Privacy and Journey Memory — working draft

This checklist is a design control, not a complete privacy notice. Controller identity, lawful bases, processors, transfer safeguards and retention periods require approved operational facts.

Legal review required · not production terms

Data the prototype anticipates

Account identifiers, profile preferences, Journey briefs, selected context, messages, capacity receipts and outcome evidence are separate record classes.

Raw identity documents and provider secrets do not belong in Journey Memory.
Special-category or safeguarding data needs a separate necessity and lawful-basis assessment.
Imported conversation history must be selected by the Passenger.

Notice before collection

A production notice must name the controller, purposes, lawful bases, recipients, transfers, retention, rights and complaint route.

Consent, where used, must be as easy to withdraw as to give.
Automated decision-making and profiling must be described when applicable.
Provider and verification-vendor categories must be specific enough to understand.

Control and evidence

Sharing, revocation, export and deletion requests need explicit state and audit receipts.

The proposed row-level security model is designed to restrict records by server-verified account and Journey relationship; its deployed policy state must be re-verified before it is described as an active safeguard.
A deletion receipt must state exclusions or retained records honestly.
Production incident, subject-access and processor-management procedures are still required.

These official links are starting points for professional review, not an assertion that the working draft is legally complete or suitable for the final operating entity.