# Doncheli Data Policy

> Audit and document what personal or sensitive data the project collects, processes, and stores. Activate when user mentions "privacy", "data policy", "what data", "GDPR", "personal data", "data retention", "PII".

- Skill: `aibot88/doncheli-data-policy` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/doncheli-data-policy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/doncheli-data-policy/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/doncheli-data-policy

---


# Don Cheli: Data Policy Auditor

## Instructions

1. Scan the codebase for PII and sensitive data patterns:
   - Database models / schemas for fields like email, phone, name, address, IP, location
   - API request/response payloads
   - Logging statements that may capture sensitive fields
   - Third-party integrations that receive user data
2. Build a data inventory table: field name, model, purpose, retention, shared with
3. Check against common compliance requirements:
   - GDPR: lawful basis, right to erasure, data minimization
   - CCPA: disclosure, opt-out
   - SOC2: access controls, encryption at rest/transit
4. Flag violations as [critical | warning | info]
5. Generate a draft Privacy Notice section if requested (`--generate-notice`)
6. Save the audit to `.dc/data-policy-audit-<date>.md`
7. Never make assumptions about compliance status — only report findings and flag gaps

## Output Format

```
## Data Policy Audit — 2026-03-28

### Data Inventory
| Field     | Model      | Purpose       | Retention | Shared With     |
|-----------|-----------|---------------|-----------|----------------|
| email     | User       | Auth, comms   | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog   | Security      | 90 days   | Internal only  |

### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING:  No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO:     No right-to-erasure endpoint found — required for GDPR compliance

### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy
```