1. Controller and contact
The controller is Christopher Gobien, acting in his own name as a natural person, Ofterdingenstr. 42, 45279 Essen, Germany. Privacy questions and rights requests can be sent to admin@seatharmony.net.
No data protection officer is currently appointed.
2. Website, app backend and security logs
When the website is requested, the hosting infrastructure necessarily processes connection and request data such as the IP address, time, requested URL, response status, referrer and browser or device information so that the page can be delivered and protected.
When the app uses online functions, Firebase Authentication, App Check, Cloud Functions, Firestore and Cloud Storage process the account identifier, sign-in and verified-email state, information used to check that the request comes from the app, request metadata and the content needed for the selected function. Local planning, PDF/image preparation and CSV/PDF exports stay on the device or browser until an account synchronization or AI function sends the relevant content. Verified accounts synchronize plans and referenced assets for free on web and mobile. In-app exports, printing and other marked premium tools require the relevant active, server-confirmed Planner Plus access. AI requests require a registered account and available AI credits, independently of Planner Plus; current planning limits and other premium restrictions still apply to accepted changes. A local plan becomes cloud-backed only after synchronization succeeds.
The website is delivered through Firebase Hosting and a dedicated second-generation Firebase Cloud Function in the Firebase project controlled by Christopher Gobien. The function is deployed in us-central1 (Iowa, USA). Google processes customer personal data as a processor under the Firebase Data Processing and Security Terms and may engage the subprocessors listed in its current register.
For customers with a German billing address, Google's current contracting-entity table identifies Google Cloud EMEA Limited as the contracting entity for Firebase Paid Services, unless separately agreed otherwise. The applicable agreement remains authoritative. The table is available at https://cloud.google.com/terms/google-entity.
Firebase Hosting is a global service. The function's US compute region does not prevent Google or authorised subprocessors from processing data in other countries under the agreement. For restricted transfers, the Firebase Data Processing and Security Terms provide for an applicable Data Transfer Solution, including the EU-US Data Privacy Framework where available, or the relevant Standard Contractual Clauses. The terms and SCC links are available at https://firebase.google.com/terms/data-processing-terms.
Firebase states that Hosting uses incoming-request IP addresses to detect abuse and provide usage analysis and retains this IP data for a few months. The app projects' Cloud Logging configuration was checked on 6 September 2026: function request and application logs routed to the _Default bucket are retained for 30 days; Google's locked _Required bucket retains administration and system audit logs for 400 days. No project-level logging exclusions or additional log buckets were configured.
The legal basis is Article 6(1)(f) GDPR: the legitimate interests in reliably delivering, securing and diagnosing the website.
3. Contact by email and feature requests
If you contact SeatHarmony by email, including with feedback or a feature request, the message, sender information, time and any information you choose to include are processed to answer, assess and document the request. If a requested idea becomes a released feature, the contact details can also be used to tell you and, where you have a registered SeatHarmony account, to arrange the manually granted complimentary AI credits described on the marketing page. Do not send sensitive or unnecessary personal information.
Google Workspace provides the mailbox. Messages are accessible to the SeatHarmony operator and the service providers needed to deliver and secure the mailbox. They are kept while needed to answer and document the request, then deleted unless a contract, statutory duty or legal claim requires longer retention.
Subject to the terms incorporated into the applicable account agreement, Google provides its Cloud Data Processing Addendum for processing mailbox data on SeatHarmony's behalf. Account-level incorporation or acceptance of that Addendum was not independently verified for this release, so the actual account agreement remains authoritative. For a direct Google Workspace agreement with a German billing address, Google's current contracting-entity table identifies Google Cloud EMEA Limited in Dublin, Ireland, unless a different agreement applies. The entity table and Addendum are available at https://cloud.google.com/terms/google-entity and https://cloud.google.com/terms/data-processing-addendum/.
No EEA-only Workspace data-region setting was verified for this release, so no such restriction is claimed. Google may process email data in the EEA, the United States and other countries where Google or its authorised subprocessors maintain facilities. Current subprocessor locations are listed at https://workspace.google.com/terms/subprocessors/.
For EU/EEA transfers to and onward from the United States, Google states that Google LLC is certified under the EU-US Data Privacy Framework. Where the applicable account agreement incorporates Google's Cloud Data Processing Addendum and no adequacy decision or other alternative transfer solution applies, Google provides the relevant EU Standard Contractual Clauses, including for onward transfers to subprocessors. Google's transfer statement and processor-to-processor clauses are available at https://cloud.google.com/terms/alternative-transfer-solution and https://cloud.google.com/terms/sccs/eu-p2p-google-exporter. A copy of the safeguards applicable to the account may also be requested from admin@seatharmony.net.
Depending on the request, processing relies on Article 6(1)(b) GDPR for pre-contractual communication or Article 6(1)(f) GDPR for ordinary product and business correspondence, product improvement, avoiding duplicate follow-up and documenting any voluntary manual credit allocation.
App accounts, event plans and guest information
Public guest invitations use a necessary first-party browser cookie to remember which household or guest this browser replied for and to allow a new reply for that same household. It contains an opaque identifier, not guest names or answers. The server keeps the invitation-specific binding and receipt recognition for a fixed maximum of 180 days, limited further by the invitation's validity. This does not return earlier answers or verify the respondent's identity. Clearing cookies or using another browser removes browser recognition; replies still require host review. This functional cookie belongs to the invitation app, not the public information website's marketing pages.
SeatHarmony creates an anonymous Firebase identity for online security on supported native devices, and when needed for explicit web account registration or your deliberate choice to join a shared plan without an account. Limited local planning does not require a registered account. You can create one for free in the web, Android or iPhone app. Registration upgrades the existing identity while preserving its user ID and associated data. Signing in with a verified email address starts free account synchronization across devices. Planner Plus is required only for marked premium tools and higher limits. A registered account additionally uses the supplied email address, provider identity, verified-email status, linked sign-in methods and minimum profile metadata. The app records the accepted Terms version and time and the acknowledged privacy-information version and time. Verification, password-reset and email-change messages are sent through Firebase Authentication. Sign in to a registered account before buying or restoring a purchase. Purchases, entitlements and AI credits belong to the account used for the verified purchase.
Optional plan collaboration lets a Planner Plus owner invite one person per link to view guest display names, seating and visible room content. Contacts, notes, relationship rules, catering, budgets, files and images are excluded. Joining is free with an account or an explicit anonymous identity. Firebase processes the chosen display name, membership, timestamps and private text messages. Each conversation is visible only to the owner and that recipient; it grants no editing authority. Unused invitations are valid for seven days. Removing access or leaving prevents further shared access but does not itself erase retained owner correspondence; archiving or a lapse in the owner’s Planner Plus pauses sharing. Account deletion removes the participant’s authored messages and identifying membership fields, including messages written before an account upgrade. The owner’s own text may remain under the owner’s account with a generic removed-participant record; deleting the owner’s account removes the conversation through guarded, retryable cleanup. Private messages have no fixed automatic expiry. A scoped recovery proof preserves shared access through deliberate account entry; web recovery uses that browser tab’s session storage and native apps use protected device storage. Opening or installing the app is not acceptance of an invitation.
An event plan can contain an event title, guest names, attendance, tags, table and seat assignments, relationship or separation preferences, room dimensions and room elements, optional notes, imported floor-plan images, and generated or reviewed proposals. Device-local plans use the native app's local database; browser-local plans use storage belonging to that browser profile. After verified sign-in, eligible local plans and the account's saved plans synchronize through the SeatHarmony backend to Firestore and Cloud Storage, including referenced images. Distinct plans are preserved and conflicting versions of the same plan require review. Copies associated with another account are kept separate. Only successful synchronization establishes a current cloud copy. Synchronization, retrieval, recovery and deletion are free; in-app exports and printing require active Planner Plus.
Optional event details include an event date, household membership, adult/child/unspecified classification without a birth date, ordinary meal and drink preferences, and service-provider names, addresses and contact notes. On Android and iPhone, optional contact permission lets the native picker read display names on the device for searching and selecting several people. Only selected names are added for review; the address book is not uploaded, and phone numbers, email addresses and photos are not imported. Optional device-local reminders use generic notification text and the latest saved preparation state. Enabling invitations makes event and guest names, household grouping and completion flags available to anyone with the shared link. Earlier attendance and preference answers are never returned to guests. A fresh guest submission is unverified and private to the host; the host reviews it before applying changes. Invitation content is kept with the retained plan. Do not enter medical history or diagnoses in meal-preparation notes.
Budget entries can include titles, notes, currency and planned, actual and paid amounts. Checklist tasks can include titles, due dates, notes and completion status. Selected budget files can contain personal data; new uploads require Planner Plus and accept PDF, JPEG, PNG or WebP up to 10 MiB per file. These files are not automatically sent to an AI provider.
Address fields offer Google suggestions as you type. You can turn suggestions off in the field for manual-only entry. Opening or focusing a saved address does not start a search. The typed search text, selected language and a search-session token pass through the SeatHarmony server to Google Places. SeatHarmony does not log search text and saves only the street address you select in the event or service-provider address field. Suggested-address lists are not saved. You can always enter an address manually, including if search is unavailable.
This optional search uses Google Maps content. Use of this function is subject to the current Google Maps/Google Earth Additional Terms of Service at https://maps.google.com/help/terms_maps.html and Google Privacy Policy at https://policies.google.com/privacy. Google processes search requests under its applicable privacy information; no special Google retention or regional restriction is promised here.
Guest information normally comes from the SeatHarmony user rather than from the guest. The user must be entitled to enter and use it and, where required, inform guests about the planning, cloud synchronization and optional AI processing. SeatHarmony is not designed for health information, religious beliefs, political opinions, biometric identifiers or other special-category or highly sensitive guest data; users should not put such information in names, tags, notes, prompts, images or recordings.
SeatHarmony uses Article 6(1)(b) GDPR for the account holder's data needed to provide the requested service and Article 6(1)(f) for necessary security, abuse prevention, fault diagnosis and economic evidence. Professional guest-plan content is processed on the customer's documented instructions under the processing terms; the customer determines its lawful basis and guest information duties. For private event planning, ordinary guest processing supports the user's requested event and the legitimate interests in preparing that event with minimal data, subject to guests' applicable rights. No in-app acknowledgement supplies a missing lawful basis or permission for another person's data.
Cloud plans, referenced assets and invitation content become eligible for inactive-account cleanup after 180 days without owner login or synchronization activity and without active paid access. The period starts no earlier than the recorded paid-through date or the introduction of this policy. Owner activity extends it; scans and replies through a guest link do not. Active Planner Plus access prevents this inactivity expiry. Local device/browser plans are not automatically deleted by cloud retention. Removal from the active workspace and invitation access is followed by asynchronous recovery, asset and provider-backup cleanup under the separate periods below. Account and economic records follow their own retention rules.
Account deletion removes the Firebase identity and initiates deletion of synchronized plans, plan assets, current records of subscription access and available features, and SeatHarmony-held AI operation and result state. Local data on another device, in browser storage or in an export is not erased remotely. The pseudonymous deletion-security marker and purchase/payment, non-developer credit, voucher-redemption, and payment-credit-claim evidence described below may remain in the backend; deleting a SeatHarmony account does not cancel an external subscription.
AI-assisted planning, images and speech transcription
AI processing starts only after the user chooses an AI function and acknowledges the just-in-time information in the app. SeatHarmony sends the user's instruction and only the plan details needed for the request through its authenticated and App Check-protected backend to the paid OpenAI or Google Gemini API. Depending on the task, this context can include guest names, attendance, tags, relationships, tables, room information and an image selected by the user. The service limits the details sent to the provider and checks proposed changes against the complete plan.
Audio is recorded locally while you speak. Stop sends the completed recording in one request through the SeatHarmony backend to the paid OpenAI or Google Gemini API for transcription. Cancel before Stop discards the local recording without using AI credits. Successful transcription costs one AI credit per started minute, with a minimum of one credit, including when no speech is recognized and the result is empty. Provider or server failure is refunded. You can edit the transcript; only an explicit Send starts the separate paid planning request. Website browsing sends no content for AI processing. The microphone requires your action and platform permission.
The Assistant and completed-recording transcription normally use OpenAI; Google Gemini remains an alternative provider for these functions. Floor-plan import uses Google Gemini. OpenAI states that API inputs and outputs are not used for training by default. For Assistant requests, its abuse-monitoring retention is up to 30 days, with longer retention where required by law or reasonably necessary to protect services or third parties from harm. SeatHarmony disables stored Responses and does not use stored conversations or the Files API for these requests. OpenAI lists no abuse-monitoring or application-state content retention for its audio transcription endpoint. These endpoint controls do not promise zero retention of account, billing or security metadata. Processing may take place outside the EEA; no EEA-only or approved Zero Data Retention arrangement is claimed. See https://developers.openai.com/api/docs/guides/your-data for the applicable endpoint rules.
Google states that paid Gemini inputs and responses are not used to improve its products. Its abuse-monitoring policy specifies 55 days for prompts, context (including submitted audio and images) and output (including transcripts). Processing may occur outside the EEA. Provider account, billing and security records are separate. No EEA-only processing or zero-retention arrangement is claimed. See https://ai.google.dev/gemini-api/docs/usage-policies and https://ai.google.dev/gemini-api/terms; the applicable provider agreements remain authoritative.
A selected PDF page or image is prepared locally. Only the prepared image and relevant plan context are sent when the user authorizes AI analysis. Preparing the source image makes no AI request. Larger analysis images may use temporary Gemini file storage; the backend attempts deletion after the analysis attempt. Saved AI results remain accessible for 30 days, followed by automatic deletion that may finish later. Operation identifiers, status, cost and billing evidence have a separate retention schedule below. Account deletion starts guarded, retryable removal of SeatHarmony-held AI state. Reviewed proposals and transcripts saved into a plan remain plan content. SeatHarmony processes raw audio in memory and creates no reusable audio archive.
The purposes are to provide the AI feature the user requested, validate and retrieve its saved result, meter AI credits, prevent duplicate charging and abuse, and diagnose failures without putting prompts, names, raw media or provider output into user-visible diagnostics. For SeatHarmony's own account processing, Article 6(1)(b) GDPR applies where needed to deliver the requested feature; professional guest content follows the customer's instructions and lawful basis. Article 6(1)(f) applies to service integrity, abuse prevention, reliable accounting and fault diagnosis. The acknowledgement makes the data flow clear but is not described as consent to a privacy notice.
AI results can be incomplete or wrong. SeatHarmony presents them as proposals and does not apply them until the user reviews and confirms them. Users should check capacity, accessibility, safety, venue requirements and guest preferences and must not use the feature for unlawful, harmful, medical or other prohibited purposes.
A user can report an AI result without leaving the app. The authenticated and App Check-protected report stores the internal Firebase user ID, an opaque receipt-bound reference to that user's AI result, the selected fixed reason and a bounded optional note. The report does not attach the prompt, generated result, plan, guest list, image or audio; users are asked not to repeat names or other private plan information in the optional note. The reason, note and reference are not forwarded to Gemini or another AI model provider. SeatHarmony stores the report in the user's server-only account area for human safety and quality review, duplicate prevention and abuse control. Only authorised SeatHarmony operators can access reports for this review; a server alert containing no reported content sends each new report for review by SeatHarmony. The legal basis is Article 6(1)(f) GDPR: the legitimate interests in reviewing reported AI behaviour, improving service safety and quality, and preventing reporting abuse.
4. App-store purchases and entitlements
You cannot buy SeatHarmony subscriptions or AI-credit packs on this website. Purchases are processed through Apple App Store or Google Play. The Android or iPhone app activates Planner Plus after the store purchase is confirmed. Sign in or create a free account before buying or restoring a purchase. Creating an account does not require payment. The store checkout and receipt identify the seller or contracting party, final price, currency, taxes, billing period, payment method and applicable store terms. SeatHarmony does not receive complete payment-card details.
The app associates the purchase with its Firebase user ID, which is also used as the RevenueCat App User ID. Apple or Google and RevenueCat can provide SeatHarmony with the product, transaction, subscription, renewal, cancellation, refund and entitlement information needed to deliver and reconcile Planner Plus and AI credits, prevent granting the same purchase twice, handle support and defend legal claims. The legal bases are Article 6(1)(b), 6(1)(c) and 6(1)(f) GDPR as applicable to performance, statutory duties, reliable fulfilment and abuse prevention.
RevenueCat receives and reconciles Apple App Store and Google Play purchase events; it is not a separate SeatHarmony website checkout. RevenueCat states that it stores customer data with Amazon Web Services in the United States. The applicable RevenueCat agreement and Data Processing Addendum govern processing for SeatHarmony. Current information is available at https://www.revenuecat.com/privacy and https://www.revenuecat.com/dpa. Apple and Google independently process their store billing under their own terms and privacy notices.
Subscription management, cancellation, withdrawal and refund requests must use the route offered by the store named on the receipt. SeatHarmony can provide product, account and purchase-support messages, but deleting a SeatHarmony account or removing the app does not cancel an app-store subscription.
5. First-party campaign measurement; no cookies or advertising pixels
A known SeatHarmony campaign link can contain the standard campaign dimensions source, medium and campaign, plus the optional campaign ID, content and term. Source, medium and campaign must match the active campaign configured by SeatHarmony when they are supplied; the bounded optional values distinguish an advertisement, creative or keyword and are treated only as untrusted reporting dimensions. It creates a random, short-lived campaign identifier and passes only that random identifier to the SeatHarmony app. The campaign-touch record contains the SeatHarmony campaign ID, the effective normalized campaign dimensions, creation and expiry times and the fact that the marketing redirect created it. It does not contain the incoming URL, raw referrer, IP address, browser or device information, email, voucher text or another open-ended parameter.
Only after an optional campaign-measurement choice does the app bind an eligible campaign identifier to its anonymous or registered account. This may record first touch, last eligible touch within 30 days and verified subscription or voucher-assisted conversion. The purpose is to measure SeatHarmony campaigns and reconcile partner reporting. The legal basis for optional account-linked measurement is consent under Article 6(1)(a) GDPR; consent also covers optional device storage/access where section 25 TDDDG requires it. The app remembers the choice for 180 days. It can be declined or withdrawn in Legal and privacy settings without affecting purchases, AI credits, vouchers or cloud access. Withdrawal removes the matching account mapping and detailed conversion data; aggregate counters and a minimal withdrawal safeguard remain. No advertising-network audience or cross-service profile is created.
The marketing website sets no cookies and does not use Web Storage for campaign measurement, audience analytics, advertising, profiles, accounts or marketing preferences. It includes no advertising pixels or third-party analytics. Its rendering framework may use temporary sessionStorage strictly for page navigation and error recovery. Browsers and Firebase may also cache first-party files that are necessary to load the pages efficiently. This statement concerns the public information website: the separately hosted web app uses browser-local storage when a user creates a local plan. Firebase's operational request processing and usage analysis remain disclosed in section 2. The website offers no checkout. Apple App Store and Google Play purchases occur outside this website under the store's own notices.
The product screenshots are served from the same website, contain only fictional demonstration data and do not contact an external image or media provider when viewed.
6. Recipients and international processing
Google Cloud EMEA Limited, where it is the contracting entity, Google group companies and authorised Firebase subprocessors may receive connection and account data, information used to check the app, synchronized plans and plan images, AI requests and technical usage data as necessary to host, maintain, support and secure the service. Google also receives the limited content described in the AI section above for paid Gemini processing. Processing in the United States and other countries is governed by the applicable agreement and transfer safeguards described in section 2.
Email data is available to the mailbox provider and authorised mailbox recipient identified in section 3.
OpenAI or Google Gemini receives the request content described above for the AI Assistant and speech transcription. Apple or Google and RevenueCat receive the account, access and purchase information needed to process an app-store purchase and manage its subscription.
Ordinary browsing of the public information website does not send visitor content to SeatHarmony's app backend, AI providers, payment providers or advertising networks. A deliberate campaign-link visit creates the limited first-party campaign record described in section 5 and passes its random identifier to the SeatHarmony app; it is not sent to an advertising network. The informational cancellation and withdrawal pages submit no form and send no declaration to SeatHarmony. App-store purchase and subscription data flows through the originating store, RevenueCat and the SeatHarmony backend as described in section 4; the native app completes Planner Plus activation after purchase confirmation. Free account creation in the mobile app is independent of a purchase. SeatHarmony does not send this data to advertising networks.
7. Retention
Firebase states that Hosting retains incoming-request IP data for a few months. In both SeatHarmony app projects, function request and application logs in the _Default Cloud Logging bucket are retained for 30 days. Google's locked _Required bucket retains administration and system audit logs for 400 days. These periods were verified against both live project configurations on 6 September 2026 and must be rechecked if those configurations change.
Email correspondence is retained according to the necessity-based criteria described in section 3.
Device-local plan data remains until the user deletes it, clears the app or browser site data, or removes the app or browser profile. Browser-local storage is available only where the browser supports it and can also be removed through storage eviction; a private or incognito session normally removes its local plan when that session ends. A browser-local plan is not a cloud backup until eligible account adoption and synchronization succeed. Synchronized current plans remain while the verified account uses synchronization. Replaced backup generations are normally retained for 30 days; temporary sync markers expire after 15 minutes, and records that prevent the same request being processed twice expire after 30 days. Account deletion removes active cloud plan records and their files through a guarded, retryable cleanup.
Saved AI results can be replayed for 30 days. Expired results are no longer accessible, although automatic deletion of expired data may finish later. Ordinary operation identifiers, status and cost/provenance metadata remain while the account exists for deduplication, recovery and accounting; cancellation intents recorded before credit reservation expire after 30 days. Account closure starts removal of operation and result state through retryable cleanup, not immediate erasure of every copy. AI content saved into plans follows plan retention. Provider records, backups and economic evidence remain subject to their separate rules.
AI-result reports, including any optional explanation the user deliberately supplies, expire after at most 90 days and are deleted earlier when the account is closed. The server-only reporting control record expires within at most about 72 hours, no later than 48 hours after the applicable fixed reporting windows close. The linked recoverable AI result keeps its separate 30-day maximum described above; reporting does not create another copy or extend that result's retention.
After account closure, the backend may retain pseudonymous economic evidence needed for later store refunds or chargebacks, preventing the same purchase from being granted twice, accounting, fraud claims, or legal claims: purchase and payment-event records, non-developer credit-ledger entries, voucher-redemption records, and records linking purchased credits to the account. These records contain no profile, email, plan, prompt, media, or AI result content and cannot make the deleted account usable again. RevenueCat and the originating app store determine retention for data they independently control under their own privacy notices and legal duties; deleting a SeatHarmony account does not itself delete provider records or cancel a subscription.
SeatHarmony permanently keeps a protected identifier derived only from the deleted account’s former internal ID using a one-way hash. This pseudonymous identifier has no expiry. Its only purpose is to prevent an old signed-in session, a retried deletion task or a delayed store or payment-provider message from recreating, reactivating or replaying the closed account. It contains no email, profile, plan, prompt, media or AI result and cannot be used to sign in or grant access or credits.
An unclaimed campaign identifier expires after no more than 30 days, and may expire earlier. It can then be deleted automatically. A consented pending reference on a device also expires after 30 days. Account attribution uses a 30-day lookback. Decline does not bind a reference; withdrawal retires the associated detailed conversion record, and account deletion removes account-linked attribution. A minimal revocation safeguard prevents delayed requests from restoring withdrawn measurement. Aggregate campaign totals can remain without account-linked conversion detail.
Historical cloud copies can outlast active-data deletion. Current production configuration provides seven-day Firestore point-in-time recovery and a weekly backup schedule with 56-day retention. Cloud Storage temporarily retains deleted files for seven days through its soft-delete feature. These protected recovery copies are separate from the normally 30-day replaced-plan recovery generations and from local or exported files. They are not a promise of user-accessible recovery after erasure; deletion safeguards must be preserved when restoring a backup.
8. Your rights
Where the GDPR applies, you may have rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent when processing is based on consent. Statutory conditions and exceptions apply. Contact admin@seatharmony.net for data controlled by SeatHarmony. Requests concerning data independently controlled by RevenueCat, Apple or Google can be made through that provider's privacy channel.
Depending on where you live, other privacy laws may provide corresponding rights or an appeal route. In SeatHarmony's own processing, SeatHarmony does not sell personal data, share it for cross-context behavioural advertising or use it for targeted advertising. RevenueCat and the app stores describe their independently controlled processing and choices in their own notices.
You may also lodge a complaint with a supervisory authority. The authority currently identified for the operator is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, https://www.ldi.nrw.de.
9. Status and changes
This notice covers private and professional use, local and synchronized plans, account services, AI, native purchases, the website and optional campaign measurement. For professional guest-plan content, SeatHarmony normally acts on the customer's instructions under the processing terms incorporated into the Terms and Conditions. Its own account, billing, security, support and optional measurement purposes remain separate. The app explains the essential AI data flow again before first AI use. Material changes to purposes, providers or processing will be communicated and the applicable notices updated.