# Personal data

Personal data is anything that identifies a living person, directly or in combination with something else — which in a communications system means almost everything, since a message is personal data about its sender before anyone reads a word of it. The useful discipline is knowing every place it accumulates, because copies are what turn a manageable set into an unmanageable one.

- **Status:** Reference
- **Audience:** both
- **Last verified:** 2026-09-10
- **Canonical:** https://connectbyjbrh.com/docs/technology/pii/

## The definition is wider than the obvious fields

People reach for names, addresses and telephone numbers. Those qualify, but so does anything that singles somebody out in combination with something else you hold: a mailbox identifier, a call at a particular minute, a note that a named company's only director objected to a price. Free text is the richest source of all and the hardest to survey.

Two categories deserve separate handling because their sensitivity is not proportional to their size. Content — what somebody actually wrote or said — carries whatever they chose to disclose. Metadata — who contacted whom, when and how often — reveals relationships that content alone would not.

## Where it accumulates in a system like Connect

| Store | Holds | Why it grows |
|---|---|---|
| Threads and messages | Content and metadata for every conversation worked on | Every inbound and outbound message |
| Contacts and identities | A person, and each address on each channel that resolves to them | Cross-channel identity resolution deliberately joins them up |
| Call transcripts and summaries | What was said on a call, and the summary derived from it | Every call |
| Memory, four tiers | What Connect has learned about a business and its people | Conversations and calls generate it |
| Files | Whatever a document contains, plus its extracted text | Uploads, and files Connect creates |
| Prospect research | Public-source findings about organisations and people | Discovery runs |
| The audit trail | Who decided what, under which rule — deliberately not the message body | Every decision, including refusals |
| Exports | A snapshot of any of the above, outside the system's controls | Somebody pressing export |

> **Careful** The last row is the one to watch. Every control described on this page stops at the moment a CSV leaves the product.

## Does Connect use personal data, and under what rules?

It cannot avoid handling it — reading a business's mail is handling personal data by definition. What matters is which handling rules are actually implemented rather than promised:

- **Isolation, three times.** The customer allowlist, the workspace kernel and PostgreSQL row-level security each restrict a request to one workspace's rows.
- **Credentials are sealed on save** and never echoed back to a screen, so a screenshot of a settings page cannot leak one.
- **Remote images in mail are proxied** rather than fetched by your browser, so opening a message does not tell the sender you opened it.
- **Names are scrubbed on the way out** of the written relationship summary, so a generated narrative does not carry identifiers it did not need.
- **The audit trail references records rather than copying their content**, which keeps the same personal data from acquiring a second retention rule.
- **Memory is readable and erasable by a person** at every tier, from the mailbox row, the channel screen or the contact panel.
- **Do-not-contact and suppression are checked in one place** before any outreach, and the Connect Assistant cannot clear a do-not-contact entry.

## The rules that keep the set from spreading

1. **Reference rather than copy.** A second store of the same data has a second lifetime, a second permission model and a second chance to leak.
2. **Keep content out of anything designed to be read widely** — logs, metrics, error reports, audit entries.
3. **Make erasure reach the derived records.** Deleting a contact and leaving the memory about them is not erasure; the memory viewer exists so that second half is possible by hand.
4. **Treat an export as a release.** It leaves with none of the controls it had inside.
5. **Prefer a gap to a guess.** Connect does not pattern-generate email addresses; a prospect with no discoverable address stays a researched prospect with a different next action rather than becoming a plausible address that belongs to a real stranger.

## Questions

### Can I see everything Connect has learned about one person?

Yes. Memory resolves over four tiers — workspace, channel, endpoint, contact — and a person can read what is held at every tier and forget any of it. The viewer is reachable from the mailbox row, the channel screen and the contact panel, so you do not have to go looking for a separate administration screen.

### Does the audit trail contain personal data?

It contains who decided what and under which rule, which is personal data about the people who used the system. It deliberately does not copy the content of the messages it describes, because that would give the same material two retention rules and two access rules.

### What happens to personal data when I export it?

It becomes yours to control entirely. The isolation, the access rules and the retention that applied inside stop at the export boundary. That is a reason to be deliberate about who can export and where the file goes, not a reason to avoid exporting.

## Related

- [What is kept and for how long](https://connectbyjbrh.com/docs/security/data-retention/)
- [Seeing what Connect knows](https://connectbyjbrh.com/docs/memory/viewing/)
- [Privacy inside the product](https://connectbyjbrh.com/docs/product/privacy-in-the-product/)
- [Data residency](https://connectbyjbrh.com/docs/technology/data-residency/)
- [Export your data](https://connectbyjbrh.com/docs/how-to/export-your-data/)

## What this page is based on

- `docs-source/sources/GENERAL.md` §6, §9 and §10 — memory, files, security
- `docs-source/sources/CHANNELS.md` §1, §4 and §5 — rendering, compliance, story scrubbing
- Connect capability registry (docs-source/facts.py)