Getcandl is a personal birthday reminder tool. We collect the minimum data needed to run the service and never sell it. This policy explains exactly what we collect, why, and what your rights are.
Getcandl is operated by Sylvain Zircher. Our service is hosted in the EU (Frankfurt, Germany). For any privacy questions, contact us at hello@getcandl.app.
We collect only what is necessary to provide the service:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account login, sending reminders | Contract performance |
| Contact & birthday data | Core reminder service | Contract performance |
| Billing data | Subscription management | Contract performance |
| Server logs | Security, fraud prevention | Legitimate interest |
We use a small number of trusted sub-processors to run the service. All are GDPR-compliant and process data under our instructions:
Your data is kept for as long as you have an account with Getcandl. If you delete your account, all your data (contacts, gift history, profile) is permanently deleted within 30 days. Server logs are deleted after 30 days on a rolling basis.
As a user based in the EU or UK, you have the following rights under GDPR:
To exercise any of these rights, email hello@getcandl.app. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
Getcandl uses only essential cookies, specifically a session cookie that keeps you logged in. We do not use advertising, tracking, or analytics cookies. No cookie banner is needed.
All data is encrypted in transit (TLS) and at rest. Database access is restricted via row-level security policies. Your data is only accessible to your account. We use Supabase's managed infrastructure in Frankfurt, which is ISO 27001 certified.
If we make material changes, we will notify you by email at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.
Questions about this policy? Email us at hello@getcandl.app.