> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Organization: Acme Inc

Project: nextjs-saas-example

This document maps API endpoints to the types of personal data they process, providing transparency for privacy compliance. Each endpoint is linked to the relevant section of the Privacy Policy.

For questions about API data handling, contact legal@acme.com.

## Overview

Total API endpoints detected: 2

Metric | Count
--- | ---
Endpoints accepting user data | 0
Write endpoints (POST/PUT/PATCH/DELETE) | 2
Read-only endpoints (GET/QUERY) | 0

## Endpoint Summary

Endpoint | Method | Data Fields | Privacy Category
--- | --- | --- | ---
`/api/chat` | POST | — | —
`/api/checkout` | POST | — | —

## Privacy Policy Mapping

The following table maps data categories collected through the API to the corresponding sections in your Privacy Policy.

Data Category | Privacy Policy Section | Legal Basis (GDPR) | Retention
--- | --- | --- | ---
Personal Identity Data | Personal Information We Collect | Contractual necessity (Art. 6(1)(b)) | Duration of account + [X] days
Financial Data | [Map to relevant section] | [Determine legal basis] | [Define retention period]
Usage & Behavioral Data | Automatically Collected Information | Legitimate interest (Art. 6(1)(f)) | [X] days
AI Interaction Data | AI and Automated Processing | Contractual necessity / Consent | [X] days
Communication Data | Communications | Contractual necessity (Art. 6(1)(b)) | [X] days
Technical & Diagnostic Data | Automatically Collected Information | Legitimate interest (Art. 6(1)(f)) | [X] days
Stored User Data | [Map to relevant section] | [Determine legal basis] | [Define retention period]
Contact Information | [Map to relevant section] | [Determine legal basis] | [Define retention period]
Authentication Data | [Map to relevant section] | [Determine legal basis] | [Define retention period]

## Detailed Endpoint Documentation

### `POST /api/chat`

Property | Value
--- | ---
File | `src/app/api/chat/route.ts`
Method | POST
Route | `/api/chat`
Data fields | None detected

### `POST /api/checkout`

Property | Value
--- | ---
File | `src/app/api/checkout/route.ts`
Method | POST
Route | `/api/checkout`
Data fields | None detected

## API Data Flow to Third-Party Services

The following third-party services may receive data submitted through the API.

Service | Category | Data Shared | Purpose
--- | --- | --- | ---
@sentry/node | monitoring | error data, stack traces, user context, device information, IP address | [Describe purpose]
@supabase/supabase-js | auth | email, password hash, session data, user metadata | [Describe purpose]
openai | ai | user prompts, conversation history, generated content | [Describe purpose]
posthog | analytics | user behavior, session recordings, feature flag usage, device information | [Describe purpose]
prisma | database | user data as defined in schema | [Describe purpose]
resend | email | email addresses, email content | [Describe purpose]
stripe | payment | payment information, billing address, email, transaction history | [Describe purpose]
stripe-ios | payment | payment information, billing address, email, transaction history | [Describe purpose]

## Recommendations

- Document the purpose and legal basis for each data field collected
- Implement input validation on all endpoints accepting user data
- Add rate limiting to prevent abuse of data-accepting endpoints
- Ensure authentication is required for all endpoints accessing personal data
- Implement field-level encryption for sensitive data (SSN, financial data)
- Add API versioning to manage privacy-impacting changes
- Log all data access for audit trail purposes
- Document data retention periods for each endpoint's data

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Data Dictionary (`DATA_DICTIONARY.md`)

This API privacy documentation was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. It should be reviewed by your engineering and legal teams to ensure accuracy and completeness. Fields marked with brackets require manual input.