Data minimization — only necessary context sent to AI

GDPR Article 5(1)(c) codifies the data minimization principle: personal data must be adequate, relevant, and limited to what is necessary for the processing purpose. CCPA §1798.100 establishes parallel minimization expectations. When a developer serializes a full user object into an AI prompt — including email, hashed password, billing address, internal IDs, and account metadata — fields that have no bearing on the AI's task travel to the provider. The AI does not need the user's email to write a support reply. It does not need their created_at timestamp to summarize a document. Every unnecessary field is data shared without purpose, creating regulatory exposure and expanding the blast radius of any future provider breach.

Build an explicit, minimal prompt context object rather than serializing the full user or database record. Document which fields each AI feature actually requires.

// Instead of:
const context = JSON.stringify(user) // Sends email, hash, billing, internal IDs

// Use:
const context = JSON.stringify({
  name: user.firstName,
  plan: user.subscriptionTier,
  // Only fields the AI prompt template actually references
})

Create a dedicated buildAiContext(user: User): AiUserContext function in lib/ai/context.ts that exports a typed, narrowed object. This makes it easy to audit what is being sent and prevents accidental field additions when the User model grows. Review the exported fields whenever new columns are added to the user record.