02
Transmission
- Data
- Request bodies, query strings, headers and third-party SDK events
- Purpose
- Delivery to the application or a named service
- Privacy risk
- Sensitive values leak through URLs, analytics, referrers or insecure transport
- Control
- Keep sensitive values out of URLs, constrain destinations and protect transport
- 03
Storage
- Data
- Database records, files, browser storage, logs, caches and backups
- Purpose
- Current product and recovery requirements
- Privacy risk
- Unknown copies, excessive access or indefinite retention
- Control
- Inventory stores, restrict access, set retention and include backups in the policy
- 04
Use
- Data
- Profiles, content, behavioral events or derived attributes
- Purpose
- A specific feature, support task or analysis
- Privacy risk
- Data is repurposed beyond the context in which it was provided
- Control
- Limit use to documented purposes and review material changes before activation
- 05
Sharing
- Data
- Information sent to infrastructure, analytics, communication or AI providers
- Purpose
- A named processor function
- Privacy risk
- Unreviewed sub-processors, regions, training use or broad vendor permissions
- Control
- Review current terms, configuration, access and necessity before sending data
- 06
Deletion and recovery
- Data
- Primary records plus replicas, exports, queues and backups
- Purpose
- User request, retention limit or account closure
- Privacy risk
- The UI says deleted while operational copies remain usable indefinitely
- Control
- Define effective deletion, exceptions, backup aging and a verified end-to-end procedure
The prompt can also be a data transfer
Do not paste production information into a tool by default
Debugging prompts, screenshots and copied logs can contain customer content, tokens, email addresses or internal URLs. The fact that a tool is used for development does not make every production datum necessary for that purpose.
Use synthetic or minimized examples whenever possible. Define which tools are approved for which data, remove secrets before sharing and ensure the team understands current provider settings and contractual terms.
- Treat prompts, logs and screenshots as potential data flows
- Use least privilege for builders and integrations
- Keep consent, preference and deletion behavior testable
- Review vendors again when the product purpose changes
Threat model
Four privacy scenarios hidden by a working interface
These scenarios are not legal conclusions. They identify operational facts that a privacy or legal review needs.
Analytics receives form values
- Trigger
- Automatic event capture observes input or URL state
- Potential impact
- Personal or sensitive information reaches an unintended provider
- Control
- Disable broad capture, allowlist low-risk events and test actual network payloads
- Access needed
- Browser network traffic and analytics configuration
Deleted accounts persist in backups and vendors
- Trigger
- The primary record is removed without an end-to-end workflow
- Potential impact
- The organization cannot describe or execute effective deletion
- Control
- Map replicas, define backup aging and verify vendor deletion behavior
- Access needed
- Storage, backup, queue and processor procedures
Support logs expose secrets or customer content
- Trigger
- Raw requests and errors are recorded for debugging
- Potential impact
- More staff and tools can access data than the product requires
- Control
- Minimize and redact logs, bound retention and restrict access
- Access needed
- Logging code, sample production records and permissions
A new AI feature changes data purpose
- Trigger
- Existing customer content is sent to a model or used for a new analysis
- Potential impact
- User expectations, provider terms and risk profile no longer match the original flow
- Control
- Review necessity, disclosure, configuration and alternatives before launch
- Access needed
- Feature specification, provider terms and actual payloads
Applied example
Privacy map example: a newsletter form with hidden reach
The visible form asks only for an email address. The page also sends the URL, referrer, device identifiers and full form interaction to two analytics services, while server logs retain the request indefinitely.
- The visible field list describes only part of the data journey.
- Automatic collection expands the number of recipients and retention systems.
- A generic privacy notice cannot determine whether each flow is necessary or correctly configured.
- Network inspection, log review and vendor configuration are needed before the map is complete.
Plain answers
Privacy questions
Does using an AI builder automatically violate privacy law?+
No. The relevant facts include which data is processed, why, by whom, where, under which terms and controls. Obtain legal advice for applicable obligations.
Is a privacy policy enough for a small website?+
A notice describes practices; it does not create data minimization, access control, retention or deletion. The implementation must match the statement.
Can a public scanner verify privacy compliance?+
No. It may observe some delivered scripts and requests, but purposes, contracts, internal access, storage and deletion require broader evidence.