# Data exposure and personal data Step 5 traces every data category the tools return to every place it lands, then narrows it. The skill flags what needs the privacy owner; it does not decide legal basis, DPAs or retention policy. ## The data path, one line per category Write one line per data category in the record: - `` (personal: yes or no): source objects and fields, then server operator, then AI provider (plan, training setting, retention, region), then client storage (local transcripts and their retention), then logs and traces, then outputs (chat, files, docs, tickets). Example from the worked example: - Deal records (personal: yes, owner names): deals.name, stage, amount, close date, company name, owner name, then the CRM vendor's hosted server, then the AI provider on the business plan (training off by default per the plan terms, retention per the provider's page, cited with date), then local transcripts on three laptops (14 days, the team's setting), then the vendor's connected-app log (tool name, time, user), then a weekly summary in an internal doc. Rule: no destination for personal data may say "unknown". Unknown means step 5 is not done. ## Personal data in marketing systems - Contact identifiers: email, phone, name, postal address, customer and user IDs. - Device and cookie identifiers, client IDs, IP addresses, user IDs inside event properties. - Customer, order, subscription and invoice records. - Audiences and hashed identifiers. Hashed emails and phone numbers are still personal data when they are used for matching. - Employee names on owner, assignee and author fields, and call recordings. - Free text: notes, tickets, chat, reviews, form answers, call transcripts. It can hold special-category data such as health or religion, typed in by the customer. - Data about children in some products, and small aggregates that single out a person (a segment of three). ## Narrow at the source first The order that holds up: source controls, then tool choice, then task design. A prompt instruction to "ignore emails" is the weakest layer and never counts as minimisation. Vendor controls that narrow exposure (verify each live): - HubSpot: with Sensitive Data on, activity data (calls, emails, meetings, notes, tasks) and conversation data are blocked from the MCP server. The standard APIs are not affected. - Customer.io: the default `read` scope excludes sensitive personal data. `read:sensitive` needs the admin setting that allows MCP to access sensitive data plus a role that may view it. - Braze: its MCP tools return no user-profile data or user-level personal data. - Klaviyo: `disable-tools-with-user-generated-content=true` on the remote server, or `ALLOW_USER_GENERATED_CONTENT=false` on the local server, removes review and similar tools. - Amplitude: per-project role actions `USE_MCP_READ` and `USE_MCP_WRITE`. - Salesforce: field-level security and sharing rules apply to the hosted servers. - Snowflake and BigQuery: views over aggregated marts, SELECT-only roles, masking policies on identifier columns. - Any vendor: aggregate tools (pipeline summary, campaign metrics) before record searches, and a field list instead of whole records. Credentials in tool results: block or deny tools that return keys, tokens or integration secrets; the value would land in transcripts and logs (T14). If the task needs such a tool, that is B5. Proof for C6: a test query in the sandbox that shows the narrowed result, for example a contact search that returns names and companies with no email or phone column. Paste the column list into the record, not the rows. ## AI provider handling Record the provider's own statement for the plan in use, with the URL and the date read. Verify live; terms change. - Training setting. Consumer plans can differ from business, enterprise and API plans. - Retention, and whether zero-data-retention is available and enabled. - Region of processing, where the provider offers a choice. - Feedback and bug-report buttons can upload whole transcripts with longer retention. Tell users, or turn them off where the admin console allows. - Remote connectors in chat apps are called from the AI provider's cloud, not the user's laptop. A server behind a firewall must allow the provider's published outbound ranges, which every customer of that provider shares. - Vendor terms can restrict AI use. Apollo prohibits model training with its MCP integrations and requires training to be off in the client. A plan that trains on content is blocker B9 for that vendor. ## Local copies - Transcripts on laptops: tool results, including CRM records, land in local session files, and some tools fall back to plaintext token files when no keychain is available (auth-tokens-and-revocation.md). Claude Code keeps transcripts in plaintext for 30 days by default (`cleanupPeriodDays`). Record each client's setting. - Exports, screenshots and pasted tables in docs are copies too. Name them in the outputs part of the path. - Unbounded tools put large results into context and transcripts. Prefer tools with limits, date ranges and aggregates. ## Header mirroring in the 2026-07-28 revision Streamable HTTP requests now carry `Mcp-Method` and `Mcp-Name` headers, and a tool can mark parameters with `x-mcp-header` so their values are mirrored into `Mcp-Param-*` headers. Proxies, load balancers and WAFs see and often log headers. The review script lists every mirrored parameter (T13, WARN when the name looks like personal data). Add each one to the data path and keep personal data out of them; a mirrored email or contact ID is a data path to every log on the way. ## Region Use the regional endpoint that matches the account's data region (C13 when it does not): - Braze: US or EU endpoints; either reaches any cluster, so record which one the config uses. - Mixpanel: US, EU or India hosts. - Customer.io: one URL that routes to the account's region at sign-in, with an EU URL as a fallback. - Amplitude: US or EU. Intercom: US or EU. Funnel: global or EU endpoints. ## When the privacy owner must sign off (B9) - Personal data reaches a new processor: a third-party host, an aggregator, a new AI provider or plan. - A new region or retention setting. - Free text is in scope. - The vendor's terms restrict AI use. - Children's or special-category data could be returned. The decisions.md entry records: date, use case, data categories, processors and regions, retention, the conditions attached (for example, contact emails hidden by the role), the approver's role and the review trigger. The record cites the entry ID. ## Logging without over-collecting - Log identifiers, versions and outcomes first: actor, tool, account, target IDs, time, result, approval reference. - Capture full payloads only where the investigation need and retention justify it, with access set to the payload's sensitivity. - Test the telemetry that is actually exported. Nested tool results and error messages can carry data the final answer does not show. The OpenTelemetry GenAI conventions (development status) advise not capturing message content by default.