Start free trial

Privacy Policy

Last updated: October 11, 2026

1. Introduction

We take the protection of your data seriously. This privacy policy explains which personal data we process, for which purposes, and on what legal basis.

2. Data Controller — Company Details

  • Pacco Planning UG (limited liability)
  • Günterstalstraße 35
  • 79102 Freiburg im Breisgau, Germany
  • HRB 733943, Amtsgericht Freiburg
  • Managing Directors: Nils Brabänder, Bastian Nill
  • Email: info@pacco-planning.de

3. Data Protection Contact

Email: info@pacco-planning.de

Data Protection Officer: not appointed (not required under Art. 37 GDPR).

4. Categories of Personal Data

  • Master data (e.g. name, company)
  • Contact data (e.g. email, phone, address)
  • Usage data (e.g. pages visited, access times)
  • Content data (e.g. recipes, events, documents)
  • Payment data (e.g. billing address, payment history)

5. Purposes and Legal Bases

We process personal data on the following legal bases:

  • Contract performance — Art. 6(1)(b) GDPR
  • Legitimate interests — Art. 6(1)(f) GDPR
  • Consent — Art. 6(1)(a) GDPR
  • Legal obligation — Art. 6(1)(c) GDPR

6. Hosting and Server Logs

Our services are hosted on Google Cloud Platform in the europe-west3 region (Frankfurt am Main, Germany). Contract partner is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Services used: Cloud Run (compute), Cloud SQL for PostgreSQL (database), Cloud Storage (files), and Cloud CDN/Cloud Armor (delivery and protection). When accessing our services, the following data is automatically stored in server log files:

  • IP address
  • Date and time of the request
  • URL accessed
  • Browser and operating system
  • Data volume transferred

Legal basis: Art. 6(1)(f) GDPR. Log files are automatically deleted after 30 days.

7. Fonts (Self-Hosting)

We embed fonts (Inter, Cormorant Garamond, Roboto Mono) locally from our own server. No data is transferred to Google servers. Technically this is implemented via next/font, which copies the fonts to our server at build time and serves them from there (self-hosting). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent typography without third-country transfers).

8. Cookies and Audience Measurement

Strictly necessary cookies. We use cookies required to operate the site (e.g. language preference, login session in the app area, CSRF protection). No consent is required for these; storage is based on §25(2)(2) TDDDG (strictly necessary). Legal basis for subsequent processing: Art. 6(1)(f) GDPR.

Google Analytics 4 — only with your consent. For audience measurement we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service is loaded only after you have explicitly agreed in the consent banner. Without your consent, no Google script is fetched, no connection to Google is made, and no analytics cookies are set.

Data processed once consent is given: truncated IP address, time and duration of the visit, pages viewed, referrer, approximate city-level location, device and browser type, and your clicks on this site’s call-to-action buttons. Only the following clicks are recorded: “Start free trial”, “Sign in”, and our sales address info@pacco-planning.de where it is offered as a contact button (in the “FAQ” and “Pricing” sections and in the footer) — each together with which part of the page the button sits in. We do not record: clicks on any other link, your mouse movements, your scrolling behaviour, clicks on the other email addresses named on this site (such as datenschutz@pacco-planning.de, the conciliation body, or the supervisory authority), and expressly not clicks on that same address info@pacco-planning.de where it appears on the legal pages (imprint, terms, accessibility statement, this policy). Someone writing to us from there is usually exercising a right — we do not measure that. Google Analytics 4 truncates the IP address before storage; the full IP address is never stored. A pseudonymous identifier is stored on your device in cookies (_ga, _ga_*). We have disabled Google Signals, so no cross-device linking with Google accounts takes place, and we have switched off data sharing with Google for its own purposes. The data is not used for advertising or personalisation.

Legal bases: Art. 6(1)(a) GDPR (consent) for the processing and §25(1) TDDDG for the storage on your device. A data processing agreement under Art. 28 GDPR is in place with Google. Transfers to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. Retention of event data in Google Analytics: 14 months.

Withdrawal. You may withdraw your consent at any time with effect for the future. The “Withdraw consent” link in the footer of every page is sufficient; it deletes the stored decision and the cookies set by Google. The lawfulness of processing carried out before withdrawal remains unaffected. If you decline in the banner, Google Analytics is never loaded at all.

Further information: Google’s privacy policy.

9. Appointment Booking (Google Calendar)

You can book a demo call with us through the links to the demo with the founders (in the first screen of the home page and in the “Team” section). The links lead via calendar.app.google to a booking page of Google Calendar, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The page only opens when you click one of the links; until then our website does not connect to Google for this purpose.

When you book an appointment, Google and we process the details in the booking form (your name and email address, plus anything you choose to add) and the time you select. We need your name and email address to arrange the appointment with you; without them, booking through the page is not possible. You can write to us at info@pacco-planning.de instead. When the page is opened, Google also collects technical data such as your IP address and browser and device details. The booking appears in our calendar; Google Calendar sends you a confirmation by email.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request). A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. We delete the appointment data as soon as it is no longer needed for the call and its follow-up; statutory retention obligations remain unaffected. For the data Google itself processes when the booking page is opened, Google’s privacy policy applies.

10. Authentication (Firebase Identity Platform)

We use Firebase Identity Platform, a service of Google Ireland Limited, for authentication. Processing takes place in the europe-west3 region (Frankfurt). Data processed: email address, hashed password, sign-in timestamps, sign-in IP address. Legal basis: Art. 6(1)(b) GDPR (contract performance).

11. Payment Processing (Stripe)

For payments we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe processes payment data directly; we do not store credit card numbers. Legal basis: Art. 6(1)(b) GDPR.

12. Processors

We work with the following processors. A current list including contract partner, purpose, region, and DPA status is maintained in our sub-processor list; a copy is available on request at datenschutz@pacco-planning.de. B2B controller customers can request our Art. 28 GDPR Data Processing Agreement template at the same address.

  • Google Ireland Limited — hosting and database (Cloud Run, Cloud SQL, Cloud Storage, Cloud CDN/Armor), authentication (Firebase), AI features (Vertex AI). Region: europe-west3 (Frankfurt). Art. 28 GDPR DPA in place.
  • Stripe Payments Europe, Ltd., Dublin, Ireland — payment processing. DPA in place; PCI-DSS Level 1 certified.
  • STRATO AG, Berlin, Germany — authoritative DNS for our domains and transactional outbound email (invitations, quotes and invoices incl. their PDF attachments). Region: Germany. Art. 28 GDPR DPA in place.

13. International Data Transfers

Insofar as data is transferred to the USA, this takes place on the basis of the EU-US Data Privacy Framework or on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

14. Retention Periods

  • Contract data: 10 years (commercial and tax retention obligations)
  • Invoice data: 10 years per § 147 AO
  • Server log files: 30 days

15. Security

We apply the following technical and organizational measures:

  • TLS/SSL encryption for all data in transit
  • Encrypted data storage
  • Regular security updates
  • Access controls and permission management
  • Regular data backups

16. Your Rights

You have the following rights regarding your personal data:

  • Access — Art. 15 GDPR
  • Rectification — Art. 16 GDPR
  • Erasure — Art. 17 GDPR
  • Restriction of processing — Art. 18 GDPR
  • Data portability — Art. 20 GDPR
  • Objection — Art. 21 GDPR
  • Withdrawal of consent — Art. 7(3) GDPR

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Lautenschlagerstraße 20
70173 Stuttgart, Germany
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de

18. Automated Decision-Making

No automated decision-making within the meaning of Art. 22 GDPR takes place.

19. Children

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children.

20. Changes

We reserve the right to update this privacy policy to adapt it to changes in law or services.

21. Contact

Email: info@pacco-planning.de