Audit your personal-data inventory against the GDPR, then write its Article 30 record
Paste one product's data inventory - a row per data item or store, with its purpose, lawful basis, retention, recipients and location - and a few notes on how the product works. Your browser flags Art. 9 and Art. 10 data, missing lawful bases, retention that is missing or too long, transfers outside the EEA with no safeguard, weak password hashing, unmasked logs and production data in staging, and reads whether a DPIA is needed. Free, before you sign in, and nothing is uploaded. Then the audit lane writes the findings with the article and the fix, and the record lane writes the Article 30 record of processing activities.
The companies and their inventories are invented. Two are audits (the fitness app also carries its Article 30 record, one click after the audit) and one is a record; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
What this does, and what it does not
Most GDPR trouble is not exotic. It is a health field collected on a plain consent checkbox, a vendor in a third country with no transfer mechanism, a table nobody ever set a retention period for, passwords hashed with a fast hash, request bodies in the server log, and a staging database refreshed from production. The two skills behind this page say what to look for: every store of personal data needs a purpose, a lawful basis and a retention period set at design time; special-category data needs an Art. 9(2) condition on top of the Art. 6 basis; transfers need an adequacy decision or SCCs; sensitive data is encrypted and passwords are hashed with Argon2id or bcrypt; logs mask IPs; a DPIA comes before high-risk processing; and the record of processing activities is kept current. This page does the reading it can from your paste and shows how it got each flag.
The paid lanes see up to 60 inventory rows with the page's reading of each, your notes (the middle lines dropped past about 6,000 characters, and the page says so) and the page's flags. Your input stays in this browser unless you run a lane. Every reply is held to your input: quotes are checked word for word, every row id must be one of the page's, and no lawful basis, retention period, safeguard or count may be invented - missing ones are written as [placeholders]. It assesses the inventory as written, not your real practice, and it is not legal advice. Derived from the agent skills @wshobson/gdpr-data-handling (wshobson/agents, MIT, by Seth Hobson: data categories, lawful bases, data-subject rights, retention, breach notification, the compliance checklist) and @github/gdpr-compliant (github/awesome-copilot, MIT: the engineering rules from Arts. 5, 25, 32, 33 and 35, the retention defaults, the record of processing activities). Sources are listed in llms.txt.