Legal
ImprintPrivacy Policy

Privacy Policy

Status: 〈DD.MM.YYYY〉

1. Controller

The controller responsible for data processing on this service is:

Zircles GmbH, 〈Straße Hausnummer, PLZ Ort, Deutschland〉, Germany. Email: 〈kontakt@zircles.eu〉.

2. What data we process

Depending on how you use Zircles, we process:

  • Account data: email address, password (stored only as a hash by our authentication provider), and login metadata.
  • Profile data: display name, nickname, date of birth, avatar, time zone and language preference.
  • Family/circle content you create: tasks, events, shopping and gift lists, notes, people you add, and how work is shared.
  • Health data (special category, Art. 9 GDPR): vaccination records and other health documents you scan, and the reminders derived from them. We only process these with your explicit consent.
  • Calendar data: events and availability from Google or Microsoft calendars you choose to connect via OAuth.
  • Messaging data: messages you forward to our WhatsApp/Telegram capture bots, and voice braindumps you record (audio is transcribed and then discarded — recordings are not stored).
  • Uploaded documents: files you upload for scanning, kept to provide the scan result and let you review the source.
  • Usage and billing data: feature usage counters, subscription status and payment metadata handled by our payment provider (we never see full card numbers).
  • Technical data: IP address, device/browser information and logs needed to operate and secure the service.

3. How and why we use it

We use your data to:

  • Provide the service — manage your account, circles, tasks, calendar and lists (legal basis: performance of a contract, Art. 6(1)(b) GDPR).
  • Run AI features — extract tasks, events and health dates from your documents and voice notes, generate weekly digests, briefings and suggestions. Document and health processing relies on your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
  • Send notifications and lifecycle emails — reminders, weekly overviews and onboarding/trial emails you can switch off at any time (Art. 6(1)(b) and (f) GDPR).
  • Handle billing — process subscriptions and the Founding Family offer through our payment provider (Art. 6(1)(b) GDPR).
  • Keep the service secure and improve it — diagnostics, abuse prevention and error monitoring (Art. 6(1)(f) GDPR).

4. Where your data is hosted (EU)

We deliberately keep data within the European Union and work with the following processors under data processing agreements (Art. 28 GDPR):

  • Supabase — database and authentication. Data is hosted in the EU (Sweden).
  • Railway — application and worker hosting. Data is hosted in the EU (Netherlands).
  • Google (Gemini API) — AI text and vision processing for scans, briefings and the assistant. Requests are routed to a European region.
  • Resend — delivery of transactional and lifecycle emails.
  • Stripe — payment processing for subscriptions.

5. Sharing within your circle

Content you add to a circle (tasks, events, lists, people, health reminders) is visible to the other members of that circle, because shared coordination is the purpose of the product. Gift items assigned to a person are hidden from that person to preserve the surprise. Private tasks are visible only to you.

6. Optional features you can turn off

Several data-processing features are optional. You can disable them at any time, and the rest of the app keeps working:

  • Health record scanning and reminders — disable per circle in the circle settings (the health feature). Without it, no health documents are processed.
  • Calendar sync — connect or disconnect Google/Microsoft calendars under Settings → Calendar. Disconnecting stops all calendar data processing.
  • Messaging capture (WhatsApp/Telegram) — connect or disconnect under Settings → Messaging.
  • Email and push notifications — toggle individually under Settings → Notifications, including the onboarding/trial lifecycle emails.
  • Account deletion — remove your account and associated data entirely under Settings → Account.

7. Retention and deletion

We keep your data for as long as your account exists. You can delete your account at any time under Settings → Account; we send a confirmation code to your email, and on confirmation your profile, tasks, messages, health records, documents and calendar connections are permanently removed and any connected calendar access is revoked. Scanned documents are automatically deleted after 90 days. Some records (e.g. billing, and an anonymized log of the deletion itself) may be retained for as long as statutory retention periods require.

8. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Rectify inaccurate data (Art. 16).
  • Erase your data (Art. 17) — including via account deletion.
  • Restrict or object to processing (Art. 18, 21).
  • Data portability (Art. 20).
  • Withdraw consent at any time, without affecting prior processing (Art. 7(3)).

9. Right to complain

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: 〈zuständige Datenschutz-Aufsichtsbehörde〉.

10. Contact

For any privacy request, contact us at 〈kontakt@zircles.eu〉.