Data controller and data processor
Controller decides why and how data gets used; processor just handles it on orders. The split decides who is legally on the hook.
See it
What it is
The controller decides why personal data is collected and the essential how: which data, how long, who gets to see it. The processor touches that data on the controller's documented instructions and cannot decide to use it for something else, though it still makes the ordinary operational calls about non-essential means (which database engine, which crypto library, how to shard). If you run the product, you are almost always the controller for your users' data. Your analytics tool, email sender, and hosting provider are your processors.
The roles flip depending on whose data you mean. For your own employees' payroll data you are the controller. If you build software that stores your client's customers, you are the processor for that data and your client is the controller. Same company, same week, two hats. Write down which hat you wear per data set before anyone asks.
Gotcha: the label follows behaviour, not the contract. A vendor that quietly uses your users' data to train its own models has made itself a controller for that particular processing, no matter what its terms say, and that is exactly the arrangement regulators enjoy fining. It does not automatically stop being your processor for the rest of the service, which is why these deals get messy: two roles, one contract, and a regulator asking which one applied to the activity in question. Controllers carry the heavy duties (lawful basis, notices, answering user requests); processors carry security and 'do only what you were told', so being the processor is not a free pass.
Ask AI for it
Map the personal data flows in this product and assign roles. For every data set (end users, client end users, employees, leads) and every third party it touches, produce a table with: data set, purpose, who decides the purpose, our role (controller, processor, or joint controller), the other party's role, and the contract that should cover it. Flag any vendor that uses the data for its own purposes, since that makes it an independent controller for that activity even while it stays our processor for the rest, and say which paperwork each role needs.