Privacy & data minimization
Where PII lives, commerce UUID identity, and GDPR-oriented design rules.
Prood separates authentication (Better Auth) from commerce (tenant-scoped Postgres). Buyer email and credentials never duplicate across layers—commerce references buyers by internal UUID only.
Data zones
| Zone | Stored data | Access |
|---|---|---|
Better Auth (user, session, …) | Email, password hash, name | Auth layer only |
customers | Internal id (UUID), optional auth_user_id FK, optional profile fields | Tenant RLS; no duplicated email |
Order snapshots (orders.shipping_address, billing_address) | Name, address, phone for fulfillment | Merchant fulfillment; retention policy applies |
| Payment providers | Processor-required charge data | Third-party; documented in privacy policy |
Commerce identifier rule
customers.id = internal UUID (commerce-owned)
customers.auth_user_id = FK → Better Auth user.id (nullable for guests)
orders.customer_id = customers.id (never auth user.id, never email)
carts.customer_id = customers.idAPIs, checkout Redis sessions, payment metadata, webhooks, and Agent Auth tools use customerId and orderId only. Resolve to PII at display boundaries (merchant customer detail, buyer account page, transactional email send).
What must not propagate
- Better Auth
user.idon orders, carts, Redis checkout sessions, webhooks, logs, or public API responses - Buyer email in checkout session Redis payloads, payment metadata, or agent tool schemas when
customerIdsuffices - Cross-merchant profile tables — removed in greenfield schema
Guest checkout
- Create a
customersrow with internal UUID only (auth_user_idnull). - Fulfillment PII lives in the order address snapshot, not on
customers.email. - On register/login, link the guest row: set
auth_user_idonce; keep usingcustomers.ideverywhere.
Logged-in buyers
ensureCustomerForAuthUser() maps Better Auth session → customers.id inside the tenant. Orders and carts always reference that UUID.
Merchant visibility
The dashboard lists customers with email joined from Better Auth at read time (admin-customers query). Email is not stored on the commerce customers row.
Erasure (GDPR)
- Delete/anonymize Better Auth
user→ nullcustomers.auth_user_id. - Order address snapshots may be retained where legal basis requires (tax/fulfillment); anonymize where possible.
- Document retention windows in your merchant privacy policy; Prood acts as processor for merchant storefront data.