1. Data controller

The data controller is Machine Learning Group E.E., a limited partnership registered in Greece, at Anastasiou Gennadiou 19, 11474 Athens, Greece. General Commercial Registry (ΓΕΜΗ) number 179903503000, VAT number EL802631890. Questions about your data can be sent to privacy@retiresafe.io.

2. What we collect

• If you use the service anonymously: nothing leaves your browser. Inputs and results are held in your own browser's storage, on your device.
• If you create an account: your email address (for authentication), when you accepted the terms and which version, and the scenarios + runs you explicitly save (your inputs and the engine's output JSON), with timestamps and the engine version that produced them.
• If you ask us to email your results: we send the summary to the address on your account, and only to that address. We do not accept a different one.
• If you contact us: your name, email address and message, so we can reply and keep a record of the exchange. We also store a one-way hash of your IP address, which we use only to stop the form being flooded. The address itself is not kept.
• If you opt in to hearing from us: we record the date you gave permission, so we can show when and how it was given. Leaving the box unticked records nothing, and you can withdraw at any time from your account page. Sign-in links and receipts are not marketing and are sent regardless.
• If you purchase Premium: Stripe takes the payment, through its Link service acting as merchant of record, and collects and stores payment information per Stripe's privacy policy. We do not see or store card numbers.
• If you tell us how you heard about us: after a purchase we ask this once. Answering is optional. If you do, we keep the option you picked, any detail you typed and when, with your account, and delete them with it. We use them only to decide where to tell people about RetireSafe.
• Analytics: page-view counts, and which parts of the product get used (a run started, a report exported, a "?" explainer opened), via Umami (no cookies, no cross-site IDs, EU hosting). These are records of actions, never of the numbers you typed. To group one visit's actions together, Umami derives a rotating code from your IP address and browser. Nothing is stored on your device and the code changes on a schedule, so it cannot follow you across sites or over the long run. Your browser sends these records to our own site, which passes them straight on to Umami together with your IP address and the approximate location our host (Cloudflare) reads from it: country, region and city. Umami needs those to group the visit and count visitors by country. Our site keeps none of it.
• Advertising measurement, only if you accept it: if you accept analytics cookies, Google Analytics also records which pages you opened and four moments that matter to us commercially: a sign-up finishing, a click through to checkout, Premium switching on, and a simulation finishing. That is how we tell whether an advert we paid for led anywhere. It never receives the numbers you typed. Google sets cookies to do this, and it can connect what it sees here to your activity on other sites that use its advertising products, which is the part Umami cannot do and the reason this one asks first. Refuse or change your mind at any time from Cookie settings at the bottom of any page. The cookies page names each cookie and how long it lasts.
• Error reporting: JavaScript stack traces and URL context via Sentry (EU region) when something breaks in production. Two clarifications: (a) if a simulation run fails, the inputs of that specific run are attached to the crash report so we can reproduce and fix the error. That is the only case in which your inputs leave your browser without you saving them. (b) When an error occurs, Sentry may capture a masked replay of that session (a reconstruction of on-screen interactions with all text and form values blanked out) to help us see what led to the failure. Normal, error-free sessions are never recorded.

3. Children

The service is not aimed at children. You must be 18 or older to create an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@retiresafe.io and we will delete it.

4. Legal basis (GDPR Art. 6)

• Performance of a contract: to deliver the service you signed up for.
• Legitimate interest: error reporting, and the cookieless analytics that runs for everyone (Umami), to keep the service working.
• Consent: three things here run on consent, and you can withdraw any of them at any time. Hearing from us about the product, if you tick that box, which you withdraw from your account page. Google Analytics, which you withdraw from Cookie settings at the bottom of any page. And your answer to how you heard about us, which we delete if you write to us. Everything else this site stores is strictly necessary and so does not ask; the cookies page lists every item.

5. How long we keep it

Account data: for as long as your account is active. After account deletion, a 30-day grace period applies (during which you can cancel the deletion). After the grace period, every row tied to your account is hard-deleted.

Payment records: per our payment processor's retention schedule and applicable accounting law (typically 5–10 years in Greece).

Analytics: 6 months, then deleted by Umami. What is kept is actions and the rotating visit code, never your name, your email, or anything you entered. Where you accepted Google Analytics, Google keeps that event data for 14 months and then deletes it.

6. Where it lives

All account data is stored on servers in the EU (Frankfurt), encrypted at rest by the underlying cloud provider. Access is enforced by the database itself rather than by our application code, so a row can only ever be read by the account that owns it. The company operating those servers is named in section 8.

7. Your rights (GDPR)

These rights are not only for EU residents. They apply to everyone who uses the service, wherever you live, and your account data is stored in the EU either way.

• Access: export everything we hold on you as JSON from your account settings.
• Rectification: edit your inputs and saved scenarios directly.
• Erasure: delete your account from the account settings.
• Restriction & objection: contact us to limit specific processing.
• Portability: the export is a standard JSON file; you can take it elsewhere.
• Complaint: you may complain to the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens (dpa.gr), which is our supervisory authority. If you live elsewhere in the EU you may complain to the authority where you live instead.

8. Companies that handle your data

These are the companies that handle your data for us, most of them as processors, which means they act only on our instructions. We name them rather than describing them in categories, because the point of the list is that you can go and check any of them yourself.

• Supabase: holds your account and your saved plans, and handles signing you in. Hosted in the EU.
• Cloudflare: serves the site itself. It does not receive your plans.
• Stripe: takes the payment if you buy Premium, through its Link service, and receives what you give it at checkout. Because Link is the merchant of record, Stripe decides for itself how it uses that information, under its own privacy policy, rather than only on our instructions.
• Umami: counts page visits and which features get used, and groups one visit's actions under a rotating code derived from your IP address and browser. It sets no cookies, receives nothing you typed, and cannot recognise you on another site. Hosted in the EU.
• Google: receives analytics and advertising measurement, but only from people who accepted it. It learns which pages were opened and the four commercial moments named in section 2, and never anything you typed. Unlike the others on this list, Google decides for itself how it uses that information across its own advertising products, under its own privacy policy, rather than only on our instructions. Our contracting party in Europe is Google Ireland Limited.
• Resend: sends the email we generate: your sign-in links and account notices (a change of email address, Premium switched on or off after a purchase or refund, and the notices when you ask us to delete your account), a summary of your results if you ask for one, and anything you send us through the contact form. It receives your email address and the contents of that message.
• Sentry: receives the error report when something breaks, which for a failed simulation includes that run's inputs. EU region.

9. Sending data outside the EU

Your account data is stored in the EU, Umami analytics is hosted in the EU and error reports go to Sentry's EU region. Several of the companies above are American even when they hold the data in Europe, though, and three of them receive personal data directly: Stripe, who take your payment, Resend, who deliver the email you ask for, and Google, if you accepted analytics cookies. Google is the one that does not keep the data in Europe: it processes analytics on servers in the United States.

Where personal data reaches a company outside the EU, the transfer runs on the European Commission's standard contractual clauses, which are in our data processing agreement with each of them. Stripe, Sentry and Google are additionally certified under the EU-US Data Privacy Framework. These are the safeguards GDPR Chapter V requires, and you can ask us for the detail on any one of them.

10. Changes

Material changes to this policy will be communicated to account holders by email at least 14 days before they take effect.

---

Questions? privacy@retiresafe.io or via the contact page.