Termék-adatáramlások feltárása

Product & Data Flow Discovery

Ground every legal analysis and document draft in how the product actually works. Never draft privacy notices, terms of service, or data processing agreements from assumptions or generic templates without inspecting the system first.

Discovery Workflow

1. Identify Provider & Commercial Context:
   • Inspect project briefs, existing legal docs, configs, and billing settings to determine the operating legal entity, its role, product type (SaaS, e-commerce, mobile app, AI service), target markets, sales channels, and B2B/B2C customer mix.
2. Trace End-to-End User & Commercial Flows:
   • Follow the actual implementation of account registration, login/SSO, free trials, checkout, payment processing, subscription renewal, plan changes, cancellation, withdrawal, refund handling, and account deletion.
   • Check what the UI displays at each step (checkboxes, inline notices, button labels, confirmation emails).
3. Map Personal Data Flows & Storage:
   • Inspect database schemas, migrations, ORM models, API payloads, background jobs, and log configurations.
   • For each processing activity, record:
     • Data categories (identifiers, contact, billing, usage telemetry, uploaded content, AI prompts/outputs).
     • Collection point & source (direct user input under Art. 13 vs. indirect/third-party source under Art. 14).
     • Storage location, backups, and retention/deletion logic (hard delete, soft delete, or delayed archival).
4. Audit Third-Party SDKs, Trackers & Vendors:
   • Inspect package.json/lockfiles, frontend scripts, CSP headers, environment variables, and webhook handlers to identify every external service: hosting, database, auth, payments, analytics, session replay, crash reporting, email/SMS, support, and AI/LLM providers.
   • Check whether cookies, localStorage, or tracking pixels fire before or after user consent.
5. Inspect AI & Automated Features:
   • Trace what user inputs, files, or workspace context are sent to external or self-hosted models, which provider endpoints are called, whether prompts/outputs are logged or cached, and whether automated decisions affect users.

Evidence Classification

Separate findings into three explicit categories:

• Verified actual behavior: Confirmed in code, config, or live UI.
• Planned / partial feature: Present in specs or dead code but not active in production.
• Undocumented / unknown: Cannot be verified from repo access (offline contracts, manual routines) — mark as an open question or [PLACEHOLDER].

Guardrails

• Never invent technical safeguards (encryption at rest, automatic purge jobs, EU-only hosting, or zero data retention) not verified in the system or vendor config.
• Record code-vs-compliance discrepancies as engineering action items rather than masking them with vague legal wording.