Controllers must provide a reasonably accessible, clear and meaningful privacy notice covering the categories of personal data processed; the purposes for each category; the 325M.14 rights and how and where to exercise and appeal them; the categories of personal data sold to or shared with third parties and the categories of those third parties; contact information including an active email address or other online mechanism; a description of retention policies; and the date last updated. It must be available in each language in which the controller provides the product or service, accessible to people with disabilities, and posted through a conspicuous hyperlink using the word "privacy" on the home page or app store or download page (and in an app's settings menu), or through a regularly used medium where there is no website; a general notice suffices if it contains everything required.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.