Privacy Policy.
Learn how NevaPlan collects, uses, and protects your personal data. GDPR and CCPA compliant.
Introduction
NevaPlan ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our web application and services.
NevaPlan is a personal planning and productivity platform offering Budget Planner, Goal Planner, Habit Tracker, Wedding Planner, Project Manager, and Trip Planner tools.
For questions about this policy, contact us at [email protected].
Data Controller: NevaPlan is operated as an independent online business. The data controller can be reached at [email protected], and further contact details are available on request.
Information We Collect
Account Data
Email address, display name, and password (stored as a secure hash — we never store your plain-text password).
Financial & Planning Data
Budget entries, transactions, account balances, recurring payments, goals, habits, and wedding planning details that you enter into the platform.
Technical Data
IP address, browser type, device information, and session data collected automatically when you use our service.
Usage & Analytics Data
Anonymous pageviews, referral source, UTM campaign parameters, viewport size, and performance metrics from our public website, together with a random first-party visitor identifier stored in your browser. If you create an account, this may be linked to your account to attribute your sign-up to a channel.
Information About Other People
If you use planning features such as the Wedding Planner, you may enter details about third parties (for example guest names, email addresses, phone numbers, postal addresses, dietary needs, and allergies). See "Information About Third Parties" below for how this is handled.
How We Use Your Information
We process your personal data based on the following legal grounds under GDPR Article 6:
- To provide our services and maintain your account (contractual necessity)
- To send essential communications such as password resets and email verification (legitimate interest)
- To protect against fraud, abuse, and unauthorized access (legitimate interest)
- To analyze usage patterns and improve our platform (legitimate interest)
Data Storage & Security
Your data is stored in access-controlled PostgreSQL databases on secured infrastructure. We use industry-standard security measures including:
- HTTPS/TLS encryption for all data in transit
- bcrypt hashing for passwords
- HttpOnly secure cookies for authentication
- regular security audits and vulnerability assessments
Data Breach Notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Article 33).
Where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay (GDPR Article 34).
Financial Data Notice
NevaPlan is a planning tool, not a financial institution. We are not subject to the Gramm-Leach-Bliley Act (GLBA) or similar financial regulation.
All financial data on NevaPlan is entered manually by you. We do not connect to your bank accounts, credit cards, or any financial institution.
Your budget entries, transactions, goals, and planning data are stored securely and are never sold, nor shared with third parties for marketing or profiling purposes.
Data Retention
- Active accounts: Your data is retained as long as your account remains active.
- Deleted accounts: After account deletion, your data is soft-deleted and permanently removed after 90 days.
- Financial records: Retained for 7 years as required by applicable tax and financial regulations.
Your Rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
GDPR Rights (EU/EEA Residents)
- Right to access your personal data
- Right to correct inaccurate data
- Right to request deletion of your data
- Right to data portability (export your data)
- Right to object to data processing
- Right to restrict processing of your data
CCPA Rights (California Residents)
Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information is collected, request deletion, and opt-out of the sale of personal information. NevaPlan does not sell personal information.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Analytics & Attribution
On our public website we run our own first-party, cookieless analytics. When you visit a public page, we record an anonymous pageview, the page address, viewport size, referral source, and any UTM campaign parameters. This basic measurement carries no identifier and stores nothing on your device; on our servers your IP address is never stored — visits are grouped using a hash that changes every day, so they cannot be linked across days or across websites. Only if you opt in via the cookie banner do we add a random identifier (np_cid), kept in your browser's local storage, so we can recognise return visits.
We also use Sentry for error and performance monitoring. When a problem occurs, Sentry may process technical data such as your IP address, browser, and a diagnostic report so we can fix it.
If you create an account and have opted in to analytics, we may link the anonymous visit that led to your sign-up to your account, solely to understand which channels bring new users. We never sell this data. Use for advertising measurement is opt-in only via our cookie banner. The legal basis for the anonymous measurement is our legitimate interest (GDPR Article 6(1)(f) and the equivalent KVKK ground) in measuring and improving our service; you may object at any time by contacting us.
Third-Party Services
We use the following third-party services to operate our platform:
- LemonSqueezy — Payment processing for one-time purchases (name, email, billing details). LemonSqueezy is our merchant of record; its privacy policy applies to payment data.
- Resend — Transactional emails (password resets, verification, newsletters).
- Sentry — Error and performance monitoring. May receive diagnostic data (such as IP address, browser, and error details) when a problem occurs.
- Cloudflare — Content delivery, security, and the Turnstile bot-protection check on our authentication pages. Processes connection metadata such as your IP address.
- Meta (Facebook/Instagram) — Advertising measurement pixel, loaded ONLY when you opt in to advertising cookies. Sends anonymized event signals (pageviews, purchase events) so we can measure ad performance. You can revoke consent at any time from the cookie banner.
- Pinterest — Advertising measurement tag, loaded ONLY when you opt in to advertising cookies. Sends anonymized event signals so we can measure Pinterest ad performance. You can revoke consent at any time from the cookie banner.
We do not sell or rent your personal data. We only share data with the third parties listed in this section, and only the minimum needed for each function. Advertising platforms are loaded only when you opt in via our cookie banner.
Pinterest Integration
NevaPlan uses the Pinterest API to publish our own brand-owned marketing content (Pins that link to nevaplan.com) and to read the resulting analytics so we can improve that content. NevaPlan is not endorsed by, certified by, or affiliated with Pinterest, and our use of the Pinterest API does not imply any such relationship.
The Pinterest connection links a Pinterest account that we own and operate. Our customers and visitors do not connect their own Pinterest accounts to NevaPlan, and we do not access the private Pinterest data of our customers or any other Pinterest users.
Any data we obtain from the Pinterest API — such as access tokens, board information, and aggregate performance metrics for our own Pins — is stored securely and encrypted at rest. When the Pinterest account is disconnected, the stored access and refresh tokens and the associated account records are permanently deleted from our systems.
We do not sell, rent, redistribute, or otherwise share Pinterest content or any Pinterest-derived data with third parties. It is used solely to operate and improve our own first-party marketing.
Information About Third Parties (Guests & Contacts)
Some features let you store information about other people — most notably the Wedding Planner, where you can record guests' names, contact details, postal addresses, dietary needs, allergies, and RSVP status.
For information about other people, you act as the data controller and NevaPlan acts as a processor on your behalf. You are responsible for informing those individuals and for having a lawful basis (such as their consent) to enter their data.
If someone whose data you stored asks us to access or delete it, we will direct the request to you and help you honor it. This information is deleted together with the related plan, or within 90 days of your account deletion.
International Data Transfers
Your data may be transferred and processed in countries outside of your country of residence. We ensure adequate protection through standard contractual clauses and compliance with applicable data transfer regulations.
AI & Machine Learning
NevaPlan does not use your personal data or financial information to train artificial intelligence or machine learning models.
If we introduce AI-powered features in the future, your data will only be processed for your individual experience and will never be used to train generalized models. We will update this policy and notify you before any such change.
Children's Privacy
NevaPlan is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected].
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the updated policy on our website. Your continued use of the service after such changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us: