# Privacy

URL: /systems/privacy · Id: `system:privacy`

> Privacy declares each Purpose for personal data, records Consent, answers access requests, masks data on request, and publishes its privacy notices.

Privacy declares each [Purpose](/business/nouns/purpose) a [Startup](/business/nouns/startup) uses personal data for, records [Consent](/business/nouns/consent), answers access requests, masks data on request, and publishes the notices. Data is masked, never deleted, so what was done stays provable.

## Summary
| Part | This System |
| --- | --- |
| Group | Customers and identity |
| Status | Beta: it works, and its Verbs may still change |
| Shelf | Wakes: offered once its Event fires |

You can ask:

- “Delete everything we hold about this person”
- “What data do we keep on this customer?”
- “Add a cookie banner”
- “Stop using this person’s data for marketing”

## What you get
| Part | This System |
| --- | --- |
| Starts | On for every Startup at creation, with nothing to install. |
| Wakes | On [`Visitor.identified`](/business/events/Visitor.identified) when the Startup records its first known person. |
| Built from | [Database](/code/platform/capabilities/database), [Event streams](/code/platform/event-streams), [Workflows](/code/platform/workflows), [Encryption](/code/platform/encryption) |

## Nouns it owns
| Noun | Definition |
| --- | --- |
| [Purpose](/business/nouns/purpose) | A Purpose is a named reason personal data is processed, with a lawful basis per jurisdiction. |
| [Consent](/business/nouns/consent) | A Consent is a person’s grant for one Purpose, with its basis, region, notice, evidence, and expiry. |

## Verbs
| Verb | Object | Approval | Event |
| --- | --- | --- | --- |
| [Purpose.create](/business/nouns/purpose/create) | [Purpose](/business/nouns/purpose) | None | `Purpose.created` |
| [Consent.create](/business/nouns/consent/create) | [Consent](/business/nouns/consent) | None | `Consent.created` |
| [Consent.update](/business/nouns/consent/update) | [Consent](/business/nouns/consent) | None | `Consent.updated` |

## Events
| Direction | Event | How |
| --- | --- | --- |
| Emits | `Purpose.created` | By [Purpose.create](/business/nouns/purpose/create) |
| Emits | `Consent.created` | By [Consent.create](/business/nouns/consent/create) |
| Emits | `Consent.updated` | By [Consent.update](/business/nouns/consent/update) |

## States
None.

## Who operates it
| Part | This System |
| --- | --- |
| Accountable | [Privacy Officer](/agents/legal/privacy-officer) |
| Team | [Legal Team](/agents/legal) |
| Seat | A role agent holds it until a Human is seated. |
| Autonomy | `assist` |
| Also calls its Verbs | [Success Manager](/agents/customer/success-manager), [Legal Lead](/agents/legal/legal-lead) |

## Approvals and limits
None.

## Processes that use it
| Process | How it uses it |
| --- | --- |
| [Contracting](/workflows/processes/contracting) | A step calls [Purpose.create](/business/nouns/purpose/create) |
| [Privacy](/workflows/processes/privacy) | A step calls [Consent.update](/business/nouns/consent/update) |
| [Retention](/workflows/processes/retention) | A step calls [Consent.create](/business/nouns/consent/create) |

## Rail underneath
None.

## Views and dashboards
| View | Shows | Metrics |
| --- | --- | --- |
| The [Privacy Officer](/agents/legal/privacy-officer)’s view | The Metrics its accountable Role answers for. | [Privacy requests on time](/agents/legal#privacy-requests-on-time) |

## Access
What each Access level may call here.

| Access level | May call |
| --- | --- |
| `owner` | Every Verb (9) |
| `admin` | Every Verb (9) |
| `member` | Every Verb (9) |
| `viewer` | Read only (4 of 9) |

## Import and export
None.

## Fees and pricing
None.

## Availability and limits
| Part | This System |
| --- | --- |
| Status | Beta: it works, and its Verbs may still change |

## Compliance notes
Each request is answered inside its legal deadline, and data is masked across every System; the Purposes declared stay the founder’s.

Controls it carries:

- [Log completeness](/systems/trust-and-governance/controls/log-completeness)
- [Encryption](/systems/trust-and-governance/controls/encryption)
- [Append-only records](/systems/trust-and-governance/controls/append-only-records)
- [Breach notification](/systems/trust-and-governance/controls/breach-notification)
- [Point-in-time recovery](/systems/trust-and-governance/controls/point-in-time-recovery)
- [Processing definitions](/systems/trust-and-governance/controls/processing-definitions)
- [Action completion](/systems/trust-and-governance/controls/action-completion)
- [Privacy notice](/systems/trust-and-governance/controls/privacy-notice)
- [Lawful basis](/systems/trust-and-governance/controls/lawful-basis)
- [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation)
- [Retention restriction](/systems/trust-and-governance/controls/retention-restriction)
- [Privacy requests](/systems/trust-and-governance/controls/privacy-requests)
- [Disclosure record](/systems/trust-and-governance/controls/disclosure-record)
- [Records of processing](/systems/trust-and-governance/controls/processing-records)

## Related Systems
- [Customer access](/systems/customer-access)
- [Product analytics](/systems/product-analytics)
- [Compliance](/systems/compliance)

## Example
A [b2c](/business/motions/b2c) [SaaS](/products/templates/saas) for journaling gets an erasure request from a user in the EU. Privacy masks that user’s data in every [System](/business/nouns/system), keeps proof of the request, and confirms within the legal deadline. The [Privacy Officer](/agents/legal/privacy-officer) [Agent](/business/nouns/agent) sees the request closed without touching it.