Mapping data flows before writing a privacy notice
Map collection, transmission, storage, use, and deletion before writing an accurate notice.
On this page
Direct answer
Map collection, transmission, storage, use, and deletion before writing an accurate notice. A generated generic policy does not establish compliance. This is an engineering inventory, not a substitute for business- and jurisdiction-specific review.
When to use
You are adding analytics, ads, accounts, uploads, or third-party APIs.
Step by step
Inventory data by user action
For visits, registration, uploads, payment, and support, record fields, necessity, providers, regions, and storage. Check browser requests and server implementation, not just marketing descriptions.
Minimize and protect data
Keep full user input out of logs and analytics where unnecessary. Separate public from private content and define access, retention, deletion, and recovery. Include embeds and advertising providers.
Reconcile the notice with reality
Describe purposes, providers, user choices, and contact routes accurately. Escalate unresolved requirements appropriately. Update notices with behavior changes and test the controls and deletion paths.
Worked example
Hypothetical exercise, not a real performance claim.
A “local converter” adds remote recognition. It can no longer claim files stay on-device without checking what is uploaded, retained, and deleted and updating the explanation.
Action checklist
Reusable templates
Data-flow inventory
User action and fields:
Necessity and purpose:
Browser / server / third-party destinations:
Access and visibility:
Retention, deletion, and logs:
User controls and notice:
Review questions, owner, date:
Pitfalls
Do not copy another site’s identity or legal conclusions. If the notice conflicts with network behavior, fix the implementation or wording rather than hide the disclosure.
Related guides
-
How should you decide whether user-generated content is public and indexable?
-
How can analytics measure task success and channel attribution?