# Data Flow Map

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Last updated:** 2026-03-19

**Project:** nextjs-saas-example

**Company:** Acme Inc

## Related Documents

- Data Flow Diagram (`DATA_FLOW_DIAGRAM.md`)
- Data Dictionary (`DATA_DICTIONARY.md`)
- Privacy Policy (`PRIVACY_POLICY.md`)

---

> This document maps how personal data flows through the application — where it is collected, where it is stored, and which third parties it is shared with. Generated by automated code analysis.

## Data Collection Points

The following entry points collect personal data from users:

| Source | Data Collected | Mechanism |
|--------|---------------|-----------|
| User registration/login | email, password hash, session data, user metadata | via @supabase/supabase-js |
| AI-powered feature usage | user prompts, conversation history, generated content | via openai |
| Email subscription/contact forms | email addresses, email content | via resend |
| Payment checkout | payment information, billing address, email, transaction history | via stripe |
| Payment checkout | payment information, billing address, email, transaction history | via stripe-ios |

## Data Storage

The following services and systems store personal data:

| Storage System | Category | Data Stored |
|---------------|----------|-------------|
| prisma | Database | user data as defined in schema |
| Database schema | Personal Identity Data | @supabase/supabase-js, User.name |
| Database schema | Contact Information | User.email, User.phone |
| Database schema | Authentication Data | User.passwordHash |

## Third-Party Data Sharing

The following third-party services receive personal data:

| Third Party | Category | Data Shared |
|------------|----------|-------------|
| @sentry/node | Error Monitoring | error data, stack traces, user context, device information, IP address |
| openai | AI Service | user prompts, conversation history, generated content |
| posthog | Analytics | user behavior, session recordings, feature flag usage, device information |
| resend | Email Service | email addresses, email content |
| stripe | Payment Processing | payment information, billing address, email, transaction history |
| stripe-ios | Payment Processing | payment information, billing address, email, transaction history |

## Summary

Data Flow Summary:

COLLECTION:
- User registration/login → email, password hash, session data, user metadata (via @supabase/supabase-js)
- AI-powered feature usage → user prompts, conversation history, generated content (via openai)
- Email subscription/contact forms → email addresses, email content (via resend)
- Payment checkout → payment information, billing address, email, transaction history (via stripe)
- Payment checkout → payment information, billing address, email, transaction history (via stripe-ios)

STORAGE:
- prisma (Database) → user data as defined in schema
- Database schema (Personal Identity Data) → @supabase/supabase-js, User.name
- Database schema (Contact Information) → User.email, User.phone
- Database schema (Authentication Data) → User.passwordHash

SHARING (Third Parties):
- @sentry/node → error data, stack traces, user context, device information, IP address
- openai → user prompts, conversation history, generated content
- posthog → user behavior, session recordings, feature flag usage, device information
- resend → email addresses, email content
- stripe → payment information, billing address, email, transaction history
- stripe-ios → payment information, billing address, email, transaction history

---

*This data flow map was generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on automated code analysis. Review and verify against your actual data processing activities.*