Discover product data flows

Traces actual product, commercial and personal-data workflows before legal analysis or document drafting.

product-data-flow-discovery

See how it helps

When is it useful?

Use when you need reliable facts about what the application collects, sends, stores and removes.

What does it help you do?

Follows registration, checkout, subscription changes and account actions end to end.
Maps data categories to collection points, storage, backups and retention logic.
Identifies third-party services and disclosures from code and configuration.

Try asking this

Map our upload-to-AI workflow, including logs, vendors, deletion paths and any facts still missing for the privacy notice. Follow one synthetic document through upload, processing, logs and deletion. Record every copy and recipient, including places whose cleanup behavior cannot yet be confirmed.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Product & Data Flow Discovery

Ground every legal analysis and document draft in how the product actually works. Never draft privacy notices, terms of service, or data processing agreements from assumptions or generic templates without inspecting the system first.

Discovery Workflow

Identify Provider & Commercial Context:
- Inspect project briefs, existing legal docs, configs, and billing settings to determine the operating legal entity, its role, product type (SaaS, e-commerce, mobile app, AI service), target markets, sales channels, and B2B/B2C customer mix.
Trace End-to-End User & Commercial Flows:
- Follow the actual implementation of account registration, login/SSO, free trials, checkout, payment processing, subscription renewal, plan changes, cancellation, withdrawal, refund handling, and account deletion.
- Check what the UI displays at each step (checkboxes, inline notices, button labels, confirmation emails).
Map Personal Data Flows & Storage:
- Inspect database schemas, migrations, ORM models, API payloads, background jobs, and log configurations.
- For each processing activity, record:
  - Data categories (identifiers, contact, billing, usage telemetry, uploaded content, AI prompts/outputs).
  - Collection point & source (direct user input under Art. 13 vs. indirect/third-party source under Art. 14).
  - Storage location, backups, and retention/deletion logic (hard delete, soft delete, or delayed archival).
Audit Third-Party SDKs, Trackers & Vendors:
- Inspect package.json/lockfiles, frontend scripts, CSP headers, environment variables, and webhook handlers to identify every external service: hosting, database, auth, payments, analytics, session replay, crash reporting, email/SMS, support, and AI/LLM providers.
- Check whether cookies, localStorage, or tracking pixels fire before or after user consent.
Inspect AI & Automated Features:
- Trace what user inputs, files, or workspace context are sent to external or self-hosted models, which provider endpoints are called, whether prompts/outputs are logged or cached, and whether automated decisions affect users.

Evidence Classification

Separate findings into three explicit categories:

Verified actual behavior: Confirmed in code, config, or live UI.
Planned / partial feature: Present in specs or dead code but not active in production.
Undocumented / unknown: Cannot be verified from repo access (offline contracts, manual routines) — mark as an open question or [PLACEHOLDER].

Guardrails

Never invent technical safeguards (encryption at rest, automatic purge jobs, EU-only hosting, or zero data retention) not verified in the system or vendor config.
Record code-vs-compliance discrepancies as engineering action items rather than masking them with vague legal wording.

Included files 1

SKILL.md