> Document Version: 1.0 Document Owner: Acme Inc Generated: 2026-03-19 by Codepliant Next Review Date: 2027-03-19

This register provides a complete inventory of personal data processing activities

in compliance with GDPR Article 30 (Records of Processing Activities).

## 1. Data Controller Information

Field | Details
--- | ---
Data Controller | Acme Inc
Contact Email | legal@acme.com
Data Protection Officer | Jane Mueller
DPO Email | dpo@acme-saas.com
EU Representative | Acme EU Compliance GmbH, Friedrichstr. 123, 10117 Berlin
Website | https://acme-saas.com
Register Last Updated | 2026-03-19

## 2. Data Inventory

# | Data Element | Sensitivity | Source | Storage Location | Shared With | Lawful Basis | Retention
--- | --- | --- | --- | --- | --- | --- | ---
1 | error data | General | Application-collected | @sentry/node (third-party) | @sentry/node, posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
2 | stack traces | General | Application-collected | @sentry/node (third-party) | @sentry/node, posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
3 | user context | General | Application-collected | @sentry/node (third-party) | @sentry/node, posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
4 | device information | Indirectly Identifiable | Automatic collection (HTTP request) | @sentry/node (third-party) | @sentry/node, posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
5 | IP address | Directly Identifiable | Automatic collection (HTTP request) | @sentry/node (third-party) | @sentry/node, posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
6 | email | Directly Identifiable | User-provided (registration/form) | @supabase/supabase-js (third-party) | @supabase/supabase-js, stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
7 | password hash | Security Credential | Application-collected | @supabase/supabase-js (third-party) | @supabase/supabase-js, stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
8 | session data | General | Automatic collection (cookies/SDK) | @supabase/supabase-js (third-party) | @supabase/supabase-js, stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
9 | user metadata | General | Application-collected | @supabase/supabase-js (third-party) | @supabase/supabase-js, stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
10 | user prompts | General | User-provided / Application-generated | openai (third-party) | openai | Consent / Legitimate interest | 365 days
11 | conversation history | General | User-provided / Application-generated | openai (third-party) | openai | Consent / Legitimate interest | 365 days
12 | generated content | General | User-provided / Application-generated | openai (third-party) | openai | Consent / Legitimate interest | 365 days
13 | user behavior | General | Automatic collection (analytics SDK) | posthog (third-party) | posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
14 | session recordings | General | Automatic collection (cookies/SDK) | posthog (third-party) | posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
15 | feature flag usage | General | Automatic collection (analytics SDK) | posthog (third-party) | posthog | Legitimate interest (Art. 6(1)(f)) | 365 days
16 | user data as defined in schema | General | Application-collected | prisma (third-party) | prisma | Contract performance (Art. 6(1)(b)) | 365 days
17 | email addresses | Directly Identifiable | User-provided (registration/form) | resend (third-party) | resend | Contract performance / Consent | 365 days
18 | email content | Directly Identifiable | User-provided (registration/form) | resend (third-party) | resend | Contract performance / Consent | 365 days
19 | payment information | Financial | User-provided (checkout) | stripe (third-party) | stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
20 | billing address | Directly Identifiable | User-provided (registration/form) | stripe (third-party) | stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
21 | transaction history | General | Application-collected | stripe (third-party) | stripe, stripe-ios | Contract performance (Art. 6(1)(b)) | 365 days
22 | Personal Identity Data | General | @supabase/supabase-js | Application database | Internal only | To be determined | 365 days
23 | Financial Data | Financial | stripe | Application database | Internal only | To be determined | 365 days
24 | Usage & Behavioral Data | General | posthog | Application database | Internal only | To be determined | 365 days
25 | AI Interaction Data | General | openai | Application database | Internal only | To be determined | 365 days
26 | Communication Data | General | resend | Application database | Internal only | To be determined | 365 days
27 | Technical & Diagnostic Data | General | @sentry/node | Application database | Internal only | To be determined | 365 days
28 | Stored User Data | General | prisma | Application database | Internal only | To be determined | 365 days
29 | Contact Information | General | User.email | Application database | Internal only | To be determined | 365 days
30 | Authentication Data | General | User.passwordHash | Application database | Internal only | To be determined | 365 days

## 3. Data Flow Summary

### General

Data Element | Source | Destination
--- | --- | ---
error data | Application-collected | @sentry/node, posthog
stack traces | Application-collected | @sentry/node, posthog
user context | Application-collected | @sentry/node, posthog
session data | Automatic collection (cookies/SDK) | @supabase/supabase-js, stripe, stripe-ios
user metadata | Application-collected | @supabase/supabase-js, stripe, stripe-ios
user prompts | User-provided / Application-generated | openai
conversation history | User-provided / Application-generated | openai
generated content | User-provided / Application-generated | openai
user behavior | Automatic collection (analytics SDK) | posthog
session recordings | Automatic collection (cookies/SDK) | posthog
feature flag usage | Automatic collection (analytics SDK) | posthog
user data as defined in schema | Application-collected | prisma
transaction history | Application-collected | stripe, stripe-ios
Personal Identity Data | @supabase/supabase-js | Application database
Usage & Behavioral Data | posthog | Application database
AI Interaction Data | openai | Application database
Communication Data | resend | Application database
Technical & Diagnostic Data | @sentry/node | Application database
Stored User Data | prisma | Application database
Contact Information | User.email | Application database
Authentication Data | User.passwordHash | Application database

### Indirectly Identifiable

Data Element | Source | Destination
--- | --- | ---
device information | Automatic collection (HTTP request) | @sentry/node, posthog

### Directly Identifiable

Data Element | Source | Destination
--- | --- | ---
IP address | Automatic collection (HTTP request) | @sentry/node, posthog
email | User-provided (registration/form) | @supabase/supabase-js, stripe, stripe-ios
email addresses | User-provided (registration/form) | resend
email content | User-provided (registration/form) | resend
billing address | User-provided (registration/form) | stripe, stripe-ios

### Security Credential

Data Element | Source | Destination
--- | --- | ---
password hash | Application-collected | @supabase/supabase-js, stripe, stripe-ios

### Financial

Data Element | Source | Destination
--- | --- | ---
payment information | User-provided (checkout) | stripe, stripe-ios
Financial Data | stripe | Application database

## 4. Third-Party Processors

Processor | Data Shared | Purpose | DPA Status
--- | --- | --- | ---
@sentry/node | error data, stack traces, user context, device information, IP address | monitoring | ⬜ To be verified
posthog | error data, stack traces, user context, device information, IP address, user behavior, session recordings, feature flag usage | analytics | ⬜ To be verified
@supabase/supabase-js | email, password hash, session data, user metadata | auth | ⬜ To be verified
stripe | email, password hash, session data, user metadata, payment information, billing address, transaction history | payment | ⬜ To be verified
stripe-ios | email, password hash, session data, user metadata, payment information, billing address, transaction history | payment | ⬜ To be verified
openai | user prompts, conversation history, generated content | ai | ⬜ To be verified
prisma | user data as defined in schema | database | ⬜ To be verified
resend | email addresses, email content | email | ⬜ To be verified

## 5. International Data Transfers

Processor | Transfer Destination | Safeguard Mechanism | Status
--- | --- | --- | ---
@sentry/node | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
posthog | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
@supabase/supabase-js | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
stripe | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
stripe-ios | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
openai | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
prisma | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed
resend | To be verified | SCCs / Adequacy Decision | ⬜ To be assessed

## 6. Retention Schedule

Data Category | Retention Period | Deletion Method | Legal Basis for Retention
--- | --- | --- | ---
General | 365 days | Automated purge + manual verification | Legitimate interest (Art. 6(1)(f))
Indirectly Identifiable | 365 days | Automated purge + manual verification | Legitimate interest (Art. 6(1)(f))
Directly Identifiable | 365 days | Automated purge + manual verification | Legitimate interest (Art. 6(1)(f))
Security Credential | 365 days | Automated purge + manual verification | Contract performance (Art. 6(1)(b))
Financial | 365 days | Automated purge + manual verification | Contract performance (Art. 6(1)(b))

This data mapping register is generated from automated code analysis and should be reviewed by your Data Protection Officer and legal team. It may not capture all data processing activities, particularly those conducted outside the scanned codebase. This does not constitute legal advice.