telo3-ai 5.0.7 → 6.2.0

package/references/privacy-compliance.md

@@ -1,494 +1,118 @@
-# Privacy & Data Protection Compliance
+# Privacy & Data Protection
+**Load when:** collecting personal data, or adding analytics, cookies, fonts/CDNs, third-party services, session replay, children's access, retention/deletion, or privacy-policy work.
 
-> Guidelines for identifying and addressing privacy considerations. This is NOT legal advice—verify requirements with qualified counsel.
+Engineering guidance, not legal advice. Privacy laws vary by jurisdiction and change over time; verify current requirements with qualified legal/privacy counsel. Never fabricate compliance claims.
 
----
+## Principles
 
-## Core Privacy Principles
+1. Data minimization — collect only what's needed
+2. Transparency — be clear about data practices
+3. User control — give users control over their data
+4. Security — protect data appropriately
+5. Accountability — document decisions and practices
 
-1. **Data Minimization** — Collect only what's needed
-2. **Transparency** — Be clear about data practices
-3. **User Control** — Give users control over their data
-4. **Security** — Protect data appropriately
-5. **Accountability** — Document decisions and practices
+## Data-Mapping Audit
 
----
+1. **Inventory collection:** account info (email, name, password), profiles, user-generated content, usage data (pages/features), technical data (IP, browser, device), location, analytics, cookies.
+2. **Record purpose per type:** service operation, UX improvement, analytics/insights, marketing/communication, legal/compliance.
+3. **List third-party recipients:** auth (Auth0, Clerk), analytics (Google Analytics, Plausible), error tracking (Sentry), email (SendGrid, Resend), payments (Stripe), hosting (Vercel, AWS), CDNs/external resources, session replay (FullStory, LogRocket).
+4. **Classify sensitivity:**
+   - High (extra care): children's, health, financial, biometric, precise location, authentication credentials, private communications.
+   - Medium: email addresses, names, IP addresses, usage patterns, non-precise location.
+   - Low: anonymous aggregate statistics, public information.
 
-## Privacy Audit Framework
+## Safeguards
 
-### Step 1: Identify Data Collection
+### Children's Privacy (e.g., COPPA, U.S.)
+- Determine minimum age; implement age verification and parental consent where legally required; minimize and document children's data.
+- Never knowingly collect children's data in violation of applicable law; never assume all users are adults; never ignore children's privacy laws.
+- Record: minimum age (or "no restriction"), age verification, children's data collected (or "none knowingly"), parental consent status, applicable laws. Legal review needed.
 
-**What data is collected?**
-- Account information (email, name, password)
-- Profile information
-- User-generated content
-- Usage data (pages visited, features used)
-- Technical data (IP address, browser, device)
-- Location data
-- Analytics data
-- Cookie data
+### External Fonts & Resources
+- Risk: third-party requests disclose visitor IP addresses and referrers. Audit Google Fonts (fonts.googleapis.com, fonts.gstatic.com), Adobe Fonts, Font Awesome CDN, external CSS/JS, third-party images.
+- Prefer self-hosting (check licensing for self-hosting) or system font stacks (no external request).
+- Document unavoidable third-party requests: CDNs, scripts, and who receives IP addresses.
+- Never claim external fonts are universally illegal.
 
-### Step 2: Identify Purpose
+### Session Replay (FullStory, LogRocket, Hotjar, Microsoft Clarity)
+- Risks: records user interactions, may capture sensitive input, may record across sessions, shares data with the provider.
+- Mask password fields, payment information, sensitive personal data (SSN, health info); exclude authentication secrets; configure provider privacy settings appropriately.
+- Never enable invasive recording by default, record sensitive inputs, ignore provider privacy settings, or assume consent is not required.
+- Determine whether consent is required; disclose in privacy policy.
+- Record: tool, what is recorded, masking/exclusions, consent status, policy disclosure. Legal review needed.
 
-**Why is each type collected?**
-- Essential for service operation
-- Improve user experience
-- Analytics and insights
-- Marketing and communication
-- Legal/compliance requirements
+### Analytics & Tracking
+- Scope: page analytics (views, referrers), event tracking, user identification, cross-site tracking, advertising tracking.
+- Prefer privacy-friendly: Plausible (no cookies, no personal data), Simple Analytics, Fathom, self-hosted Matomo (configured appropriately).
+- Higher risk: Google Analytics (especially Universal Analytics), Facebook Pixel, third-party advertising trackers.
+- Apply: cookie consent (GDPR, ePrivacy), optional Do Not Track respect, opt-out mechanisms, data retention limits, IP anonymization.
+- Record: tools, data collected, personal data (yes/no), cookies used, consent mechanism, policy disclosure.
 
-### Step 3: Identify Third-Party Sharing
+### Cookies & Local Storage
+- Audit: essential cookies (authentication, security), analytics cookies, marketing cookies, third-party cookies, LocalStorage, SessionStorage.
+- Categories: strictly necessary / functional / analytics / advertising-marketing.
+- EU/EEA: consent required for non-essential cookies (GDPR/ePrivacy); other jurisdictions vary — verify.
+- Record: each cookie/storage item with purpose and consent requirement; consent mechanism; cookie policy status.
 
-**What services receive data?**
-- Authentication providers (Auth0, Clerk, etc.)
-- Analytics (Google Analytics, Plausible, etc.)
-- Error tracking (Sentry, etc.)
-- Email services (SendGrid, Resend, etc.)
-- Payment processors (Stripe, etc.)
-- Hosting providers (Vercel, AWS, etc.)
-- CDNs and external resources
-- Session replay tools (FullStory, LogRocket, etc.)
+### Retention & Deletion
+- Define and document retention periods (account data, usage logs, backups); justify each duration; auto-delete old data where appropriate.
+- Provide user-initiated account deletion; document the process and what happens to data.
+- State whether erasure is immediate or scheduled (within X days) and how backups are handled (excluded from future backups or retained until backup expiry).
 
-### Step 4: Assess Privacy Sensitivity
+### Data Security
+- HTTPS in transit; encryption at rest (database); access controls (authentication, authorization); no hardcoded secrets; secure session management; input validation; output encoding.
+- Detailed controls: see `security-quality.md`.
 
-**High sensitivity (extra care needed):**
-- Children's information
-- Health information
-- Financial information
-- Biometric data
-- Precise location
-- Authentication credentials
-- Private communications
+## Consent
 
-**Medium sensitivity:**
-- Email addresses
-- Names
-- IP addresses
-- Usage patterns
-- Non-precise location
+- May be required for: non-essential cookies (GDPR), marketing emails (various laws), sensitive data processing, children's data (parental consent), some cross-border transfers.
+- Must be informed (clear explanation), specific (not bundled), freely given (not forced), easily withdrawn.
+- Mechanisms: cookie consent banner, email opt-in checkboxes, granular privacy settings, account settings toggles.
 
-**Low sensitivity:**
-- Anonymous aggregate statistics
-- Public information
+## Cross-Border Transfers
 
----
+- Know where data is stored and processed (US, EU, etc.); consider GDPR; use adequate protection mechanisms (e.g., Standard Contractual Clauses).
 
-## Critical Privacy Safeguards
+## Privacy Policy
 
-### A. Children's Privacy
+- Disclose: what is collected, why, how used, third-party recipients, retention, user rights (access, deletion), privacy contact, how the policy may change.
+- Must reflect actual practices; never copy-paste a generic policy.
 
-**If children can use the service:**
+## Checklist
 
-✅ **Do:**
-- Determine minimum age requirement
-- Implement age verification if required
-- Obtain parental consent where legally required
-- Minimize data collection from children
-- Document children's data practices
+**Data mapping**
+- [ ] All data identified; purpose documented per type; third-party recipients listed; sensitivity assessed
 
-❌ **Don't:**
-- Knowingly collect children's data in violation of applicable law
-- Assume all users are adults
-- Ignore children's privacy laws (e.g., COPPA in U.S.)
+**Technical controls**
+- [ ] Security controls implemented; sensitive data masked in logs and analytics
+- [ ] Third-party services configured for privacy; resources self-hosted where practical
 
-**Documentation:**
-```markdown
-## Children's Privacy
-
-**Minimum age:** [Age or "No restriction"]
-**Age verification:** [Implemented / Not required]
-**Children's data collected:** [List or "None knowingly"]
-**Parental consent:** [Required and implemented / Not applicable]
-**Applicable laws:** [e.g., COPPA (U.S.) if applicable]
-**Legal review needed:** Yes
-```
-
----
-
-### B. Third-Party Fonts & External Resources
-
-**Privacy risk:** External fonts/resources may disclose IP addresses and referrers to third parties.
-
-**Audit:**
-- Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
-- Adobe Fonts
-- Font Awesome CDN
-- External CSS/JS
-- Third-party images
-
-**Privacy-friendly approaches:**
-1. **Self-host fonts** when practical
-2. **Use system fonts** (no external request)
-3. **Document unavoidable third-party requests**
-4. **Check licensing** for self-hosting
-
-**Documentation:**
-```markdown
-## External Resources
-
-**Fonts:** [Self-hosted / System fonts / Google Fonts with disclosure]
-**CDNs:** [List]
-**Third-party scripts:** [List]
-**Privacy implication:** [IP addresses shared with: ...]
-```
-
-✅ **Good:** "Using system font stack to avoid third-party requests"  
-✅ **Good:** "Self-hosting Inter font for privacy"  
-❌ **Bad:** Claiming external fonts are illegal universally  
-
----
-
-### C. Session Replay & Recording Tools
-
-**Tools:** FullStory, LogRocket, Hotjar, Microsoft Clarity, etc.
-
-**Privacy risks:**
-- Records user interactions
-- May capture sensitive input
-- May record across sessions
-- Shares data with third-party
-
-**Before enabling:**
-
-✅ **Do:**
-- Mask password fields
-- Mask payment information
-- Mask sensitive personal data (SSN, health info, etc.)
-- Exclude authentication secrets
-- Configure privacy settings appropriately
-- Determine if consent is required
-- Document in privacy policy
-
-❌ **Don't:**
-- Enable invasive recording by default
-- Record sensitive inputs
-- Ignore provider privacy settings
-- Assume consent is not required
-
-**Documentation:**
-```markdown
-## Session Replay
-
-**Tool:** [Name or "Not implemented"]
-**What is recorded:** [Describe]
-**Sensitive data handling:** [Masked / Excluded]
-**User consent:** [Required / Opt-out provided / Not applicable]
-**Privacy policy disclosure:** [Yes / Needed]
-**Legal review needed:** Yes
-```
-
----
-
-### D. Analytics & Tracking
-
-**Types:**
-- Page analytics (page views, referrers)
-- Event tracking (button clicks, features used)
-- User identification
-- Cross-site tracking
-- Advertising tracking
-
-**Privacy considerations:**
-
-**Privacy-friendly analytics:**
-- Plausible Analytics (no cookies, no personal data)
-- Simple Analytics
-- Fathom Analytics
-- Self-hosted Matomo (configured appropriately)
-
-**Privacy-concerning analytics:**
-- Google Analytics (especially Universal Analytics)
-- Facebook Pixel
-- Third-party advertising trackers
-
-**Requirements to consider:**
-- Cookie consent (GDPR, ePrivacy)
-- Do Not Track (optional respect)
-- Opt-out mechanisms
-- Data retention limits
-- IP anonymization
-
-**Documentation:**
-```markdown
-## Analytics
-
-**Tools:** [List]
-**Data collected:** [Describe]
-**Personal data:** [Yes/No, describe]
-**Cookies used:** [Yes/No, list]
-**Consent mechanism:** [Implemented / Not required]
-**Privacy policy disclosure:** [Yes / Needed]
-```
-
----
-
-### E. Cookies & Local Storage
-
-**Audit:**
-- Essential cookies (authentication, security)
-- Analytics cookies
-- Marketing cookies
-- Third-party cookies
-- LocalStorage usage
-- SessionStorage usage
-
-**Categories:**
-- **Strictly necessary:** Essential for service operation
-- **Functional:** Enhance user experience
-- **Analytics:** Understand usage patterns
-- **Advertising/Marketing:** Personalized ads
-
-**Consent requirements:**
-- EU/EEA: Consent required for non-essential cookies (GDPR/ePrivacy)
-- Other jurisdictions: Varies
-
-**Documentation:**
-```markdown
-## Cookies
-
-**Essential cookies:** [List with purpose]
-**Analytics cookies:** [List with purpose and consent requirement]
-**Marketing cookies:** [List with purpose and consent requirement]
-**Consent mechanism:** [Implemented / Not required]
-**Cookie policy:** [Exists / Needed]
-```
-
----
-
-### F. Data Retention & Deletion
-
-**Retention questions:**
-- How long is data kept?
-- Why is it kept that long?
-- Is retention documented?
-- Is old data automatically deleted?
-
-**Deletion questions:**
-- Can users delete their accounts?
-- What happens to user data after deletion?
-- Is deletion immediate or scheduled?
-- Are backups also deleted (or excluded)?
-
-**Best practices:**
-- Define retention periods
-- Implement automated deletion where appropriate
-- Provide user-initiated deletion
-- Document deletion procedures
-
-**Documentation:**
-```markdown
-## Data Retention & Deletion
-
-**Retention periods:**
-- Account data: [Duration or "Until deletion"]
-- Usage logs: [Duration]
-- Backups: [Duration]
-
-**User deletion:**
-- Account deletion: [Available / Planned]
-- Deletion process: [Describe]
-- Data erasure: [Immediate / Within X days]
-- Backups: [Excluded from future backups / Retained until backup expires]
-```
-
----
+**User control**
+- [ ] Privacy policy accurate; consent obtained where required; user privacy preferences respected
+- [ ] Retention limits implemented; user data access and deletion supported where required
 
-### G. Data Security
+**Documentation**
+- [ ] Practices, third parties, retention periods, and security controls documented
 
-**Technical controls:**
-- Encryption in transit (HTTPS)
-- Encryption at rest (database encryption)
-- Access controls (authentication, authorization)
-- Secrets management (not hardcoded)
-- Secure session management
-- Input validation
-- Output encoding
+**Legal review**
+- [ ] Applicable laws identified (e.g., GDPR, CCPA, COPPA); jurisdiction-specific requirements verified
+- [ ] Privacy policy and consent mechanisms reviewed with counsel
 
-**See `security-quality.md` for detailed security guidance.**
+**Verification**
+- [ ] Changed collection/tracking/consent behavior verified (network requests, storage, consent flows); skip re-verification only for unrelated areas
 
----
-
-## Privacy-by-Design Checklist
-
-- [ ] Minimize data collection (collect only what's needed)
-- [ ] Document data collection purpose
-- [ ] Identify all third-party data recipients
-- [ ] Assess data sensitivity
-- [ ] Implement appropriate security controls
-- [ ] Provide transparency (privacy policy)
-- [ ] Obtain consent where required
-- [ ] Implement data retention limits
-- [ ] Support user data deletion
-- [ ] Mask sensitive data in logs and analytics
-- [ ] Self-host resources when practical for privacy
-- [ ] Configure third-party services for privacy
-- [ ] Respect user privacy preferences
-
----
-
-## Privacy Policy Requirements
-
-**A privacy policy should disclose:**
-- What information is collected
-- Why it's collected
-- How it's used
-- Who it's shared with (third parties)
-- How long it's retained
-- User rights (access, deletion, etc.)
-- How to contact about privacy
-- How the policy may change
-
-**Important:** The privacy policy must reflect actual practices. Don't copy-paste a generic policy.
-
----
-
-## Cross-Border Data Transfers
-
-**If users are in different countries:**
-- Understand where data is stored (US, EU, etc.)
-- Understand where data is processed
-- Consider GDPR (EU data protection)
-- Consider adequate protection mechanisms (Standard Contractual Clauses, etc.)
-
----
-
-## Consent Mechanisms
-
-**When consent may be required:**
-- Non-essential cookies (GDPR)
-- Marketing emails (various laws)
-- Sensitive data processing
-- Children's data (parental consent)
-- Cross-border transfers (some cases)
-
-**Consent should be:**
-- Informed (clear explanation)
-- Specific (not bundled)
-- Freely given (not forced)
-- Easily withdrawn
-
-**Consent mechanisms:**
-- Cookie consent banner
-- Email opt-in checkboxes
-- Granular privacy settings
-- Account settings toggles
-
----
-
-## Privacy Compliance Checklist
-
-### Data Mapping
-- [ ] Identify all data collected
-- [ ] Document purpose for each data type
-- [ ] Identify third-party recipients
-- [ ] Assess sensitivity
-
-### Technical Controls
-- [ ] Implement appropriate security
-- [ ] Mask sensitive data in logs
-- [ ] Configure third-party privacy settings
-- [ ] Self-host privacy-sensitive resources when practical
-
-### User Control
-- [ ] Provide privacy policy
-- [ ] Implement consent mechanisms where required
-- [ ] Provide data access (where required)
-- [ ] Provide data deletion
-
-### Documentation
-- [ ] Document data practices
-- [ ] Document third-party services
-- [ ] Document retention periods
-- [ ] Document security controls
-
-### Legal Review
-- [ ] Identify applicable privacy laws
-- [ ] Verify jurisdiction-specific requirements
-- [ ] Review privacy policy with counsel
-- [ ] Verify consent mechanisms
-
----
-
-## Privacy Documentation Template
+## Documentation Template
 
 ```markdown
 ## Privacy & Data Protection
-
-### Data Collection
-
-**Personal data collected:**
-- Email address (account creation)
-- Name (optional profile)
-- [Other]
-
-**Purpose:** [Why each type is collected]
-
-### Third-Party Services
-
-**Services that receive data:**
-- [Service name]: [Data shared] — [Purpose]
-- [Service name]: [Data shared] — [Purpose]
-
-### Sensitive Data
-
-**High-sensitivity data:** [None / List]
-**Special handling:** [Describe]
-
-### Children
-
-**Minimum age:** [Age or "No restriction"]
-**Children's data:** [Not knowingly collected / Describe if applicable]
-
-### Data Retention
-
-**Retention periods:**
-- Account data: [Duration]
-- Logs: [Duration]
-
-**Deletion:** [User can delete account: Yes/No]
-
-### Security
-
-**Controls:**
-- HTTPS (encryption in transit)
-- Database encryption (encryption at rest)
-- [Other controls]
-
-### Privacy Policy
-
-**Status:** [Exists / Draft / Needed]
-**Last reviewed:** [Date]
-
-### Consent Mechanisms
-
-**Cookies:** [Consent banner implemented / Not required]
-**Marketing emails:** [Opt-in required / Not applicable]
-
-### Legal Review
-
-**Applicable laws:** [GDPR, CCPA, etc. if known]
-**Legal review needed:** [Yes/No]
-**Status:** [Not started / In progress / Complete]
-```
-
----
-
-## Summary
-
-**Privacy is not just legal compliance—it's user trust.**
-
-**Key principles:**
-1. Collect only what you need
-2. Be transparent about data practices
-3. Protect data appropriately
-4. Give users control
-5. Document your approach
-
-**Remember:**
-- This is engineering guidance, not legal advice
-- Privacy laws vary by jurisdiction
-- Requirements change over time
-- Verify with qualified legal/privacy counsel
-- Never fabricate compliance claims
-
-**Goal:** Build privacy-respectful products that earn user trust and minimize legal risk.
+- Personal data collected: [type → purpose]
+- Third-party services: [service → data shared → purpose]
+- High-sensitivity data: [none / list]; special handling: [describe]
+- Children: minimum age [age / no restriction]; data [not knowingly collected / describe]
+- Retention: account data [duration]; logs [duration]; backups [duration]
+- Deletion: user can delete account [Yes/No]; process [describe]; erasure [immediate / within X days]; backups [excluded / retained until expiry]
+- Security controls: [HTTPS, database encryption, others]
+- Privacy policy: [Exists / Draft / Needed]; last reviewed [date]
+- Consent: cookies [banner implemented / not required]; marketing emails [opt-in / not applicable]
+- Legal: applicable laws [GDPR, CCPA, etc.]; review needed [Yes/No]; status [Not started / In progress / Complete]
+```