Privacy Policy

1. Data controller

The controller for processing personal data is:

Rutimo
Owner: André Mentlen
Elfenweg 1
8038 Zurich
Switzerland

Email: [email protected]

2. General

This privacy policy explains which personal data we process when you use our website, create a personalized plan, or place an order.

We process personal data under the Swiss Federal Act on Data Protection. Where the EU General Data Protection Regulation applies, we also process personal data in accordance with the GDPR.

Personal data means information relating to an identified or identifiable person.

3. Visiting the website

When you visit our website, technically necessary data may be processed, including:

• IP address
• date and time of access
• page or file accessed
• amount of data transferred
• browser type and version
• operating system
• referrer URL
• technical error messages

This data is needed to provide the website, monitor security, and investigate technical issues.

Server log data is generally stored for 30 days and then deleted, unless longer retention is required to investigate a security incident.

4. Creating personalized plans

When you create a personalized plan, we process the information you enter. This may include:

• child's first name or label
• selected design, colors, and symbols
• weekdays, activities, and routines
• uploaded images for custom activities or day markers
• other freely entered content
• technical information about the created plan

Please do not enter sensitive information that is not needed to create the plan. Only enter details about children or other people if you are authorized to do so.

The data is used to generate the preview, personalize the ordered plan, and provide the PDF file.

Drafts may be stored locally in your browser. Completed plans and related download files are generally deleted or anonymized after 90 days, unless legal duties or legitimate reasons require longer retention (for example ongoing support requests or record-keeping duties).

5. Orders and contract processing

When you place an order, we may process in particular:

• name
• email address
• billing address, if collected
• ordered product
• personalization details
• order number
• price and currency
• payment status
• time of order
• technical information for delivery and download

We use this data to process the order, provide the plan, communicate about the order, and meet legal record-keeping duties.

Contract and billing data are stored as long as needed for contract processing. Data subject to statutory retention duties may be stored until the relevant period ends.

6. Payment processing

We use Stripe for payment processing. Depending on the selected method, payment may for example be by card or TWINT.

Data required for payment is transmitted to Stripe or to the banks and payment providers involved. Which data is processed depends on the selected payment method.

Rutimo mainly receives payment status, amount, currency, and a transaction reference. We do not receive or store credit card data. Further payment data may be processed by the payment provider depending on the method.

Payment provider: Stripe Payments Europe, Limited, Ireland.

The payment provider's own privacy information applies in addition.

7. Providing and sending PDF files

After a successful order, the personalized plan is provided as a PDF file, typically via a download link.

For order confirmations and download links we use Resend (Resend, Inc., USA). In particular, the email address, order number, and information needed for delivery are processed.

8. Hosting, database, and file storage

Our website and order-related data are operated or stored with:

• Hosting: own server at Hetzner Online GmbH, Germany; access via Cloudflare, Inc., USA (CDN and DNS)
• Database and file storage: Supabase Inc. (EU region, Frankfurt)
• Error monitoring: Sentry (Functional Software, Inc. / Sentry) — no session replay and no intentional transmission of child names, plan content, or payment data

Providers process data on our behalf unless they are independently responsible for specific processing.

9. Contact

If you contact us by email or contact form, we process the details you send to handle your request. This may include name, email address, message content, order number if provided, and time of contact.

For spam protection on the contact form we use Cloudflare Turnstile (Cloudflare, Inc., USA).

Contact requests are deleted once fully handled, unless legal or contractual reasons require longer retention. The usual retention period is 12 months.

10. Cookies and local storage

We use technically necessary cookies or similar storage technologies where required to run the website, checkout, payments, stored inputs, language settings, your cookie choice, or security. Technically necessary cookies can be used without additional consent.

We also use PostHog (PostHog Inc., EU cloud) for anonymized website and wizard usage analysis, based on our legitimate interest in improving and operating the website. Child names, email addresses, uploaded images, and custom activity content are not sent to PostHog.

To measure and improve ads we use the Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd.). Usage data (for example page views, checkout steps, purchases) may be sent to Meta and linked to Meta accounts. This is based on our legitimate interest in reach measurement and operating the site; where required, also on consent via the cookie banner. You can object via the cookie banner (“I’d rather not”) with effect for the future. After opting out, the Meta Pixel and related marketing events are no longer loaded or sent server-side.

You can object to analytics via the cookie banner (“I’d rather not”) with effect for the future. After opting out, PostHog is no longer loaded. Alternatively, write to [email protected].

11. Legal bases

Where the GDPR applies, processing is based in particular on:

• pre-contractual steps and performance of a contract
• compliance with legal obligations
• legitimate interests, especially secure and economic website operation
• consent, where obtained

Consent can be withdrawn at any time with effect for the future. Processing before withdrawal remains lawful.

12. Recipients of data

Personal data may in particular be disclosed to these categories of recipients:

• hosting and IT providers
• database and storage providers
• payment providers and banks
• email and communication providers
• analytics and monitoring providers, where used
• accounting and fiduciary providers
• authorities and courts where legally required

Disclosure for other purposes only occurs where there is a legal basis or consent.

13. International transfers

Some providers may process data outside Switzerland, Germany, or the European Economic Area.

In those cases we ensure an adequate level of protection or use appropriate safeguards where legally required, such as adequacy decisions, standard contractual clauses, or other measures provided by law.

14. Data security

We take appropriate technical and organizational measures to protect personal data against loss, unauthorized access, alteration, and disclosure.

Completely risk-free transmission of data over the internet is not technically possible.

15. Rights of data subjects

Depending on applicable data protection law, you may in particular have the right to:

• access processed personal data
• rectify inaccurate data
• erasure of data
• restriction of processing
• receive or transfer certain data
• object to certain processing
• withdraw consent given

To exercise these rights, write to [email protected].

We may ask for suitable proof of identity where needed to prevent unauthorized disclosure.

You may also contact a competent supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner. For people in the European Union, the supervisory authority at their place of residence may also be competent.

16. Changes

We may update this privacy policy if our processing, providers, or legal requirements change.

The version published on the website applies.