1. Surface definition and scope
Define exactly what the child brand is, who the controller is, which systems it uses, and whether it inherits the shared baseline without change or introduces a new processing path.
Required inputs
- Brand name, legal entity, public domains, and controller relationship
- Surface types: landing page, app, commerce flow, wallet flow, support flow, or partner portal
- Environments and production entry points
Release questions
- Does the child brand operate under the same controller and support channel as the corporate baseline?
- Does the user move between the child brand and Lucid or another shared product surface?
- Does any public-facing flow materially diverge from the shared legal or privacy baseline?
Required outputs
- Brand scope statement
- Public domain and surface inventory
- Controller relationship note
2. Data categories, purposes, and rights deltas
Capture what the child brand collects, why it collects it, which legal basis or equivalent justification applies, and whether rights handling or timing changes by market.
Required inputs
- Data categories, sensitive-data flags, and purpose mapping
- Legal-basis or authorization assumptions by market
- Retention deltas from the shared schedule
Release questions
- Does the brand collect any data category that is not already described in the shared privacy baseline?
- Does it require a separate rights timeline, denial appeal path, or children-sensitive handling?
- Does the flow create a new localization or transfer obligation for Europe, US states, Latin America, or Israel?
Required outputs
- Privacy-notice delta list
- Rights-routing delta list
- Retention and transfer notes
3. Vendors, subprocessors, and browser technologies
Map every new infrastructure dependency, API, browser-managed script, media provider, messaging provider, and wallet-routing dependency before launch.
Required inputs
- New vendors or subprocessors and their processor classification
- DPA, SCC, transfer, and contract posture
- Browser-storage keys, cookies, and consent-category mapping
Release questions
- Does the child brand add a new processor or platform provider not already in the vendor register?
- Does it introduce a new cookie, local-storage key, analytics tag, or browser-managed widget?
- Do the vendor contracts, deletion posture, and cross-border safeguards stay aligned with the actual production stack?
Required outputs
- Vendor register delta
- Cookie and browser-technology delta
- Contract and transfer review note
4. Security, IAM, and operational controls
Confirm that the child brand stays inside the shared security model or document exactly what has to change for access control, logs, secrets, incident response, and release gating.
Required inputs
- Admin surfaces, privileged roles, and joiner/mover/leaver expectations
- Secrets, integrations, and environment separation
- Incident, backup, and deletion dependencies
Release questions
- Does the brand require a new privileged role or a new production release owner?
- Does the brand create a new incident-handling or log-retention requirement?
- Are there any new secrets, service accounts, or wallet-adjacent infrastructure keys that need separate ownership?
Required outputs
- RBAC and privileged-access delta
- Logging and retention delta
- Incident-response and secret-management delta
5. Public documents and launch gate
Decide whether the child brand can inherit the shared public documents unchanged or needs a brand-specific annex, supplement, or full product-specific notice before release.
Required inputs
- Public-facing notice set needed for the brand
- Market list and regulatory overlays in scope
- Customer-safe evidence summary for launch reviewers
Release questions
- Can the child brand launch under the shared baseline alone, or is a brand-specific annex required?
- Do the trust pages need a new customer-safe disclosure, processor note, or security statement before launch?
- Has legal, privacy, engineering, and operations signoff been recorded for any delta from the shared baseline?
Required outputs
- Approved inheritance or annex decision
- Brand-specific public document checklist
- Launch-ready customer-safe trust summary
