--- name: gamma-data-handling-a912653e85e3 description: | Handle data privacy, retention, and compliance for Gamma integrations. Use when implementing GDPR compliance, data retention policies, or managing user data within Gamma workflows. Trigger with phrases like "gamma data", "gamma privacy", "gamma GDPR", "gamma data retention", "gamma compliance". allowed-tools: Read, Write, Edit version: 1.0.0 license: MIT author: Jeremy Longshore --- # Gamma Data Handling ## Overview Implement proper data handling, privacy controls, and compliance for Gamma integrations. ## Prerequisites - Understanding of data privacy regulations (GDPR, CCPA) - Data classification policies - Legal/compliance team consultation ## Data Classification ### Gamma Data Types | Type | Classification | Retention | Handling | |------|----------------|-----------|----------| | Presentation content | User data | User-controlled | Encrypted at rest | | AI-generated text | Derived data | With source | Standard | | User prompts | PII potential | 30 days | Anonymize logs | | Export files | User data | 24 hours cache | Auto-delete | | Analytics | Operational | 90 days | Aggregate only | ## Instructions ### Step 1: Data Consent Management ```typescript // models/consent.ts interface UserConsent { userId: string; gammaDataProcessing: boolean; aiAnalysis: boolean; analytics: boolean; consentDate: Date; consentVersion: string; } async function checkConsent(userId: string, purpose: string): Promise { const consent = await db.consents.findUnique({ where: { userId }, }); if (!consent) { throw new ConsentRequiredError('User consent not obtained'); } switch (purpose) { case 'presentation_creation': return consent.gammaDataProcessing; case 'ai_generation': return consent.gammaDataProcessing && consent.aiAnalysis; case 'analytics': return consent.analytics; default: return false; } } // Usage before Gamma operations async function createPresentation(userId: string, data: object) { if (!await checkConsent(userId, 'presentation_creation')) { throw new Error('Consent required for presentation creation'); } return gamma.presentations.create(data); } ``` ### Step 2: PII Handling ```typescript // lib/pii-handler.ts interface PIIField { field: string; type: 'email' | 'name' | 'phone' | 'address' | 'custom'; action: 'mask' | 'hash' | 'encrypt' | 'remove'; } const piiFields: PIIField[] = [ { field: 'email', type: 'email', action: 'mask' }, { field: 'name', type: 'name', action: 'hash' }, { field: 'phone', type: 'phone', action: 'mask' }, ]; function sanitizeForLogging(data: object): object { const sanitized = { ...data }; for (const pii of piiFields) { if (sanitized[pii.field]) { switch (pii.action) { case 'mask': sanitized[pii.field] = maskValue(sanitized[pii.field]); break; case 'hash': sanitized[pii.field] = hashValue(sanitized[pii.field]); break; case 'remove': delete sanitized[pii.field]; break; } } } return sanitized; } function maskValue(value: string): string { if (value.includes('@')) { // Email masking const [local, domain] = value.split('@'); return `${local[0]}***@${domain}`; } // Generic masking return value.substring(0, 2) + '***' + value.substring(value.length - 2); } ``` ### Step 3: Data Retention Policies ```typescript // services/data-retention.ts interface RetentionPolicy { dataType: string; retentionDays: number; action: 'delete' | 'archive' | 'anonymize'; } const policies: RetentionPolicy[] = [ { dataType: 'presentation_exports', retentionDays: 1, action: 'delete' }, { dataType: 'user_prompts', retentionDays: 30, action: 'anonymize' }, { dataType: 'api_logs', retentionDays: 90, action: 'archive' }, { dataType: 'presentations', retentionDays: 365, action: 'delete' }, ]; async function enforceRetentionPolicies() { for (const policy of policies) { const cutoffDate = new Date(); cutoffDate.setDate(cutoffDate.getDate() - policy.retentionDays); switch (policy.action) { case 'delete': await deleteExpiredData(policy.dataType, cutoffDate); break; case 'archive': await archiveExpiredData(policy.dataType, cutoffDate); break; case 'anonymize': await anonymizeExpiredData(policy.dataType, cutoffDate); break; } console.log(`Retention enforced for ${policy.dataType}`); } } // Run daily scheduleJob('0 2 * * *', enforceRetentionPolicies); ``` ### Step 4: GDPR Data Subject Requests ```typescript // services/gdpr.ts interface DataSubjectRequest { userId: string; type: 'access' | 'erasure' | 'portability' | 'rectification'; requestDate: Date; status: 'pending' | 'processing' | 'completed'; } async function handleAccessRequest(userId: string) { // Gather all user data const userData = { account: await db.users.findUnique({ where: { id: userId } }), presentations: await db.presentations.findMany({ where: { userId } }), exports: await db.exports.findMany({ where: { userId } }), consents: await db.consents.findMany({ where: { userId } }), activityLogs: await db.activityLogs.findMany({ where: { userId }, take: 1000, }), }; // Include Gamma-stored data const gammaPresentations = await gamma.presentations.list({ filter: { externalUserId: userId }, }); return { ...userData, gammaData: gammaPresentations, exportedAt: new Date().toISOString(), }; } async function handleErasureRequest(userId: string) { // Delete from our database await db.presentations.deleteMany({ where: { userId } }); await db.exports.deleteMany({ where: { userId } }); await db.activityLogs.deleteMany({ where: { userId } }); // Request deletion from Gamma const gammaPresentations = await gamma.presentations.list({ filter: { externalUserId: userId }, }); for (const p of gammaPresentations) { await gamma.presentations.delete(p.id); } // Anonymize remaining data await db.users.update({ where: { id: userId }, data: { email: `deleted_${Date.now()}@anonymized.local`, name: 'Deleted User', deletedAt: new Date(), }, }); return { success: true, deletedCount: gammaPresentations.length + 1 }; } ``` ### Step 5: Audit Trail ```typescript // lib/audit.ts interface AuditEntry { timestamp: Date; userId: string; action: string; resource: string; resourceId: string; details: object; ipAddress: string; } async function logAuditEvent(entry: Omit) { await db.auditLog.create({ data: { ...entry, timestamp: new Date(), }, }); } // Usage await logAuditEvent({ userId: user.id, action: 'PRESENTATION_CREATED', resource: 'presentation', resourceId: presentation.id, details: { title: presentation.title }, ipAddress: req.ip, }); ``` ## Compliance Checklist - [ ] Data processing agreement with Gamma - [ ] User consent mechanism implemented - [ ] PII handling procedures documented - [ ] Data retention policies enforced - [ ] GDPR rights request process ready - [ ] Audit logging enabled - [ ] Data encryption at rest and in transit - [ ] Third-party data sharing documented ## Resources - [Gamma Privacy Policy](https://gamma.app/privacy) - [Gamma DPA](https://gamma.app/dpa) - [GDPR Compliance Guide](https://gdpr.eu/) ## Next Steps Proceed to `gamma-enterprise-rbac` for access control. --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/gamma-pack/skills/gamma-data-handling/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/plugins-community/plugins/saas-packs/gamma-pack/skills/gamma-data-handling/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Legal, Marketing, Product Management Roles: Compliance Officer, Data Analyst, Growth Marketer, Product Manager, Technical Product Manager Specialties: API Tools: Gamma Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 4d950e4f355914ec83e3d8237d105c5f4cb00a12826a425e4e843a55f434f94f