Privacy Policy

GoalBranch (“GoalBranch”, “we”, “us”) is the goal-planning service at goalbranch.com, based in Greece. As a service established in the EU, we comply with the General Data Protection Regulation (GDPR) for all users, regardless of where you are located, and with applicable US state privacy laws (including the CCPA) for our California users.

For any privacy question, contact privacy@goalbranch.com.

Account information: When you create an account, we collect your name, email address, and authentication credentials (or your Google account identifier if you sign in with Google).

Goal data: The goals, plans, notes, and progress data you create within GoalBranch are stored to provide the service.

Billing information: If you subscribe to a paid plan, our payment processor (Lemon Squeezy) collects your payment card details directly. We never receive or store your full card number.

Usage data: We collect basic technical and usage data (e.g. pages visited, features used, error logs, approximate location from IP address) to operate, secure, and improve the product.

What we don't collect: We do not collect your full payment card number, do not buy or sell data from third-party data brokers, and do not run third-party advertising or cross-site tracking pixels on our site.

We use your information to:

• Provide and maintain the GoalBranch service
• Generate AI-powered goal breakdowns based on your input
• Process subscription payments and manage your plan
• Send essential service and billing communications
• Detect, prevent, and address fraud, abuse, and security issues
• Improve and optimize the product experience

We do not sell your personal information, and we do not use your account or goal data to train third-party AI models.

When you use AI features, the relevant goal text and contextual information are sent to OpenAI (GPT-4o and related models) for processing. This data is used solely to generate your response and is not used by OpenAI to train its models when sent via GoalBranch's API integration. AI-generated output is probabilistic and may occasionally be inaccurate; see our Terms of Service for details. Refer to OpenAI's privacy policy for more on their data handling practices.

We use a small number of essential cookies for authentication and session management, and a preference cookie to remember your display theme. We do not use third-party advertising or analytics tracking cookies. See our Cookie Policy for the full list of cookies and how to manage them.

We share limited data with the following processors, solely to operate the service:

• OpenAI: processes goal text to generate AI breakdowns
• Lemon Squeezy: our merchant of record; processes payments and handles billing, tax, and invoicing
• Resend: sends transactional emails (magic links, receipts, account notices)
• Google: provides optional sign-in via Google OAuth
• Cloud infrastructure providers: host our application and PostgreSQL database

Each provider is contractually restricted to using your data only to provide services to us and is bound by its own privacy policy.

We retain your account and goal data for as long as your account is active. When you delete your account, your personal data and goal data are permanently deleted within 30 days, except where we must retain billing records longer to comply with tax and accounting law (typically up to 7 years). Security and error logs are retained for a maximum of 90 days.

Depending on your location, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable, machine-readable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact privacy@goalbranch.com. We respond to verified requests within 30 days. See §13 for jurisdiction-specific supplements.

GoalBranch is operated from Greece (EU), but some of our service providers (including OpenAI and Resend) are based in or process data in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

GoalBranch is not directed to, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Your data is stored in PostgreSQL databases hosted on reputable cloud infrastructure providers. We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this privacy policy from time to time. We will notify you of material changes by email or through the service before they take effect.

EEA / UK: Our legal bases for processing are contract performance (providing the service), legitimate interests (security, product improvement), and consent (marketing, where applicable). You have the right to lodge a complaint with your local data protection authority; in Greece, the Hellenic Data Protection Authority.

California: Under the CCPA/CPRA, California residents have the right to know what personal information we collect, request deletion, and opt out of the sale or sharing of personal information. GoalBranch does not sell or share personal information as defined by the CCPA.

For privacy-related questions or requests, contact us at privacy@goalbranch.com.