Prepare a privacy review
Run new features and vendors through your privacy checklist.
Legal · When you ask · Updated
Works with
- Slack
- Box
- Dropbox
- Notion
- Microsoft 365
Slack
Box
Dropbox
Notion
Microsoft 365How do you prepare a privacy review?
To prepare a privacy review, give Maito the vendor's privacy page, DPA and security documents and your checklist in Drive. It checks each item, lists passes, gaps and unknowns, and shows where each answer came from. Legal starts the review with the gaps identified instead of reading every page.
How it's done today
Privacy reviews get skipped under deadline.
What Maito does
- Read the feature or vendor details
- Go through the checklist
- List gaps and draft notes
Example
@Maito run a privacy review on Pied Piper Analytics. We want it in the app next sprint.
Ran our 11-item privacy checklist (v2.1, Drive) on their privacy page, DPA draft and security PDF. 7 pass, 3 gaps, 1 unknown. Gaps • No DPA signed. Theirs is a draft, and we haven't signed it. • Data stored in the US (Virginia). We have EU users, so a transfer mechanism is needed. • Retention is 26 months. Our limit is 14. Unknown: no published sub-processor list. Catch: the SDK collects full IP addresses by default. An anonymize setting exists but is off. Deletion on request works, within 30 days. Claire signs off. Want me to draft questions for their privacy contact?
@Maito yes please.
Attached: pied-piper-questions.docx, 6 questions covering the gaps and IP anonymization. It's a draft for Claire. Nothing is sent to the vendor.
Leo (3:30 PM):
run a privacy review on Pied Piper Analytics. We want it in the app next sprint.
Maito (3:34 PM):
Ran our 11-item privacy checklist (v2.1, Drive) on their privacy page, DPA draft and security PDF. 7 pass, 3 gaps, 1 unknown.
Gaps
• No DPA signed. Theirs is a draft, and we haven't signed it.
• Data stored in the US (Virginia). We have EU users, so a transfer mechanism is needed.
• Retention is 26 months. Our limit is 14.
Unknown: no published sub-processor list.
Catch: the SDK collects full IP addresses by default. An anonymize setting exists but is off.
Deletion on request works, within 30 days. Claire signs off. Want me to draft questions for their privacy contact?
Leo (3:41 PM):
yes please.
Maito (3:42 PM):
Attached: pied-piper-questions.docx, 6 questions covering the gaps and IP anonymization. It's a draft for Claire. Nothing is sent to the vendor.
How to set it up
- Set up
Nothing to set up. Ask in Slack or by email whenever you need it.
- Connect files
- Google Drive
- Box
- Dropbox
- Notion
- Microsoft 365
Not connected yet? Your agent sends you a link to sign in.
What it won't do
It can only judge what the documents say, not what the vendor does in practice. It doesn't replace a formal privacy assessment, and the final call belongs to your team.
Questions
Your checklist and the vendor's documents, such as the privacy policy, DPA and security paper. It reads files from the file tool you connect or ones you attach.
No. It reports passes, gaps and unknowns. A person on your legal or privacy team makes the decision.
Yes. Share the spec or description and it runs the same checklist, then lists what the team still needs to answer.
