# Data Lifecycle Diagram — Acme Inc

> Auto-generated by Codepliant on 2026-03-19.
> Shows the full data lifecycle from collection through deletion for each data type.
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Lifecycle Overview

All personal data processed by this application follows a defined lifecycle:

**Collection** — Data is gathered from users or systems
**Processing** — Data is used for its intended purpose
**Storage** — Data is persisted with appropriate safeguards
**Sharing** — Data may be transferred to authorized third parties
**Deletion** — Data is removed per retention schedule or on request

## Lifecycle Diagram

```mermaid
graph LR
  subgraph Lifecycle["Data Lifecycle"]
    C["Collection"] --> P["Processing"]
    P --> S["Storage"]
    S --> SH["Sharing"]
    S --> D["Deletion"]
  end

  subgraph DT0["Identity  Account Data"]
    DT0C["Collect"] --> DT0P["Process"]
    DT0P --> DT0S["Store"]
    DT0S --> DT0D["Delete\nUntil account deletion"]
  end

  subgraph DT1["Payment  Billing Data"]
    DT1C["Collect"] --> DT1P["Process"]
    DT1P --> DT1S["Store"]
    DT1S --> DT1D["Delete\n7 years (tax/legal)"]
  end

  subgraph DT2["Behavioral  Analytics Data"]
    DT2C["Collect"] --> DT2P["Process"]
    DT2P --> DT2S["Store"]
    DT2S --> DT2D["Delete\n26 months"]
  end

  subgraph DT3["AI Interaction Data"]
    DT3C["Collect"] --> DT3P["Process"]
    DT3P --> DT3S["Store"]
    DT3S --> DT3D["Delete\n90 days"]
  end

  subgraph DT4["Communication Data"]
    DT4C["Collect"] --> DT4P["Process"]
    DT4P --> DT4S["Store"]
    DT4S --> DT4D["Delete\n3 years"]
  end

  subgraph DT5["Technical  Error Data"]
    DT5C["Collect"] --> DT5P["Process"]
    DT5P --> DT5S["Store"]
    DT5S --> DT5D["Delete\n90 days"]
  end

  subgraph DT6["UserGenerated Content"]
    DT6C["Collect"] --> DT6P["Process"]
    DT6P --> DT6S["Store"]
    DT6S --> DT6D["Delete\nUntil account deletion"]
  end

  style Lifecycle fill:#f0f4ff,stroke:#4a6fa5
  style DT0 fill:#e8f5e9,stroke:#43a047
  style DT1 fill:#fff3e0,stroke:#ef6c00
  style DT2 fill:#e3f2fd,stroke:#1976d2
  style DT3 fill:#fce4ec,stroke:#c62828
  style DT4 fill:#f3e5f5,stroke:#7b1fa2
  style DT5 fill:#e0f7fa,stroke:#00838f
  style DT6 fill:#fff8e1,stroke:#f9a825
```

## Retention Summary

| Data Type | Retention Period | Deletion Trigger |
|-----------|-----------------|------------------|
| Identity & Account Data | Until account deletion | On account deletion request or DSAR |
| Payment & Billing Data | 7 years (tax/legal) | Transaction records retained per legal obligation |
| Behavioral & Analytics Data | 26 months | Automatic expiry after retention period |
| AI Interaction Data | 90 days | Auto-purged after retention window |
| Communication Data | 3 years | Unsubscribe removes from marketing lists |
| Technical & Error Data | 90 days | Automatic expiry |
| User-Generated Content | Until account deletion | On user request or account deletion |

## Detailed Lifecycle per Data Type

### Identity & Account Data

**Sources:** @supabase/supabase-js

| Stage | Description |
|-------|-------------|
| Collection | User registration, OAuth login, profile updates |
| Processing | Authentication, session management, access control |
| Storage | Encrypted at rest in auth provider and local database |
| Sharing | Auth provider only; not shared with third parties |
| Retention | Until account deletion |
| Deletion | On account deletion request or DSAR; cascades to all linked data |

### Payment & Billing Data

**Sources:** stripe, stripe-ios

| Stage | Description |
|-------|-------------|
| Collection | Checkout flow, subscription management, invoicing |
| Processing | Payment tokenization, fraud detection, tax calculation |
| Storage | Tokenized by payment processor; no raw card data stored |
| Sharing | Payment processor, tax authority (as required by law) |
| Retention | 7 years (tax/legal) |
| Deletion | Transaction records retained per legal obligation; tokens revoked on request |

### Behavioral & Analytics Data

**Sources:** posthog

| Stage | Description |
|-------|-------------|
| Collection | Page views, clicks, session recordings, feature usage |
| Processing | Aggregation, segmentation, funnel analysis |
| Storage | Analytics provider cloud infrastructure |
| Sharing | Analytics provider; may be shared with advertising partners |
| Retention | 26 months |
| Deletion | Automatic expiry after retention period; on opt-out via consent preferences |

### AI Interaction Data

**Sources:** openai

| Stage | Description |
|-------|-------------|
| Collection | User prompts, queries, uploaded content for AI processing |
| Processing | Inference, content generation, classification |
| Storage | Temporarily cached by AI provider during processing |
| Sharing | AI provider API; subject to provider data processing terms |
| Retention | 90 days |
| Deletion | Auto-purged after retention window; immediate on DSAR request |

### Communication Data

**Sources:** resend

| Stage | Description |
|-------|-------------|
| Collection | Transactional emails, marketing emails, notifications |
| Processing | Template rendering, delivery tracking, bounce handling |
| Storage | Email service provider logs and delivery records |
| Sharing | Email service provider only |
| Retention | 3 years |
| Deletion | Unsubscribe removes from marketing lists; logs expire per retention |

### Technical & Error Data

**Sources:** @sentry/node

| Stage | Description |
|-------|-------------|
| Collection | Error reports, stack traces, performance metrics, IP addresses |
| Processing | Error grouping, alerting, performance analysis |
| Storage | Monitoring service cloud infrastructure |
| Sharing | Monitoring provider only; may include anonymized IP |
| Retention | 90 days |
| Deletion | Automatic expiry; scrubbed of PII before long-term storage |

### User-Generated Content

**Sources:** prisma

| Stage | Description |
|-------|-------------|
| Collection | File uploads, form submissions, user-created content |
| Processing | Validation, transformation, indexing |
| Storage | Database and/or object storage with encryption at rest |
| Sharing | Not shared externally unless user explicitly shares |
| Retention | Until account deletion |
| Deletion | On user request or account deletion; backups purged within 30 days |

## Lifecycle Stage Details

### Collection

Data is collected through the following channels:

- **Identity & Account Data**: User registration, OAuth login, profile updates
- **Payment & Billing Data**: Checkout flow, subscription management, invoicing
- **Behavioral & Analytics Data**: Page views, clicks, session recordings, feature usage
- **AI Interaction Data**: User prompts, queries, uploaded content for AI processing
- **Communication Data**: Transactional emails, marketing emails, notifications
- **Technical & Error Data**: Error reports, stack traces, performance metrics, IP addresses
- **User-Generated Content**: File uploads, form submissions, user-created content

### Processing

Data is processed for the following purposes:

- **Identity & Account Data**: Authentication, session management, access control
- **Payment & Billing Data**: Payment tokenization, fraud detection, tax calculation
- **Behavioral & Analytics Data**: Aggregation, segmentation, funnel analysis
- **AI Interaction Data**: Inference, content generation, classification
- **Communication Data**: Template rendering, delivery tracking, bounce handling
- **Technical & Error Data**: Error grouping, alerting, performance analysis
- **User-Generated Content**: Validation, transformation, indexing

### Storage

Data is stored with the following safeguards:

- **Identity & Account Data**: Encrypted at rest in auth provider and local database
- **Payment & Billing Data**: Tokenized by payment processor; no raw card data stored
- **Behavioral & Analytics Data**: Analytics provider cloud infrastructure
- **AI Interaction Data**: Temporarily cached by AI provider during processing
- **Communication Data**: Email service provider logs and delivery records
- **Technical & Error Data**: Monitoring service cloud infrastructure
- **User-Generated Content**: Database and/or object storage with encryption at rest

### Sharing

Data sharing is limited to:

- **Identity & Account Data**: Auth provider only; not shared with third parties
- **Payment & Billing Data**: Payment processor, tax authority (as required by law)
- **Behavioral & Analytics Data**: Analytics provider; may be shared with advertising partners
- **AI Interaction Data**: AI provider API; subject to provider data processing terms
- **Communication Data**: Email service provider only
- **Technical & Error Data**: Monitoring provider only; may include anonymized IP
- **User-Generated Content**: Not shared externally unless user explicitly shares

### Deletion

Data deletion follows these procedures:

- **Identity & Account Data**: On account deletion request or DSAR; cascades to all linked data
- **Payment & Billing Data**: Transaction records retained per legal obligation; tokens revoked on request
- **Behavioral & Analytics Data**: Automatic expiry after retention period; on opt-out via consent preferences
- **AI Interaction Data**: Auto-purged after retention window; immediate on DSAR request
- **Communication Data**: Unsubscribe removes from marketing lists; logs expire per retention
- **Technical & Error Data**: Automatic expiry; scrubbed of PII before long-term storage
- **User-Generated Content**: On user request or account deletion; backups purged within 30 days

---

*This data lifecycle diagram is generated from automated code analysis. Actual data flows may include additional processing not captured by code scanning. This does not constitute legal advice. Have this document reviewed by qualified compliance professionals.*
