English

Get Started

Privacy Policy

1. Controller

The controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR) is:

AnnuCal GmbH
Lerchenstraße 28
22767 Hamburg
Germany

Phone: +49 40 50719309‬
Email: info@annucal.com
Managing Director: Jan-Willem Wulff


2. Purpose of Processing and Legal Basis

We process personal data to provide and improve AnnuCal, ensure reliable operation, and enable user support. Processing takes place on the following legal bases:

2.1 Use of the Service (Art. 6(1)(b) GDPR – Contract performance)

To create and operate your AnnuCal account, we process:

  • Name

  • Email address

  • Encrypted password

  • Language preferences

  • Calendar, scheduling, and event data entered by you

  • App settings and configurations

2.2 Technical Operation and Security (Art. 6(1)(f) GDPR – Legitimate interest)
For system stability and security, we process:

  • IP address

  • Browser type and version

  • Date and time of access

  • Server log files

  • Session cookies

  • Error and diagnostic information

Our legitimate interest lies in maintaining the security and proper functioning of the platform.

2.3 Communication (Art. 6(1)(b), (f), and where applicable Art. 6(1)(a) GDPR)

We send essential service-related emails such as:
• account confirmation
• password reset messages
• security notifications
• operational updates
• important product or service-related changes

These communications are sent where necessary to provide the service, maintain security, or ensure the reliable operation of AnnuCal.
In addition, if you subscribe to our newsletter or otherwise give your consent, we may send occasional email updates about product news, major feature releases, and other relevant AnnuCal updates.
For newsletter and email campaign delivery, we use Mailchimp, a service provided by Intuit Mailchimp.
The legal basis for essential service-related communication is Art. 6(1)(b) GDPR where necessary for the performance of a contract, and Art. 6(1)(f) GDPR where necessary for security, operational reliability, and important service communication.

The legal basis for newsletter or marketing-related communication is your consent under Art. 6(1)(a) GDPR, where such consent is required.

2.4 Single Sign-On (SSO) – Voluntary (Art. 6(1)(a) GDPR – Consent)

If you choose to sign in using an external provider (e.g., Google), the provider may transmit your name, email address, and profile data to us.
SSO is optional and requires your explicit consent.

2.5 Payments, Subscriptions and Billing via Stripe (Art. 6(1)(b), (f) GDPR)

If you purchase a paid plan, start a trial, maintain a subscription, or make a voluntary support payment, we process personal data as necessary to provide payment, billing, and subscription-related services.

For this purpose, we use Stripe Payments Europe, Ltd. and its affiliated companies as our payment service provider.

Depending on the transaction, the following data may be processed:

• name
• email address
• billing address
• country and tax-related information, if applicable
• subscription status and billing period
• invoices, invoice history, and payment status
• payment method information and transaction metadata
• customer support information related to billing issues, if applicable

We use this processing to:

• complete payments
• manage subscriptions, renewals, and cancellations
• generate invoices and billing records
• handle refunds and payment-related support requests
• prevent abuse and protect the reliability and security of our billing processes

The legal basis is Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract or to take steps prior to entering into a contract, and Art. 6(1)(f) GDPR for fraud prevention, billing security, and the reliable operation of our payment processes.

We do not receive or store full payment card numbers ourselves. Payment card data is processed directly by Stripe.

2.6 Google Calendar Integration (Art. 6(1)(a) GDPR)

AnnuCal offers an optional integration with Google Calendar. If you choose to connect your Google Calendar, you will be asked to grant AnnuCal access via Google's official authorization service (OAuth 2.0). With your explicit consent, AnnuCal accesses the following Google user data:

  • The list of your Google calendars (calendar names only) - so you can choose which calendars to import into your AnnuCal year view.

  • Events from the calendars you select (title, date and time, location, description, recurrence) - to display them in your AnnuCal year view and keep them up to date through incremental synchronization.

  • A dedicated secondary calendar named "AnnuCal" that AnnuCal creates in your Google account if you enable syncing. AnnuCal writes only the events you created in AnnuCal into this calendar. AnnuCal never creates, modifies or deletes events in your pre-existing Google calendars.

This data is used exclusively to provide the calendar features described above. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties (except as necessary to provide the feature, for security purposes, or to comply with applicable law), and we do not use it to train artificial-intelligence models. AnnuCal staff do not read your calendar data unless you explicitly ask us to do so for support purposes, or where necessary for security reasons or to comply with legal obligations.

The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), which you give when granting access on Google's consent screen. You can withdraw your consent at any time by disconnecting Google Calendar in your AnnuCal settings. When you disconnect, we revoke our access token with Google and delete the stored credentials; imported calendar data is deleted from our systems. You can additionally revoke AnnuCal's access at any time in your Google account at myaccount.google.com/permissions.

Limited Use disclosure: AnnuCal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.


3. Categories of Recipients

We do not sell your data or use it for advertising.

To provide our service, we work with selected processors in accordance with Art. 28 GDPR:

  • Hosting and data center services: Frankfurt, Germany

  • Email delivery services: to send system-relevant messages

  • Monitoring and diagnostics: to ensure platform stability

  • SSO providers (optional): Google LLC (USA)

  • Provider of the Google Calendar API: Google LLC, when you choose to connect your Google Calendar (see Section 2.6)

  • Payment and billing services: Stripe Payments Europe, Ltd. and affiliated Stripe entities for payment processing, subscriptions, invoicing, and related billing operations

  • Email delivery and newsletter services: Intuit Mailchimp for newsletter distribution, email campaigns, and related communication management

These service providers act strictly on our instructions.

4. Data Transfers to Third Countries

As a general rule, your data is not transferred outside the EU/EEA.

Exception: If you use Google Single Sign-On
In this case, data may be transferred to the United States.

Legal safeguards include:

  • Your explicit consent (Art. 6(1)(a) GDPR)

  • Standard Contractual Clauses (SCCs) under Art. 46 GDPR

You may withdraw your consent at any time by discontinuing use of SSO.

Exception: If payment, subscription, or billing services are processed through Stripe, personal data may be transferred to countries outside the EU/EEA, including the United States, where necessary for the provision of Stripe’s services.

Legal safeguards may include Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR and other applicable transfer mechanisms.

Exception: If newsletter or email communication services are provided through Mailchimp, personal data such as email address and related campaign data may be transferred to countries outside the EU/EEA, including the United States, where necessary for the provision of Mailchimp’s services.

Legal safeguards may include Standard Contractual Clauses (SCCs) and other applicable transfer mechanisms.

Exception: If payment, subscription, or billing services are processed through Stripe, personal data may be transferred to countries outside the EU/EEA, including the United States, where necessary for the provision of Stripe’s services.

Legal safeguards may include Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR and other applicable transfer mechanisms.

Exception: If newsletter or email communication services are provided through Mailchimp, personal data such as email address and related campaign data may be transferred to countries outside the EU/EEA, including the United States, where necessary for the provision of Mailchimp’s services.

Legal safeguards may include Standard Contractual Clauses (SCCs) and other applicable transfer mechanisms.

Google Calendar integration: If you connect your Google Calendar, authorization and calendar data are exchanged with Google LLC (USA). This transfer takes place only with your explicit consent (Art. 49(1)(a) GDPR) and is additionally safeguarded by Google's certification under the EU-U.S. Data Privacy Framework and standard contractual clauses. Calendar data imported into AnnuCal is stored on our servers in Germany.

5. Storage Periods

We store personal data only as long as necessary for the purpose of providing the service.

  • Account data: until the account is deleted

  • Calendar and event data: until deleted by the user

  • Backups: automatically deleted after 14 days

  • Server log files: stored for up to 30 days

  • Billing and invoice records: retained for as long as required by applicable commercial and tax retention obligations

  • Google Calendar data (imported events, access tokens): until you disconnect the Google Calendar integration or delete your account, whichever occurs first

Once your account is deleted, all personal data is fully removed within the backup retention period.

6. Cookies

AnnuCal uses only essential cookies, primarily:

  • Session cookies (required for login, navigation, and security)

We do not use tracking, analytics, or advertising cookies.

7. Your Rights Under the GDPR

You have the following rights:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restrict processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object (Art. 21 GDPR) to processing based on legitimate interests

  • Right to withdraw consent at any time (Art. 7(3) GDPR), e.g., for SSO

To exercise your rights, contact us at:
info@annucal.com

Right to lodge a complaint

You may lodge a complaint with any data protection supervisory authority.
For example:

Hamburg Commissioner for Data Protection and Freedom of Information
https://datenschutz-hamburg.de/


8. No Automated Decision-Making

We do not engage in automated decision-making or profiling under Art. 22 GDPR.


9. Data Security

We protect your data using technical and organizational measures, including:

  • SSL/TLS encryption

  • Access controls

  • Role-based permissions

  • Encrypted passwords

  • Daily secure backups

  • Certified data centers located in Germany


10. Changes to This Privacy Policy

We may update this policy to reflect legal, technical, or functional changes.
The latest version will always be available on our website.