1. Data controller

The data controller is Machine Learning Group E.E., a limited partnership registered in Greece, at Anastasiou Gennadiou 19, 11474 Athens, Greece. General Commercial Registry (ΓΕΜΗ) number 179903503000, VAT number EL802631890. Questions about your data can be sent to privacy@retiresafe.io.

2. What we collect

• When you use the calculator, signed in or not: your plan is calculated on our servers, not on your device. While you fill it in and when you run it, your inputs are sent to our calculation servers in Belgium (Google Cloud, on our behalf). They are held only until the calculation is done and are never written to our database or our files. The results are kept in our database until your browser collects them, then deleted 10 minutes later, and never kept longer than an hour. If a run fails because an input is invalid, the message explaining what to fix can repeat the value it rejected, and is deleted on the same clock. Without an account, nothing ties a run to you. With one, the run is marked as yours until it is deleted, so we can help if you ask about it. Your browser also keeps your latest inputs and results in its own storage, so they are there when you come back.
• To stop abuse: we count how often each internet address runs the calculator, using a one-way hash of the address rather than the address itself, and delete the counts after a day. The hash is never stored with a run.
• If you create an account: your email address (for authentication), when you accepted the terms and which version, and the scenarios + runs you explicitly save (your inputs and the engine's output JSON), with timestamps and the engine version that produced them.
• If you ask us to email your results: we send the summary to the address on your account, and only to that address. We do not accept a different one.
• Your health, only if you agree: with an account, you can tell us how you rate the health of each person in your plan, so the calculator can judge how long your money needs to last. We ask only after you tick a box agreeing to it, and you can untick it in your account settings at any time, which deletes the answer. Without it, the calculator assumes average health. Your health answers are never included in error reports. Our health data policy has the detail.
• If you contact us: your name, email address and message, so we can reply and keep a record of the exchange. We also store a one-way hash of your IP address, which we use only to stop the form being flooded. The address itself is not kept.
• Bot check: before a full calculation runs, before we send an email sign-in link, and before we accept a contact message, Cloudflare Turnstile checks that a person is asking, not a script. To do that, Cloudflare reads your IP address, the name and version your browser gives itself, and technical details of how it connects. We receive only a yes or no. Nothing you typed into the calculator is involved.
• If you opt in to hearing from us: we record the date you gave permission, so we can show when and how it was given. Leaving the box unticked records nothing, and you can withdraw at any time from your account page. Sign-in links and receipts are not marketing and are sent regardless.
• If you purchase Premium: Stripe takes the payment, through its Link service acting as merchant of record, and collects and stores payment information per Stripe's privacy policy. We do not see or store card numbers.
• If you tell us how you heard about us: after a purchase we ask this once. Answering is optional. If you do, we keep the option you picked, any detail you typed and when, with your account, and delete them with it. We use them only to decide where to tell people about RetireSafe.
• Analytics: page-view counts, and which parts of the product get used (a run started, a report exported, a "?" explainer opened), via Umami (no cookies, no cross-site IDs, EU hosting). These are records of actions, never of the numbers you typed. To group one visit's actions together, Umami derives a rotating code from your IP address and browser. Nothing is stored on your device and the code changes on a schedule, so it cannot follow you across sites or over the long run. Your browser sends these records to our own site, which passes them straight on to Umami together with your IP address and the approximate location our host (Cloudflare) reads from it: country, region and city. Umami needs those to group the visit and count visitors by country. Our site keeps none of it.
• Advertising measurement, only if you accept it: if you accept analytics cookies, Google Analytics also records which pages you opened and four moments that matter to us commercially: a sign-up finishing, a click through to checkout, Premium switching on, and a simulation finishing. That is how we tell whether an advert we paid for led anywhere. It never receives the numbers you typed. Google sets cookies to do this, and it can connect what it sees here to your activity on other sites that use its advertising products, which is the part Umami cannot do and the reason this one asks first. Refuse or change your mind at any time from Cookie settings at the bottom of any page. The cookies page names each cookie and how long it lasts.
• Error reporting: JavaScript stack traces and URL context via Sentry (EU region) when something breaks in production. Two clarifications: (a) if a simulation run fails, the inputs of that specific run are attached to the crash report so we can reproduce and fix the error. Our calculation servers report their own failures too, with the failing line of code and none of your inputs. (b) When an error occurs, Sentry may capture a masked replay of that session (a reconstruction of on-screen interactions with all text and form values blanked out) to help us see what led to the failure. Normal, error-free sessions are never recorded.

3. Children

The service is not aimed at children. You must be 18 or older to create an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@retiresafe.io and we will delete it.

4. Legal basis (GDPR Art. 6)

• Performance of a contract, or steps you ask for before one: to deliver the service you signed up for, and to calculate the plan you asked for, with or without an account.
• Legitimate interest: error reporting, the cookieless analytics that runs for everyone (Umami), the bot check on calculations, sign-in and the contact form, and counting runs per internet address, to keep the service working and stop it being abused.
• Consent: four things here run on consent, and you can withdraw any of them at any time. Hearing from us about the product, if you tick that box, which you withdraw from your account page. Your health answer, if you give one, which you withdraw from your account settings; because it is health information, the law asks for explicit agreement (GDPR Art. 9(2)(a)), which is what that tick box records. Google Analytics, which you withdraw from Cookie settings at the bottom of any page. And your answer to how you heard about us, which we delete if you write to us. Everything else this site stores is strictly necessary and so does not ask; the cookies page lists every item.

5. How long we keep it

Account data: for as long as your account is active. After account deletion, a 30-day grace period applies (during which you can cancel the deletion). After the grace period, every row tied to your account is hard-deleted.

Payment records: per our payment processor's retention schedule and applicable accounting law (typically 5–10 years in Greece).

Analytics: 6 months, then deleted by Umami. What is kept is actions and the rotating visit code, never your name, your email, or anything you entered. Where you accepted Google Analytics, Google keeps that event data for 14 months and then deletes it.

Calculations: the inputs are not stored. The results are deleted 10 minutes after your browser collects them and never kept longer than an hour. The per-address counts used to stop abuse are deleted after a day. Our servers' technical logs, which never contain your inputs, are deleted after at most 14 days. Once our database is on a plan with daily backups, a result that happened to exist at the moment of a backup stays in that backup until it expires, at most 7 days.

Error reports: kept by Sentry for at most 90 days, then deleted. That includes the inputs of a failed run and any masked replay attached to the report.

6. Where it lives

All account data is stored on servers in the EU (Frankfurt), encrypted at rest by the underlying cloud provider. Access is enforced by the database itself rather than by our application code, so a row can only ever be read by the account that owns it. The company operating those servers is named in section 8.

Your plans are calculated on servers in Belgium, run for us by Google Cloud, and nowhere else.

7. Your rights (GDPR)

These rights are not only for EU residents. They apply to everyone who uses the service, wherever you live, and your account data is stored in the EU either way.

• Access: export everything we hold on you as JSON from your account settings.
• Rectification: edit your inputs and saved scenarios directly.
• Erasure: delete your account from the account settings.
• Restriction & objection: contact us to limit specific processing.
• Portability: the export is a standard JSON file; you can take it elsewhere.
• Complaint: you may complain to the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens (dpa.gr), which is our supervisory authority. If you live elsewhere in the EU you may complain to the authority where you live instead.

8. Companies that handle your data

These are the companies that handle your data for us, most of them as processors, which means they act only on our instructions. We name them rather than describing them in categories, because the point of the list is that you can go and check any of them yourself.

• Supabase: holds your account and your saved plans, handles signing you in, and holds each calculation's results until your browser collects them. Hosted in the EU.
• Google Cloud: runs the servers that calculate your plan, in Belgium. It receives your inputs for each calculation, including your health answers if you gave them, and keeps nothing once the calculation is done. It acts only on our instructions, under Google's Cloud data processing terms. This is a different role from the Google advertising entry below, and the two are kept apart.
• Cloudflare: serves the site itself, and runs the bot check described in section 2. It does not receive your plans. For the bot check it acts on our instructions, except that it also uses what it sees to get better at telling people from scripts, and for that part it decides for itself, under its Turnstile privacy addendum.
• Stripe: takes the payment if you buy Premium, through its Link service, and receives what you give it at checkout. Because Link is the merchant of record, Stripe decides for itself how it uses that information, under its own privacy policy, rather than only on our instructions.
• Umami: counts page visits and which features get used, and groups one visit's actions under a rotating code derived from your IP address and browser. It sets no cookies, receives nothing you typed, and cannot recognise you on another site. Hosted in the EU.
• Google: receives analytics and advertising measurement, but only from people who accepted it. It learns which pages were opened and the four commercial moments named in section 2, and never anything you typed. Unlike the others on this list, Google decides for itself how it uses that information across its own advertising products, under its own privacy policy, rather than only on our instructions. Our contracting party in Europe is Google Ireland Limited.
• Resend: sends the email we generate: your sign-in links and account notices (a change of email address, Premium switched on or off after a purchase or refund, and the notices when you ask us to delete your account), a summary of your results if you ask for one, and anything you send us through the contact form. It receives your email address and the contents of that message.
• Sentry: receives the error report when something breaks, which for a failed simulation includes that run's inputs. EU region.

9. Sending data outside the EU

Your account data is stored in the EU, your plans are calculated in the EU, Umami analytics is hosted in the EU and error reports go to Sentry's EU region. Several of the companies above are American even when they hold the data in Europe, though, and three of them receive personal data directly: Stripe, who take your payment, Resend, who deliver the email you ask for, and Google, if you accepted analytics cookies. Google is the one that does not keep the data in Europe: it processes analytics on servers in the United States.

Where personal data reaches a company outside the EU, the transfer runs on the European Commission's standard contractual clauses, which are in our data processing agreement with each of them. The same clauses cover Google Cloud, whose support staff may reach the calculation servers from outside the EU when they keep them running, though the servers themselves stay in Belgium. Stripe, Sentry and Google are additionally certified under the EU-US Data Privacy Framework. These are the safeguards GDPR Chapter V requires, and you can ask us for the detail on any one of them.

10. Changes

When we make a material change to this policy, we email every account holder when the change takes effect, saying what changed. The date at the top of this page is the date of the latest version.

---

Questions? privacy@retiresafe.io or via the contact page.