Data map — LADLE trust

A data map is the artifact your privacy team asks for and every vendor produces reluctantly. Ours is short because our product is simple: an assistant, some files, a subscription, and a monthly donation. This page lists all of it.

Account records

WhatEmail, name (if provided), password hash, workspace membership

WhereSupabase (AWS us-east-1)

WhyTo authenticate you and route your data to your account

RetentionDuration of account + 7 years for finance-record purposes

Legal basis (GDPR)Contract (Art. 6(1)(b))

Chat content

WhatUser prompts, model responses, message timestamps, attached-file references

WhereSupabase (AWS us-east-1)

WhySo you can access your history; so projects retain context

RetentionUntil you delete the chat or the account

TrainingNever used for model training — contractual with Anthropic

Legal basis (GDPR)Contract (Art. 6(1)(b))

Uploaded files

WhatFiles you attach to chats or projects

WhereSupabase Storage (AWS us-east-1, S3-backed)

WhySo the model can read them; so you can reference them

RetentionUntil you delete the file, the chat, or the project

DeduplicationBy content hash; identical file uploaded twice stores once

Usage telemetry

WhatAggregate metrics: token counts, response times, feature adoption rates

WhereSupabase (aggregated) + application logs (Vercel, transient)

WhyTo meter usage against plan tiers, plan capacity, debug incidents

RetentionApplication logs 30 days; aggregate metrics indefinite (anonymized)

Individual identificationNot correlated to individual identity outside your own dashboard

Payment / billing data

What we storeCard token, last-four, billing address, subscription state

What Stripe storesFull card details (PCI DSS Level 1)

Where (LADLE side)Supabase (AWS us-east-1)

Where (Stripe)Stripe infrastructure (US-hosted)

Retention7 years post-cancellation (tax + finance records)

Impact ledger

WhatPer-user meal contribution history (dates, amounts, WFP reference numbers)

WhereSupabase (AWS us-east-1)

WhySo My Table shows your personal contribution; so business plans can generate impact statements

RetentionDuration of account (personal); indefinite (aggregate contribution to public ledger)

IP addresses

WhatSource IP of your requests

WhereVercel edge logs (transient)

WhyAbuse detection, geographic tax-jurisdiction determination

Retention24 hours

Email delivery records

WhatDelivery timestamps, bounces, spam-marks for transactional email (receipts, notifications, monthly impact statements)

WhereResend (US-hosted)

WhyTo confirm delivery + retry on failure

Retention90 days

COMPLETE DPA + PROCESSING PURPOSES · /LEGAL/DPA · YOUR RIGHTS · /LEGAL/PRIVACY-CHOICES

Account records

WhatEmail, name (if provided), password hash, workspace membership

WhereSupabase (AWS us-east-1)

WhyTo authenticate you and route your data to your account

RetentionDuration of account + 7 years for finance-record purposes

Legal basis (GDPR)Contract (Art. 6(1)(b))

Chat content

WhatUser prompts, model responses, message timestamps, attached-file references

WhereSupabase (AWS us-east-1)

WhySo you can access your history; so projects retain context

RetentionUntil you delete the chat or the account

TrainingNever used for model training — contractual with Anthropic

Legal basis (GDPR)Contract (Art. 6(1)(b))

Uploaded files

WhatFiles you attach to chats or projects

WhereSupabase Storage (AWS us-east-1, S3-backed)

WhySo the model can read them; so you can reference them

RetentionUntil you delete the file, the chat, or the project

DeduplicationBy content hash; identical file uploaded twice stores once

Usage telemetry

WhatAggregate metrics: token counts, response times, feature adoption rates

WhereSupabase (aggregated) + application logs (Vercel, transient)

WhyTo meter usage against plan tiers, plan capacity, debug incidents

RetentionApplication logs 30 days; aggregate metrics indefinite (anonymized)

Individual identificationNot correlated to individual identity outside your own dashboard

Payment / billing data

What we storeCard token, last-four, billing address, subscription state

What Stripe storesFull card details (PCI DSS Level 1)

Where (LADLE side)Supabase (AWS us-east-1)

Where (Stripe)Stripe infrastructure (US-hosted)

Retention7 years post-cancellation (tax + finance records)

Impact ledger

WhatPer-user meal contribution history (dates, amounts, WFP reference numbers)

WhereSupabase (AWS us-east-1)

WhySo My Table shows your personal contribution; so business plans can generate impact statements

RetentionDuration of account (personal); indefinite (aggregate contribution to public ledger)

IP addresses

WhatSource IP of your requests

WhereVercel edge logs (transient)

WhyAbuse detection, geographic tax-jurisdiction determination

Retention24 hours

Email delivery records

WhatDelivery timestamps, bounces, spam-marks for transactional email (receipts, notifications, monthly impact statements)

WhereResend (US-hosted)

WhyTo confirm delivery + retry on failure

Retention90 days

COMPLETE DPA + PROCESSING PURPOSES · /LEGAL/DPA · YOUR RIGHTS · /LEGAL/PRIVACY-CHOICES

Every category of data LADLE holds.

Account records

Chat content

Uploaded files

Usage telemetry

Payment / billing data

Impact ledger

IP addresses

Email delivery records

If a data category exists that isn't listed here, that's a bug.

Every category of data LADLE holds.

Account records

Chat content

Uploaded files

Usage telemetry

Payment / billing data

Impact ledger

IP addresses

Email delivery records

If a data category exists that isn't listed here, that's a bug.