Name the responsible owner
Record the organisation that decides why and how each processing activity happens. Separate client, engineering, hosting, analytics, support, and specialist roles.
Data control / route map
Draw the database and vendor path before writing the notice.
A privacy page cannot explain a system the team has never mapped. Start with field-level collection, responsible owners, every service that receives data, and the evidence required to operate safely.
Inventory the real fields
List form inputs, account records, logs, cookies, analytics, support messages, uploaded material, derived data, and backups. Remove fields without a defined need.
Trace hosting and vendors
Show each handoff, processing location, subcontractor, credential boundary, and proposed cross-border route. Contract and legal review belongs to the responsible organisation.
Set lifecycle controls
Define access, correction, retention, deletion, export, backup expiry, and rights-request handling in operational terms the product can support.
Attach security evidence
Attach named owners and review dates to permissions, encryption decisions, audit trails, supplier checks, restoration exercises, and administrator runbooks.
Prepare incident ownership
Decide who investigates, preserves facts, restricts access, communicates, contacts advisers or authorities, and authorizes restoration.
The Privacy Protection Authority and Israel National Cyber Directorate are official starting points for the responsible owner. Faith Forge Labs can implement agreed controls but does not decide legal obligations or certify compliance.
Useful input
Bring one real record from entry to deletion.
That single trace often exposes missing owners, invisible vendors, excessive collection, and recovery assumptions faster than a generic policy review.