← Playbooks

The privacy-first analytics approval pack

For product ops and platform leads who need sign-off from legal, the DPO, and possibly a works council before measuring internal tools. Each section below is written to be lifted into your own documents and forwarded to counsel — the fastest privacy review is the one you arrive at prepared.

July 21, 2026 · Playbook · 11 min read

Part 1: the data-flow description (DPIA input)

Your DPIA's core is an accurate description of what's collected and what never is. For an anonymous-by-design deployment, the honest inventory is short:

Key DPIA arguments this design supports: the purpose is product improvement, not performance monitoring (write this explicitly — it's the works council's first question); the data is pseudonymous-to-anonymous with no realistic re-identification path; retention is bounded and configurable; and cohort views enforce a k-anonymity floor (any breakdown smaller than five visitors is withheld entirely — no counts, no ratings), which is the technical control that turns "aggregate only" from a promise into a property.

Part 2: the works-council / employee-relations FAQ

Publish answers before the questions circulate. The six that always come:

• "Can my manager see what I did?" No. There are no per-person views to show. The system stores a random visitor ID that maps to no directory, and any slice smaller than five people displays nothing.
• "Is this performance monitoring?" No — structurally, not just by policy. Data that could grade an individual is never collected, so no future policy change can repurpose it.
• "What about the feedback I type?" Comments are voluntary and anonymous. Write nothing you don't want read; the system neither knows nor records who wrote it.
• "What about screenshots and form values?" Only attached when you explicitly opt in, per submission (Part 3). Never captured in the background.
• "Can I opt out?" Browser Do-Not-Track and Global Privacy Control signals are honored automatically; feedback is opt-in by nature.
• "Who sees the results?" Product owners see aggregates and anonymous comments — the same view leadership sees, just scoped. Nobody sees individuals, because individuals don't exist in the data.

Part 3: the consent & scrubbing architecture (for the technical reviewer)

The two "risky-sounding" features — screenshots and form-value attachments — are exactly where a prepared explanation wins the meeting:

1. Screenshots are user-initiated, browser-mediated, and minimized. The user explicitly chooses to attach one; capture goes through the browser's native share prompt (the OS-level consent surface), the widget hides itself from the shot, and the image is downscaled to ≤1280px JPEG before upload.
2. Form values are double-scrubbed. If a user opts to attach their form entries, passwords, hidden fields, and sensitive-pattern names (card, cvv, ssn, token) are stripped client-side before transmission, then the server re-scrubs on receipt — defense in depth against a missed pattern. Teams exclude anything else with a data-feedback-ignore attribute.
3. Widget tokens are signed and rate-capped, so the collection endpoint can't be repurposed to hoover data from outside the deployed products.

The principle to state in the meeting: consent is per-action and visible, scrubbing is layered, and the default for everything is off.

Part 4: pre-answered security questionnaire

The rows your security team will ask about, ready to paste: hosting and encryption posture, retention windows and erasure mechanics (visitor export and deletion on request), role-based access with owner/admin/member/viewer tiers and a full audit trail, SAML SSO with domain discovery, passwordless authentication, signed webhooks, and the public documentation of all of it. For Morvero specifically, point reviewers at the living pages — /security and /privacy — rather than a PDF that ages; "SOC 2 Type I in progress" and current control status live there.

The approval sequence that works

1. DPO first, informally. Walk through Parts 1 and 3 before writing anything formal; their edits become your DPIA.
2. Works council with the FAQ, not a demo. Demos show dashboards, which look like surveillance; the FAQ shows what can't happen, which is the actual reassurance.
3. Security review in parallel, seeded with Part 4.
4. Announce before first data. A short employee note — what's measured, what isn't, link to the FAQ — costs nothing and buys the trust that makes feedback volumes actually materialize. Measurement people trust produces data worth trusting.