Map the personal data your app collects

• Your app collects anything that identifies a person: email, name, phone, account IDs, IP addresses, device IDs, payment details, location, uploaded files or messages.
• You're about to write or update a privacy notice, answer a customer's security questionnaire, or respond to a data request.

• Every privacy law expects your privacy notice to match what the product actually does. You can't write an honest notice, delete someone's data on request, or answer 'what do you hold about me?' without a map.
• GDPR Art. 30 requires a record of processing activities. Businesses under 250 people are exempt only if the processing is occasional, low-risk and avoids sensitive data, which rarely fits an app that processes user data every day.
• The map is also your first line of defence in a breach: you'll know whose data was where.

• Access to the codebase, including environment variables (names only) and database migrations.
• A list of the services you've signed up for (payments, email, analytics, AI, hosting, error tracking).

Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.

Read this codebase and build a map of the personal data it handles. Don't change any code.

LOOK EVERYWHERE PERSONAL DATA CAN GO
- Forms, sign-up and sign-in (including social login profile fields)
- Database tables and columns (read the migrations and schema)
- File and image uploads and where they're stored
- API routes, server functions and webhooks that receive or send user data
- Third-party SDKs and API calls: payments, email, SMS, analytics, error tracking (Sentry and similar often capture user data), AI models (prompts that include user content), maps, chat widgets
- Analytics events: flag any event that includes an email, name or free text
- Logs: flag console.log or logger calls that print user data
- Cookies and local storage

PRODUCE ONE TABLE with a row per piece of personal data and these columns:
- Data (for example email, IP address, card details, uploaded photos, chat messages)
- Whose data (users, visitors, their customers, employees)
- Where it's collected (file and line)
- Why it's used (sign-in, billing, support, analytics, product feature)
- Where it's stored (table.column, bucket, or service)
- Who receives it (every third party, with the service's name)
- Country it's processed in, if the code or config shows it (for example a region setting); otherwise "check"
- How long it's kept, or "no deletion found"
- Can the person see, export or delete it in the app? (yes / no / partly)

THEN LIST
1. Sensitive data: health, sex life or orientation, religion, political views, biometrics, precise location, government IDs, financial account details, children's data.
2. Data collected but never used.
3. Personal data written to logs or analytics events.
4. Third parties that receive personal data, as a short list with what each receives.

Mark anything you're unsure of as "check" rather than guessing. Output the table as Markdown and also as CSV so I can paste it into a spreadsheet.

• Forgetting error trackers, logs and analytics events, which often capture emails and free text.
• Leaving out AI providers that receive user prompts or uploaded content.
• Listing 'Supabase' or 'AWS' as the only recipient and missing the services wired in later.
• Treating IP addresses and device IDs as not personal: under the GDPR they usually are.

1. 1Click through every form in the app: each field appears in the table.
2. 2Compare the 'Who receives it' column with package.json dependencies and your environment variable names: every service that touches user data is listed.
3. 3Compare the table with your privacy notice line by line. Anything in the table but not in the notice needs adding; anything in the notice but not in the table should be checked or removed.
4. 4Pick one test user and trace their data through the table: you should be able to say exactly where it all lives.

• GDPR (Regulation (EU) 2016/679)

General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.