Lawful basis
Document why you process each type of data. Consent, contract, legitimate interest — pick and record.
Advertisement
Data minimization
Don't collect more than you need. Redact PII from prompts unless functionally required.
Advertisement
Right to access + rectify
User can request their data. Endpoint returns everything you store about them.