> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Company: Acme Inc

## Related Documents

- Data Flow Diagram (`DATAFLOWDIAGRAM.md`)
- Data Dictionary (`DATA_DICTIONARY.md`)
- Privacy Policy (`PRIVACY_POLICY.md`)

> This document maps how personal data flows through the application — where it is collected, where it is stored, and which third parties it is shared with. Generated by automated code analysis.

## Data Collection Points

The following entry points collect personal data from users:

Source | Data Collected | Mechanism
--- | --- | ---
User registration/login | email, password hash, session data, user metadata | via @supabase/supabase-js
AI-powered feature usage | user prompts, conversation history, generated content | via openai
Email subscription/contact forms | email addresses, email content | via resend
Payment checkout | payment information, billing address, email, transaction history | via stripe
Payment checkout | payment information, billing address, email, transaction history | via stripe-ios

## Data Storage

The following services and systems store personal data:

Storage System | Category | Data Stored
--- | --- | ---
prisma | Database | user data as defined in schema
Database schema | Personal Identity Data | @supabase/supabase-js, User.name
Database schema | Contact Information | User.email, User.phone
Database schema | Authentication Data | User.passwordHash

## Third-Party Data Sharing

The following third-party services receive personal data:

Third Party | Category | Data Shared
--- | --- | ---
@sentry/node | Error Monitoring | error data, stack traces, user context, device information, IP address
openai | AI Service | user prompts, conversation history, generated content
posthog | Analytics | user behavior, session recordings, feature flag usage, device information
resend | Email Service | email addresses, email content
stripe | Payment Processing | payment information, billing address, email, transaction history
stripe-ios | Payment Processing | payment information, billing address, email, transaction history

## Summary

Data Flow Summary:

COLLECTION:

- User registration/login → email, password hash, session data, user metadata (via @supabase/supabase-js)
- AI-powered feature usage → user prompts, conversation history, generated content (via openai)
- Email subscription/contact forms → email addresses, email content (via resend)
- Payment checkout → payment information, billing address, email, transaction history (via stripe)
- Payment checkout → payment information, billing address, email, transaction history (via stripe-ios)

STORAGE:

- prisma (Database) → user data as defined in schema
- Database schema (Personal Identity Data) → @supabase/supabase-js, User.name
- Database schema (Contact Information) → User.email, User.phone
- Database schema (Authentication Data) → User.passwordHash

SHARING (Third Parties):

- @sentry/node → error data, stack traces, user context, device information, IP address
- openai → user prompts, conversation history, generated content
- posthog → user behavior, session recordings, feature flag usage, device information
- resend → email addresses, email content
- stripe → payment information, billing address, email, transaction history
- stripe-ios → payment information, billing address, email, transaction history

This data flow map was generated by Codepliant based on automated code analysis. Review and verify against your actual data processing activities.