Data Protection Impact Assessment (DPIA) — template

This template helps a Furx Pro / Team / Enterprise customer document a DPIA for the optional features that move data to the Furx cloud: persona packs (distilled from your approved cloud traces). Cloud features are opt-in per project and OFF by default; if you never enable them, no prompt/response content leaves your machine and this DPIA is not required.

1 · Processing overview

Controller	You (the customer / your organization).
Processor	INVERSO HUB S.R.L. (Furx), using Cloudflare as sub-processor.
Purpose	Observability of your own LLM calls (traces) and distillation of a reusable system prompt from interactions you explicitly approved (persona packs).
Lawful basis	Legitimate interest / contract performance. You decide what to upload; consent is captured per project via the opt-in toggle.
Data subjects	You and anyone whose data appears in the prompts/responses you choose to upload.

2 · Data flows

BYOK is preserved. Provider API keys never leave your device and are never sent to Furx — they go straight to the LLM provider. See BYOK.
Traces. When cloud_traces_enabled is on for a project, each LLM call's metadata (model, provider, tokens, latency, status) and an optional sanitized payload (prompt + response) are uploaded to Furx.
Two-pass PII sanitizer. The desktop client redacts known secret/PII patterns (API keys, bearer tokens, emails, IBAN, ARNs, GUIDs) before upload; the Cloudflare Worker re-runs the same pass server-side. Redaction hits are logged as evidence.
Persona packs. Distillation reads only traces you marked approved, and a frontier model produces a short system prompt + a literal subset of your approved examples. Nothing else is read.

3 · Storage, retention & location

Metadata is stored in Cloudflare D1; payloads/pack blobs in Cloudflare R2 (encrypted at rest).
Retention is automatic by tier via R2 Object Lifecycle: Free 7 days, Pro 30, Team 90, Enterprise 365.
Processing runs on Cloudflare's global edge. Choose a regional jurisdiction with Cloudflare data-localization controls if required.
You can delete a project at any time; deletion cascades to its traces, packs and replay sets.

4 · Sub-processors

See the live list at furx.cloud/subprocessors. Primary: Cloudflare, Inc. (Workers, D1, R2, Workers AI). Server-side distillation/eval uses Cloudflare Workers AI (no third-party LLM vendor receives your data for these jobs).

5 · Data-subject rights

Access / portability: Pro+ can export traces as NDJSON; packs export as signed JSON (Enterprise).
Erasure: delete the project (cascade) or disable cloud traces; retention windows bound residual copies.
Audit: an append-only audit log records every cloud action (a DPO viewer is available for Team/Enterprise).

6 · Risks & mitigations

Risk	Mitigation
PII leaks into uploaded payloads	Two-pass sanitizer (client + Worker); opt-in OFF by default; only approved traces feed packs.
Provider key exposure	BYOK — keys never reach Furx; stored in OS Keychain only.
Over-retention	Automatic tier-based R2 lifecycle deletion.
Unauthorized access	Per-user row-level scoping on every endpoint; session tokens; HMAC-signed exports.
Re-identification via distilled prompt	Packs cite only approved examples; you review a side-by-side preview before applying.

7 · Conclusion

With opt-in defaults, two-pass sanitization, automatic retention and per-user scoping, the residual risk for the persona pack feature is assessed as low for a customer who keeps PII out of uploaded payloads. Re-run this DPIA if you enable cloud features for projects handling special-category data.

Disclaimer: this is a template to accelerate your own assessment — it is not legal advice. Adapt it with your DPO / counsel for your jurisdiction and data. Related: audit log, privacy, DPA.