# PII Data Flow Map — [Your App Name]

> **Instructions for Claude:** Search the codebase for all database tables/columns that store personal data, all API endpoints that receive user input, and all external services that receive user data. Map every piece of PII from entry to storage to deletion.

---

## 1. PII Categories Collected

| Category | Data Fields | Source | Sensitivity |
|----------|------------|--------|-------------|
| Identity | [e.g., name, email, avatar] | [e.g., Google OAuth] | [High/Medium/Low] |
| Professional | [e.g., job title, company] | [e.g., User input] | [Medium] |
| Communication | [e.g., email content, phone] | [e.g., Gmail sync] | [High] |
| Location | [e.g., address, timezone] | [e.g., Calendar events] | [Medium] |
| Behavioral | [e.g., feature usage, login times] | [e.g., Analytics] | [Low] |

## 2. Data Entry Points

> For each way data enters your system, describe what's collected:

### Entry Point 1: [e.g., User Registration]
- **Method:** [e.g., Google OAuth callback]
- **Data collected:** [List fields]
- **Validation:** [What's validated]
- **Storage:** [Where it goes]

### Entry Point 2: [e.g., API Import]
- **Method:** [e.g., Gmail API sync]
- **Data collected:** [List fields]
- **Validation:** [What's validated]
- **Storage:** [Where it goes]

> Add more entry points as needed.

## 3. Data Storage Map

| Table/Collection | PII Columns | Encryption | Access Control |
|-----------------|-------------|------------|---------------|
| [e.g., users] | [e.g., email, name] | [e.g., Database-level] | [e.g., RLS: own row only] |
| [e.g., messages] | [e.g., content, sender] | [e.g., Database-level] | [e.g., RLS: own rows] |

## 4. External Data Sharing

| Recipient | Data Shared | Purpose | Legal Basis |
|-----------|------------|---------|-------------|
| [e.g., OpenAI] | [e.g., Contact names for enrichment] | [Purpose] | [e.g., Legitimate interest] |
| [e.g., Analytics] | [e.g., Anonymized usage events] | [Purpose] | [e.g., Consent] |

## 5. Data Retention

| Data Category | Retention Period | Deletion Trigger | Deletion Method |
|--------------|-----------------|-----------------|-----------------|
| [e.g., Account data] | [e.g., Account lifetime] | [e.g., User deletion] | [e.g., Cascading delete] |
| [e.g., Logs] | [e.g., 7 days] | [e.g., Automatic rotation] | [e.g., Platform managed] |

## 6. User Rights (GDPR/CCPA)

| Right | Implementation | Response Time |
|-------|---------------|--------------|
| Access (Article 15) | [How users access their data] | [e.g., 30 days] |
| Erasure (Article 17) | [How deletion works] | [e.g., 30 days] |
| Portability (Article 20) | [Export mechanism] | [e.g., 30 days] |
| Rectification (Article 16) | [How users correct data] | [e.g., Self-service] |