Privacy policy clauses for Next.js

Next.js itself is a framework that does not inherently collect user data—it is a build and deployment tool. However, privacy obligations trigger the moment you:

1. Deploy to Vercel (the default hosting provider): Vercel Inc. (United States) processes server logs, request metadata, and performance analytics. This creates a data processor relationship under GDPR Article 28 and CCPA Section 1798.140(ag). You must execute a Data Processing Agreement (DPA) with Vercel before going live in EU or UK jurisdictions, or collecting data from California residents. Vercel's privacy policy covers IP addresses and device identifiers in server logs.

2. Add third-party services via Next.js: If you integrate analytics (e.g., Vercel Web Analytics), authentication, or payment processors through Next.js middleware or API routes, each integration triggers separate processor obligations. Each service's privacy policy and data flows must be documented and disclosed.

3. Collect user data server-side: Server-side data collection in Next.js API routes (e.g., `/api/submit`) creates the same GDPR Article 13/14 and CCPA Section 1798.100 disclosure obligations as any web form—consent, purpose limitation, and retention policies must be explicit.

First concrete step: Before deploying, audit whether you use Vercel hosting and what third-party integrations are active. If yes, execute Vercel's DPA and document all data flows in a Data Processing Register (GDPR Article 30).