Privacy Data Map

Before you can write a privacy policy, answer a security questionnaire or talk to a privacy adviser, you need to know what personal data your app handles and where it goes. That usually means days of reading code.

This skill gives your AI a procedure for it. A scanner finds likely personal-data fields (about 30 types, from email and phone to health, children's data and government IDs) and about 60 tracking and third-party services, and notes where each appears: forms, schemas, logs, analytics calls, cookies. Your AI then reviews every finding, follows the data, asks you what the code can't show, and writes a data map: element, category, source, purpose, storage, retention, shared with, and a lawful-basis placeholder, with file and line evidence. It adds a processor list, risk flags with practical next steps, and a privacy-notice outline.

The Node.js scanner has no dependencies, skips node_modules, .git, binaries and .env files, masks values in its output, and writes a CSV and a Markdown summary. The example is a small fake app with planted problems, its scan, and the finished map.

This is a drafting aid, not legal advice. It never states lawful bases or compliance as fact, and it tells you to have a privacy professional review the result. Pattern matching misses data and flags some false positives, so the review step matters.