gamma-data-handling

name	gamma-data-handling
description	Handle data privacy, retention, and compliance for Gamma integrations. Use when implementing GDPR compliance, data retention policies, or managing user data within Gamma workflows. Trigger with phrases like "gamma data", "gamma privacy", "gamma GDPR", "gamma data retention", "gamma compliance".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>

Gamma Data Handling

Overview

Implement proper data handling, privacy controls, and compliance for Gamma integrations.

Prerequisites

• Understanding of data privacy regulations (GDPR, CCPA)
• Data classification policies
• Legal/compliance team consultation

Data Classification

Gamma Data Types

Type	Classification	Retention	Handling
Presentation content	User data	User-controlled	Encrypted at rest
AI-generated text	Derived data	With source	Standard
User prompts	PII potential	30 days	Anonymize logs
Export files	User data	24 hours cache	Auto-delete
Analytics	Operational	90 days	Aggregate only

Instructions

Step 1: Data Consent Management

// models/consent.ts
interface UserConsent {
  userId: string;
  gammaDataProcessing: boolean;
  aiAnalysis: boolean;
  analytics: boolean;
  consentDate: Date;
  consentVersion: string;
}

async function checkConsent(userId: string, purpose: string): Promise<boolean> {
  const consent = await db.consents.findUnique({
    where: { userId },
  });

  if (!consent) {
    throw new ConsentRequiredError('User consent not obtained');
  }

  switch (purpose) {
    case 'presentation_creation':
      return consent.gammaDataProcessing;
    case 'ai_generation':
      return consent.gammaDataProcessing && consent.aiAnalysis;
    case 'analytics':
      return consent.analytics;
    default:
      return ;
  }
}


  () {
   (! (userId, )) {
      ();
  }

   gamma..(data);
}

Step 2: PII Handling

// lib/pii-handler.ts
interface PIIField {
  field: string;
  type: 'email' | 'name' | 'phone' | 'address' | 'custom';
  action: 'mask' | 'hash' | 'encrypt' | 'remove';
}

const piiFields: PIIField[] = [
  { field: 'email', type: 'email', action: 'mask' },
  { field: 'name', type: 'name', action: 'hash' },
  { field: 'phone', type: 'phone', action: 'mask' },
];

function sanitizeForLogging(data: object): object {
  const sanitized = { ...data };

  for (const pii of piiFields) {
    if (sanitized[pii.field]) {
      switch (pii.action) {
        case 'mask':
          sanitized[pii.field] = (sanitized[pii.]);
          ;
         :
          sanitized[pii.] = (sanitized[pii.]);
          ;
         :
           sanitized[pii.];
          ;
      }
    }
  }

   sanitized;
}

 ():  {
   (value.()) {
    
     [local, domain] = value.();
     ;
  }
  
   value.(, ) +  + value.(value. - );
}

Step 3: Data Retention Policies

// services/data-retention.ts
interface RetentionPolicy {
  dataType: string;
  retentionDays: number;
  action: 'delete' | 'archive' | 'anonymize';
}

const policies: RetentionPolicy[] = [
  { dataType: 'presentation_exports', retentionDays: 1, action: 'delete' },
  { dataType: 'user_prompts', retentionDays: 30, action: 'anonymize' },
  { dataType: 'api_logs', retentionDays: 90, action: 'archive' },
  { dataType: 'presentations', retentionDays: 365, action: 'delete' },
];

async function enforceRetentionPolicies() {
  for (const policy of policies) {
    const cutoffDate = new Date();
    cutoffDate.setDate(cutoffDate.getDate() - policy.retentionDays);

    switch (policy.) {
       :
         (policy., cutoffDate);
        ;
       :
         (policy., cutoffDate);
        ;
       :
         (policy., cutoffDate);
        ;
    }

    .();
  }
}


(, enforceRetentionPolicies);

Step 4: GDPR Data Subject Requests

// services/gdpr.ts
interface DataSubjectRequest {
  userId: string;
  type: 'access' | 'erasure' | 'portability' | 'rectification';
  requestDate: Date;
  status: 'pending' | 'processing' | 'completed';
}

async function handleAccessRequest(userId: string) {
  // Gather all user data
  const userData = {
    account: await db.users.findUnique({ where: { id: userId } }),
    presentations: await db.presentations.findMany({ where: { userId } }),
    exports: await db.exports.findMany({ where: { userId } }),
    consents: await db.consents.findMany({ where: { userId } }),
    activityLogs: await db.activityLogs.findMany({
      where: { userId },
      take: 1000,
    }),
  };

  
   gammaPresentations =  gamma..({
    : { : userId },
  });

   {
    ...userData,
    : gammaPresentations,
    :  ().(),
  };
}

  () {
  
   db..({ : { userId } });
   db..({ : { userId } });
   db..({ : { userId } });

  
   gammaPresentations =  gamma..({
    : { : userId },
  });

   ( p  gammaPresentations) {
     gamma..(p.);
  }

  
   db..({
    : { : userId },
    : {
      : ,
      : ,
      :  (),
    },
  });

   { : , : gammaPresentations. +  };
}

Step 5: Audit Trail

// lib/audit.ts
interface AuditEntry {
  timestamp: Date;
  userId: string;
  action: string;
  resource: string;
  resourceId: string;
  details: object;
  ipAddress: string;
}

async function logAuditEvent(entry: Omit<AuditEntry, 'timestamp'>) {
  await db.auditLog.create({
    data: {
      ...entry,
      timestamp: new Date(),
    },
  });
}

// Usage
await logAuditEvent({
  userId: user.id,
  action: 'PRESENTATION_CREATED',
  resource: 'presentation',
  resourceId: presentation.id,
  details: { title: presentation.title },
  ipAddress: req.ip,
});

Compliance Checklist

• Data processing agreement with Gamma
• User consent mechanism implemented
• PII handling procedures documented
• Data retention policies enforced
• GDPR rights request process ready
• Audit logging enabled
• Data encryption at rest and in transit
• Third-party data sharing documented

Resources

• Gamma Privacy Policy
• Gamma DPA
• GDPR Compliance Guide

Next Steps

Proceed to gamma-enterprise-rbac for access control.