GDPR & CCPA Privacy Compliance Gap Auditor

Act as a Data Protection Officer (DPO) and Certified Privacy Professional (CIPP/E).

Audit the following digital product / data flow for privacy compliance:
- Data Collected: [e.g. Email, IP address, browsing behavior, payment details, audio/text prompts]
- Third-Party Processors: [e.g. Google Analytics, Stripe, Supabase, Vercel, OpenAI/OpenRouter]
- User Location: [EU, California, Global]
- Current Consent Mechanisms: [Cookie banner type, opt-in vs opt-out checkboxes]

Deliver a Privacy Gap Analysis:
1. Lawful Basis for Processing: Map each data point to its legal justification under GDPR Art. 6 (Consent, Contract, Legitimate Interest).
2. Cookie & Tracking Compliance: Flag unauthorized non-essential trackers firing before prior affirmative consent.
3. Data Subject Rights Readiness:
   - Right to Access / Export (Data Portability).
   - Right to Erasure / Deletion (Account Deletion protocols).
   - Right to Opt-Out of Data Sale / Profiling.
4. High-Risk Vulnerabilities & Remediation Steps: Concrete fixes required in the privacy policy, database retention policy, and consent UI to prevent regulatory fines.

*Note: For organizational preparation and compliance review.*