> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Data Controller: Acme Inc

## Related Documents

- Data Processing Agreement (`DATAPROCESSINGAGREEMENT.md`)
- Privacy Policy (`PRIVACY_POLICY.md`)
- Vendor Contacts Directory (`VENDOR_CONTACTS.md`)
- Third-Party Risk Assessment (`THIRDPARTYRISK_ASSESSMENT.md`)
- Transfer Impact Assessment (`TRANSFERIMPACTASSESSMENT.md`)

## Overview

This document lists the third-party sub-processors that process personal data on behalf of Acme Inc in connection with the operation of this application. Each sub-processor has been assessed for compliance with applicable data protection requirements.

For questions about our sub-processors, contact us at legal@acme.com.

## Sub-Processors

Sub-Processor | Purpose | Data Processed | Location | Privacy Policy
--- | --- | --- | --- | ---
Sentry | Error tracking and performance monitoring | error data, stack traces, user context, device information, IP address | US | Link
Supabase | User authentication and identity management | email, password hash, session data, user metadata | US | Link
OpenAI | AI processing and content generation | user prompts, conversation history, generated content | US | Link
PostHog | Product analytics and usage tracking | user behavior, session recordings, feature flag usage, device information | US | Link
Resend | Transactional and marketing email delivery | email addresses, email content | US | Link
Stripe | Payment processing and billing | payment information, billing address, email, transaction history | US | Link
stripe-ios | Payment processing and billing | payment information, billing address, email, transaction history | US | Link

## Changes to This List

We may update this sub-processor list from time to time to reflect changes in the third-party services we use. Material changes will be communicated in accordance with our Data Processing Agreement.

## How to Object

If you have concerns about a sub-processor, please contact us at legal@acme.com. Under our Data Processing Agreement, you may object to the appointment of a new sub-processor.

This sub-processor list was generated by Codepliant based on automated code analysis. Review and verify all entries for accuracy.