1. Controller

The controller for the processing of your personal data is:
Retainly GmbH (or the operating entity), Germany.
Contact: privacy@getretainly.app

2. Data we collect

Account data: Email address (for authentication via magic link), workspace name.

Billing data: Payment method details (processed by Stripe, Inc. — we never store raw card numbers). Billing email, invoice history.

Usage data: Cancel sessions, flow events, save rates. This data belongs to the SaaS company (our customer) and is processed on their behalf.

End-user data: When the SDK is embedded in a customer's product, Retainly may process end-user email addresses and cancellation reasons as a data processor on behalf of the SaaS company (the controller).

Log data: IP addresses, browser type, timestamps — for security and abuse prevention. Retained 30 days.

3. Legal basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) — account management, billing
• Legitimate interest (Art. 6(1)(f)) — fraud prevention, security, analytics
• Legal obligation (Art. 6(1)(c)) — tax records, compliance

4. Data processors (sub-processors)

Transfers to the USA are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses.

5. Data retention

Account and usage data: as long as the account is active, plus 30 days after deletion request (cooling-off period).

Billing records: 10 years (tax law obligation, §147 AO).

Log files: 30 days.

6. Your rights (GDPR)

You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection.

To exercise any right, email privacy@getretainly.app. Erasure requests are processed within 30 days via our automated GDPR deletion system.

7. Cookies

We use only technically necessary cookies (session management, CSRF protection). No advertising cookies, no third-party tracking. No cookie consent banner required.

8. Supervisory authority

You have the right to lodge a complaint with the competent supervisory authority. In Germany: Landesbeauftragte für den Datenschutz of the relevant federal state.