The data controller for Christmas Planner is 3lb savjetovanje i usluge, vl. Rusalka Majer, Ulica Jurja Križanića 22, Varaždin, Croatia. You can reach us at hello@christmasplanner.app. This policy explains what personal data we process when you use Christmas Planner, why, and what rights you have.

• Account data: your email address, an optional display name and your password (stored only as a secure hash by our authentication provider).
• Planner content you enter: gifts, budgets and expenses, guests (including any names, emails, phone numbers or dietary notes you add about them), menus, shopping lists, tasks, event details and mood board images.
• Technical data: sign-in timestamps, plan status and usage counters, and server logs needed to run and secure the service.
• Anonymous quiz results: if you take the planner-type quiz, we record only the result type, with no link to you.

• To provide your account and planner, and to send service emails such as sign-up confirmation, password reset and a welcome message (performance of our contract with you, GDPR Art. 6(1)(b)).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest, Art. 6(1)(f)).
• To understand which planner types use the app, using anonymous quiz results only (legitimate interest, Art. 6(1)(f)).

Christmas Planner is currently a free closed pilot. No payments are taken and no payment data is collected. AI helpers are switched off, so your planner content is not sent to any AI service. We will update this policy before either feature is switched on.

• Lovable Cloud (Supabase): hosting, database and sign-in.
• Resend: delivery of service emails.
• Google Fonts: delivers the app's font, which means your browser's IP address is sent to Google when a page loads.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep your data for as long as your account exists. When you delete your account in Profile, your planner data and your sign-in account are deleted immediately. Copies may remain in our hosting provider's routine backups until those backups expire.

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. In Profile you can download a copy of your data as a JSON file and delete your account yourself. For anything else, email hello@christmasplanner.app.

You may also complain to a data protection authority. In Croatia this is the Personal Data Protection Agency (AZOP), azop.hr.

We use only what is strictly necessary: browser storage that keeps you signed in and remembers your preferences, such as currency. There are no advertising or analytics cookies.

Christmas Planner is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Data is encrypted in transit, access to each account's data is enforced by the database, and passwords are never stored in plain text. No online service is completely secure, so please use a unique password.

When we change this policy, we update the date above. For significant changes we will also tell you by email or in the app.