wuemaikblume

Use whenever code or infrastructure handles user data and touches a non-EU service or region — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Any user data (names, emails, IPs, user IDs, avatars, profile pictures, uploaded files, user-generated content, signup/registration/onboarding data, support tickets, chat messages, payment info, location, device IDs) is p

Use whenever code touches authentication, login, session management, audit logging, or application logging — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Triggers on bcrypt/argon2/scrypt, jsonwebtoken/jose, passport/next-auth/Auth.js/authjs/lucia, express-session/iron-session, cookie-session, set-cookie headers, login/logout/signup/register endpoints, passwor

Use whenever code touches newsletter, marketing-email, drip-campaign, re-engagement, win-back, lead-magnet, or any outbound email with promotional content — even if the user's prompt doesn't mention DSGVO, GDPR, UWG, privacy, or "personal data". Triggers on Mailchimp / @mailchimp/mailchimp_marketing, Brevo / @getbrevo/brevo / sib-api-v3-sdk (Sendinblue legacy), Klaviyo / klaviyo-api / klaviyo-php,