Skip to main content

Privacy & GDPR

Status: ⚠️ Compliance

Scope​

Covers the EU General Data Protection Regulation obligations: right to erasure (account + ledger data), data portability (export), consent records, and lawful basis for processing. Maps to backup-restore-portability for the export surface. Must also handle household deletion cascades cleanly.

Open questions​

  • Does Rewhaven need a Data Processing Agreement (DPA) with Supabase/Cloudflare?
  • What is the data residency strategy for EU users (Supabase region)?
  • How is a child member's data handled when a parent exercises erasure on behalf of the child?
  • Is analytics/telemetry (Mixpanel) compliant with GDPR consent requirements?

Relationship​

Backup, restore & portability — the data export surface satisfies the portability right.