Privacy
Privacy by design. Buddora minimizes, separates, and audits access to personal and sensitive data.
Principles
- Data minimization — collect and expose only what a capability needs.
- Projection separation — medical/private data never appears in public or emergency views.
- Masked contact — finders reach owners through a relay handle, never a raw phone.
- Auditability — sensitive access is recorded in an append-only trail.
GDPR workflows
| Right | State |
|---|---|
| Access / portability → data export | Built. The dataportability module serves data exports and imports with preview, validation, progress, download grants and rollback |
| Erasure → deletion workflow with audit | Built, and deliberately two-step. privacy-requests exist self-service (/v1/privacy-requests) and on the admin side (/v1/admin/privacy-requests, with an executions log). Creating a request never deletes data by itself — execution is a separate admin-side action, gated and audited independently of the UI's own typed confirmation |
Data residency → per-tenant data_region routing | Not built. No such column or routing exists |
| Consent records for optional public profiles and marketing | Country legal texts and processing purposes are recorded per country by the activation registry (ADR-021); per-user consent records for public profiles and marketing are separate and not covered by it |
Country-level lawful basis and legal texts are checked at evaluation time with no cached conclusion, so withdrawing a legal text or a processing purpose de-activates the affected activity on the very next request rather than at the next deploy. See Country Policies.
One gap worth naming here rather than burying: no malware scanner is wired, so uploaded
import files stay quarantined and cannot be processed. That control fails closed, which is the
right direction, but it means the import path is not usable in production today — see
docs/MOCKED_DEPENDENCIES.md.