Privacy Policy
Datenschutzerklärung
This policy explains what this service does with your data, why, on what legal basis, and for how long. It follows Articles 13 and 14 of the GDPR.
The controller's identity and contact details below are placeholders and must be completed before launch.
1. Who is responsible
The controller within the meaning of Art. 4 (7) GDPR is:
Panas VadimDigeni Akrita 28, 3035 Limassol, Cyprus
No data protection officer has been appointed. One is required under § 38 BDSG only where at least twenty people are permanently engaged in the automated processing of personal data, or where the processing is otherwise subject to a data protection impact assessment. Neither applies here.
2. What is collected
The assessment asks for figures about your finances. These are processed in your browser to compute the plan and are not written to any database at any point.
Your assessment answers are held in your browser only, in this tab, so that moving between pages or refreshing does not discard them. They are cleared when you close the tab or press Start over, and they never leave your device unless you ask for the plan by email.
| Data | Where it comes from | Is it stored? |
|---|---|---|
| Age | You enter it | No |
| Net monthly income | You enter it | No |
| Monthly essential expenses | You enter it | No |
| Monthly amount you want to invest | You enter it | No |
| Cash savings held | You enter it | No |
| Debts: type, balance, interest rate, minimum payment | You enter them | No |
| Goals: description, target amount, horizon in years | You enter them | No |
| Three risk attitude answers | You enter them | No |
| Optional start date | You enter it | No |
| Email address | You enter it to receive the plan | Yes — see section 3 |
| Whether you ticked the waitlist box, and the exact wording you were shown | Your choice on the form | Yes — see section 3 |
| IP address and timestamp | Your connection | Yes — see section 3 |
| Contact form: your message, and your name if given | You type it into the contact form | No — emailed to the operator, see section 3 |
3. Why, on what legal basis, and for how long
Computing and showing your plan
- Data
- All the assessment answers
- Legal basis
- Art. 6 (1) (b) GDPR — carrying out, at your request, the thing you asked for
- Retention
- Not stored. The answers exist in your browser for the length of the session and are discarded when you close or restart it.
Writing the plain-language summary at the top of your plan
- Data
- Computed plan figures, generic debt and goal types, your age and your language. Not your name, not your email address, and not any text you typed.
- Legal basis
- Art. 6 (1) (b) GDPR — producing, at your request, the plan you asked for
- Retention
- Not stored. The figures are sent for the one request and the answer is held in your browser for the session only.
Emailing you the plan as a PDF
- Data
- Email address; the plan is recomputed from the answers your browser sends with the request
- Legal basis
- Art. 6 (1) (b) GDPR — fulfilling the request you just made
- Retention
- The answers are used to render the document and are then discarded. They are never written to a database and are not logged.
Sending you updates about the app in development (waitlist)
- Data
- Email address
- Legal basis
- Art. 6 (1) (a) GDPR — your consent, given by ticking a box that is never pre-ticked, and confirmed by clicking a link in a separate email (double opt-in)
- Retention
- Until you withdraw consent or unsubscribe. Every email carries an unsubscribe link.
Being able to demonstrate that consent was given
- Data
- Email address, timestamp, IP address, the exact consent wording shown, the version of this policy in force at the time
- Legal basis
- Art. 6 (1) (c) GDPR together with Art. 7 (1) GDPR — the controller must be able to demonstrate consent
- Retention
- For as long as the consent is relied on, and for three years after it is withdrawn, matching the ordinary limitation period under § 195 BGB.
Stopping the send endpoint from being used to email strangers
- Data
- IP address, recipient address, timestamp
- Legal basis
- Art. 6 (1) (f) GDPR — our legitimate interest in the security and integrity of the service, and in not becoming a vehicle for unsolicited mail
- Retention
- Counters are kept for the length of the rate-limit window (up to 60 minutes) and are then no longer read.
Feedback on the app being built
- Data
- A rating, and — only if you choose to give them — your name, your email address and whatever you write in the comment box
- Legal basis
- Art. 6 (1) (f) GDPR — our legitimate interest in improving a product, balanced by the fact that you volunteered it and none of it is required
- Retention
- Kept while the app is in development and deleted at the latest 24 months after it is sent. It is never added to any mailing list, and it is never published or quoted anywhere without asking you first.
Replying to a message sent through the contact form
- Data
- Your email address, your message, and your name if you choose to give one
- Legal basis
- Art. 6 (1) (b) GDPR — steps taken at your own request — and Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries
- Retention
- Not stored by this service. The message is delivered to the operator's email inbox and kept there only as long as the enquiry requires, then deleted.
4. Who else processes your data
Each of the following acts as a processor under Art. 28 GDPR, on the basis of a data processing agreement. No data is sold, and none is shared for anyone else's advertising.
Vercel Inc.
- What it does
- Hosting and delivery of the website and its API routes
- Data
- IP address and standard request metadata
- Where
- United States, with EU edge regions
- Safeguard
- EU Standard Contractual Clauses and Vercel's Data Processing Addendum
Neon Inc.
- What it does
- The database holding the consent audit record and the rate-limit counters
- Data
- Email address, timestamp, IP address, consent wording and version, the identifier of the contact in the email system
- Where
- European Union — Frankfurt (eu-central-1)
- Safeguard
- Processing takes place in the EU; Neon's Data Processing Agreement applies
Brevo (Sendinblue GmbH, Germany; Brevo SAS, France)
- What it does
- Sending the plan email, sending the confirmation email, delivering contact form messages, and holding the waitlist
- Data
- Email address, subscription status, the PDF attached to your plan email, and the contents of any contact form message
- Where
- European Union — Germany and France
- Safeguard
- Processing takes place in the EU; Brevo's Data Processing Agreement applies
Google (Google Ireland Limited — Gemini API, paid service)
- What it does
- Writing the plain-language summary and the three tips at the top of your plan
- Data
- Computed plan figures only: amounts, dates, months to clear, targets, projections, shortfalls, your age and your language. Debts and goals are sent as generic types (“credit card”, “home”), never the labels you typed. No name, no email address, no text you wrote.
- Where
- European Union — Ireland
- Safeguard
- Used under Google's paid Gemini API terms, which do not permit the data to be used to improve Google's products. If the summary cannot be produced, the card is written by a rule instead and nothing is sent.
5. Cookies and tracking
This service uses no analytics, no advertising pixels, no session recording and no cross-site tracking of any kind.
One cookie is set: NEXT_LOCALE, which remembers whether you are reading the English or the German version. It holds nothing else, expires after a year, and is strictly necessary to provide the language you asked for, so it is exempt from the consent requirement under § 25 (2) TDDDG.
Fonts are served from this site's own domain. They are not loaded from Google Fonts or any other third party, so opening a page here sends your IP address to nobody but the host.
6. Your rights
Under the GDPR you have the right to:
- Art. 15AccessAsk what data about you is held, and get a copy.
- Art. 16RectificationHave inaccurate data corrected.
- Art. 17ErasureHave your data deleted, subject to any legal obligation to keep it.
- Art. 18RestrictionRequire that processing be paused while a dispute is resolved.
- Art. 20PortabilityReceive your data in a machine-readable form.
- Art. 21ObjectionObject to processing based on legitimate interest.
- Art. 7 (3)WithdrawalWithdraw consent at any time, as easily as it was given. Withdrawal does not affect the lawfulness of what was done beforehand.
- Art. 77ComplaintLodge a complaint with a supervisory authority — for us, the Office of the Commissioner for Personal Data Protection (Cyprus). You may also complain to the authority where you live or work, wherever that is in the EU.
To exercise any of these, write to Vadim123.pv@gmail.com. We answer within one month, as Art. 12 (3) requires.
To unsubscribe from the waitlist without writing to anyone, use the unsubscribe link at the bottom of any email we send. That is the fastest route and it takes effect immediately.
7. Automated decision-making
The plan is produced by a deterministic calculator: the same answers always produce the same plan. It is not profiling within the meaning of Art. 22 GDPR, it produces no legal effect and no similarly significant effect, and no decision about you is taken on the basis of it. It is information for you to read.
Some of the explanatory sentences beside the figures are generated by an AI language model. They describe numbers the calculator has already produced; they never decide one. Text produced this way is labelled where it appears.
8. Changes to this policy
Every consent record stores the version of this policy that was in force when the consent was given, so an old record still says what it agreed to rather than silently inheriting today's wording.