Produktdatenflüsse ermitteln

Verfolgt tatsächliche Produkt-, Geschäfts- und Personendatenabläufe vor rechtlicher Analyse oder Textentwürfen.

product-data-flow-discovery

Entdecke, wie der Skill hilft

Wann ist der Skill hilfreich?

Nutze diesen Skill für verlässliche Fakten über Erhebung, Versand, Speicherung und Entfernung.

Wobei hilft er dir?

Verfolgt Registrierung, Checkout, Abowechsel und Kontoaktionen vollständig.
Ordnet Datenarten Erhebung, Speicherung, Sicherungen und Aufbewahrung zu.
Findet externe Dienste und Hinweise in Code und Konfiguration.

Das könntest du fragen

Erfasse unseren Upload-AI-Ablauf mit Logs, Anbietern, Löschwegen und fehlenden Fakten für Datenschutzhinweise. Verfolge ein synthetisches Dokument durch Upload, Verarbeitung, Logs und Löschung. Erfasse alle Kopien und Empfänger einschließlich ungeklärter Bereinigung.

Ausführliche Dokumentation

Hier findest du die ursprüngliche Anleitung, Beispiele und Prüfschritte des Skills in ihrer Originalsprache.

Details…Weniger anzeigen

Product & Data Flow Discovery

Ground every legal analysis and document draft in how the product actually works. Never draft privacy notices, terms of service, or data processing agreements from assumptions or generic templates without inspecting the system first.

Discovery Workflow

Identify Provider & Commercial Context:
- Inspect project briefs, existing legal docs, configs, and billing settings to determine the operating legal entity, its role, product type (SaaS, e-commerce, mobile app, AI service), target markets, sales channels, and B2B/B2C customer mix.
Trace End-to-End User & Commercial Flows:
- Follow the actual implementation of account registration, login/SSO, free trials, checkout, payment processing, subscription renewal, plan changes, cancellation, withdrawal, refund handling, and account deletion.
- Check what the UI displays at each step (checkboxes, inline notices, button labels, confirmation emails).
Map Personal Data Flows & Storage:
- Inspect database schemas, migrations, ORM models, API payloads, background jobs, and log configurations.
- For each processing activity, record:
  - Data categories (identifiers, contact, billing, usage telemetry, uploaded content, AI prompts/outputs).
  - Collection point & source (direct user input under Art. 13 vs. indirect/third-party source under Art. 14).
  - Storage location, backups, and retention/deletion logic (hard delete, soft delete, or delayed archival).
Audit Third-Party SDKs, Trackers & Vendors:
- Inspect package.json/lockfiles, frontend scripts, CSP headers, environment variables, and webhook handlers to identify every external service: hosting, database, auth, payments, analytics, session replay, crash reporting, email/SMS, support, and AI/LLM providers.
- Check whether cookies, localStorage, or tracking pixels fire before or after user consent.
Inspect AI & Automated Features:
- Trace what user inputs, files, or workspace context are sent to external or self-hosted models, which provider endpoints are called, whether prompts/outputs are logged or cached, and whether automated decisions affect users.

Evidence Classification

Separate findings into three explicit categories:

Verified actual behavior: Confirmed in code, config, or live UI.
Planned / partial feature: Present in specs or dead code but not active in production.
Undocumented / unknown: Cannot be verified from repo access (offline contracts, manual routines) — mark as an open question or [PLACEHOLDER].

Guardrails

Never invent technical safeguards (encryption at rest, automatic purge jobs, EU-only hosting, or zero data retention) not verified in the system or vendor config.
Record code-vs-compliance discrepancies as engineering action items rather than masking them with vague legal wording.

Enthaltene Dateien 1

SKILL.md