Permutify keeps your planning data private where possible.

The controller is the Permutify provider identified in the Impressum. Questions and requests concerning personal data can be sent to permutify.app@gmail.com.

• Privacy contact: permutify.app@gmail.com
• The provider’s complete legal identity and service address are published in the Impressum.
• Contact this address to exercise a data-subject right or ask how your data is handled.

Matches, outcomes, allocation settings, generated combinations, interface preferences, saved prediction history, and your cookie choice are processed in your browser and stored locally on your device when you use the relevant features. This processing supports the service you request and the legitimate interest in providing a reliable workspace under Article 6(1)(b) and, where applicable, Article 6(1)(f) GDPR.

• Your planning calculations happen on the device you are using.
• Local data remains until you delete it in Permutify, clear the site data in your browser, or remove the browser profile.
• A share link contains the setup needed to reopen the plan. Anyone who receives that link can access its contents.

When you register or sign in, Firebase Authentication processes identifiers such as your user ID, email address, display name, authentication method, and technical security data. This is necessary to create and operate your account and provide account-based access under Article 6(1)(b) GDPR. Security and abuse prevention may also rely on Article 6(1)(f) GDPR.

• Google and its affiliated companies provide Firebase Authentication and Google sign-in.
• Account data is kept while the account exists and is deleted or anonymized after a valid deletion request unless legal duties require longer storage.
• You can request account deletion through the privacy contact address.

Stripe processes checkout, payment, billing, fraud-prevention, and subscription information. Permutify sends the account reference and, where available, email address needed to create checkout. Permutify stores entitlement status, plan, Stripe customer and subscription identifiers, cancellation status, and subscription dates. Processing is necessary for the contract under Article 6(1)(b) GDPR and for tax, accounting, and other legal duties under Article 6(1)(c) GDPR.

• Stripe receives payment card details directly; Permutify does not store full card numbers.
• Entitlement records are kept for the subscription term and then as needed for contractual claims and statutory retention duties.
• Stripe applies its own retention obligations as an independent controller for parts of its payment processing.

Firebase Analytics is disabled until you choose Allow analytics in Cookie Settings. If enabled, it processes usage events and technical information such as device, browser, approximate location derived from network data, pages, and feature interactions to understand and improve the service. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time through Cookie Settings without affecting earlier processing.

• The consent choice is retained in local storage until you change it or clear site data.
• Analytics data is retained according to the configured Firebase Analytics retention period; aggregated reports may remain after event-level data expires.
• Choosing Essential only keeps optional analytics disabled.

Cloudflare provides hosting, delivery, security, and network services. When you request a page or API endpoint, technical data such as IP address, request time, requested URL, browser information, and security signals may be processed. This supports secure and reliable delivery based on the legitimate interests in availability, abuse prevention, and troubleshooting under Article 6(1)(f) GDPR.

• Operational logs are retained only for the period needed for security, delivery, and troubleshooting, subject to provider settings and legal requirements.
• Access to operational and account information is limited to people and providers who need it for these purposes.
• No solely automated decision produces legal or similarly significant effects for Permutify users.

If you email Permutify, the message, sender address, and information you provide are processed to answer the request. The legal basis is Article 6(1)(b) GDPR for account or service requests and Article 6(1)(f) GDPR for other support and correspondence. Google provides the email service.

• Support correspondence is kept until the request is resolved and then only as long as needed for follow-up, legal claims, or statutory duties.
• Do not send passwords, full payment-card details, or unnecessary sensitive information.
• Support email: permutify.app@gmail.com

Personal data is disclosed only where needed to operate the service, comply with law, or protect legal rights. Recipient categories include hosting and security providers, Google Firebase services, Stripe, email providers, professional advisers, and authorities where legally required. Google, Stripe, and Cloudflare may process data outside the European Economic Area, including in the United States.

• Transfers rely on an applicable adequacy decision, including the EU–US Data Privacy Framework where the recipient participates, or safeguards such as the European Commission’s standard contractual clauses.
• Provider privacy information describes the relevant entities, locations, and transfer safeguards in more detail.
• You may request further information about safeguards through the privacy contact address.

Subject to the conditions in the GDPR, you may request access to your personal data, correction, deletion, restriction, and data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time.

• Send requests to permutify.app@gmail.com. Identity verification may be required before a request is fulfilled.
• You have the right to lodge a complaint with the data-protection supervisory authority responsible for your place of residence, work, or the alleged infringement.
• Providing account and payment data is contractual when you choose those services. Without it, the related account or paid feature cannot be provided; the free local workspace remains available where stated.

This policy may be updated when services, providers, or legal requirements change. The current version and its update date are published on this page. Material changes will be highlighted where reasonably necessary.