> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organization: Acme Inc

Website: https://acme-saas.com

Last updated: 2026-03-19

Maintained by: Jane Mueller (dpo@acme-saas.com)

This document tracks all changes to our Privacy Policy. We maintain this changelog to comply with GDPR transparency obligations (Art. 12-14) and CCPA/CPRA requirements. Users are notified of material changes as described in Section 3.

> GDPR Requirement: Data subjects must be informed of any changes to how their personal data is processed. Material changes require active notification.

## 1. Version History

Version | Date | Change Type | Summary | Material? | Notification Sent
--- | --- | --- | --- | --- | ---
1.0 | 2026-03-19 | Initial release | Initial privacy policy generated from code scan | Yes | N/A (initial publication)
[1.1] | [DATE] | [TYPE] | [SUMMARY] | [YES/NO] | [YES/NO — DATE]
[1.2] | [DATE] | [TYPE] | [SUMMARY] | [YES/NO] | [YES/NO — DATE]

## 2. Change Type Definitions

Change Type | Description | Material? | Notification Required?
--- | --- | --- | ---
New data collection | Adding new categories of personal data | Yes | Yes — email + banner
New third-party service | Adding a new data processor/sub-processor | Yes | Yes — email + banner
New purpose | Processing data for a new purpose | Yes | Yes — email + banner
Jurisdiction change | Expanding to new geographic regions | Yes | Yes — email + banner
Retention change | Modifying data retention periods | Yes | Yes — email + banner
Rights change | Modifying data subject rights processes | Yes | Yes — email + banner
Legal basis change | Changing lawful basis for processing | Yes | Yes — email + consent re-collection
Service removal | Removing a third-party service | No | No (may notify for transparency)
Clarification | Rewording for clarity, no substantive change | No | No
Formatting | Layout, typo fixes, link updates | No | No
Contact update | Updated DPO/contact information | No | No (update in policy)

## 3. Notification Procedures

### 3.1 Material Changes

When a material change is made to the Privacy Policy:

1. Pre-publication review: Legal Counsel and DPO review the changes
2. Effective date: Set the effective date at least 30 days in the future
3. Email notification: Send notification email to all registered users
4. In-app banner: Display a prominent banner linking to the updated policy
5. Changelog update: Add entry to Section 1 of this document
6. Consent re-collection: If legal basis changed, collect fresh consent before the effective date
7. Archive: Store the previous version in the policy archive (Section 5)

### 3.2 Non-Material Changes

1. Update the Privacy Policy with the new effective date
2. Add entry to Section 1 of this document
3. No user notification required

## 4. Current Privacy Policy Baseline

As of 2026-03-19, the privacy policy covers the following (auto-detected from codebase scan):

### 4.1 Third-Party Services

- @sentry/node
- @supabase/supabase-js
- openai
- posthog
- prisma
- resend
- stripe
- stripe-ios

### 4.2 Data Categories Collected

- IP address
- billing address
- conversation history
- device information
- email
- email addresses
- email content
- error data
- feature flag usage
- generated content
- password hash
- payment information
- session data
- session recordings
- stack traces
- transaction history
- user behavior
- user context
- user data as defined in schema
- user metadata
- user prompts

### 4.3 Processing Features

- AI/ML processing
- Payment processing
- Analytics and tracking
- Authentication and user accounts
- Email communications
- Error monitoring and logging

## 5. Policy Version Archive

Maintain a copy of each version of the Privacy Policy for audit purposes.

Version | Effective Date | Superseded Date | Archive Location
--- | --- | --- | ---
1.0 | 2026-03-19 | Current | PRIVACY_POLICY.md
[0.x] | [DATE] | [DATE] | [ARCHIVE PATH OR URL]

> Best practice: Store archived versions in version control (git) or a dedicated compliance document management system. Each version should be immutable once superseded.

## 6. Review Schedule

Review Type | Frequency | Next Review | Owner
--- | --- | --- | ---
Scheduled review | Quarterly | [DATE] | DPO
Post-deployment review | After each release with data changes | Ongoing | Engineering + DPO
Annual comprehensive review | Annually | [DATE] | Legal + DPO
Regulatory trigger review | When regulations change | As needed | Legal

> Tip: Run `codepliant diff` after each deployment to detect changes that may require a privacy policy update. Integrate into CI/CD for automated detection.

## 7. Contact

For questions about privacy policy changes:

- Data Protection Officer: Jane Mueller (dpo@acme-saas.com)
- General inquiries: legal@acme.com

This Privacy Policy Changelog was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. The baseline in Section 4 is auto-populated from detected services and data types. This template should be maintained by your DPO and reviewed by legal counsel.