Privacy Policy
What we collect, why we collect it, who else touches it, how long we keep it, and what you can make us do about it.
Last updated 2026-10-02
Two different relationships
This policy covers two things that are easy to confuse, and the law treats them differently.
Our own website and account holders. When you visit https://resourceplan.nmpv.cloud, sign up, or pay us, we decide why and how your data is used. We are the controller, and this policy is the full account of it.
The data inside a customer’s organisation. When your employer uses ResourcePlan to plan projects, the people, rates and allocations in it belong to your employer. They decide what goes in and why; we only process it on their instructions. They are the controller, we are the processor, and the terms are in the Data Processing Agreement. If you are an employee asking about your own record, your employer is who to ask — we cannot lawfully change or delete it on your say-so, and we will pass the request to them.
Controller
NMPV UG (haftungsbeschränkt)Katharinenstraße 15, 71634 Ludwigsburg, Germany
almarmollenhorst@gmail.com
We have not appointed a Data Protection Officer. Under § 38 BDSG one is required once twenty or more people are permanently engaged in automated processing, which we are below. Privacy requests reach Almar Mollenhorst at the address above.
What we process, and why
| Data | Why | Lawful basis |
|---|---|---|
| Account: name, work email, password hash, chosen language, sign-in provider | To give you an account and let you sign in | Art. 6(1)(b) — performance of a contract |
| Organisation: company name, members and their roles | To keep one customer's data separate from another's and decide who may do what | Art. 6(1)(b) |
| Billing: plan, subscription and customer identifiers, invoices | To charge for the service and meet our accounting obligations | Art. 6(1)(b) and 6(1)(c) — legal obligation |
| Security log: sign-ins, permission changes, API key use, support access grants | To detect misuse and to be able to tell a customer what happened | Art. 6(1)(f) — legitimate interest in a secure service |
| Support correspondence | To answer you | Art. 6(1)(b) and 6(1)(f) |
| Planning data inside an organisation: people, rates, allocations, absences, recorded time | Processed only on the customer's instructions — see the DPA | The customer's basis, not ours |
What we do not do
We do not sell personal data. We do not use it for advertising, we do not build profiles across customers, and we do not use a customer’s planning data to train any model — ours or anyone else’s.
ResourcePlan sets no advertising or tracking cookies. The only cookies we set are the ones that keep you signed in and remember which organisation you were last looking at. Those are strictly necessary, which is why you are not asked to consent to them: there is nothing to decline.
Who else touches it
These are our processors. Each is bound by a data processing agreement, and none may use your data for its own purposes.
| Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and file storage — the system of record | Dublin, Ireland (AWS eu-west-1) |
| Vercel Inc. | Application hosting and delivery | Frankfurt, Germany (fra1) |
| Anthropic PBCoptional | The portfolio advisor and plan-realism check. The snapshot sent contains project and person names. Nothing is sent unless someone runs one of those features, and the model is given no ability to act on your data. | United States |
| Resend Inc.optional | Transactional email — invitations, digests, alerts. Replaceable with your own SMTP server, in which case no mail reaches this processor. | United States |
| Stripe Payments Europe, Ltd.optional | Subscription billing. Card details are entered on Stripe's own pages and never reach our servers. | Ireland / United States |
Where a processor is outside the EU, the transfer rests on the European Commission’s Standard Contractual Clauses together with the supplementary measures in that processor’s own terms.
How long we keep it
Account and organisation data lives as long as the account does. When an organisation closes its account we delete its data within 30 days, except where we must keep something longer — invoices, for instance, are kept for the ten years German commercial and tax law requires (§ 147 AO, § 257 HGB).
Notifications and the email delivery log are pruned automatically after twelve months by a scheduled job. Security audit records are kept for the life of the account, because their point is to answer a question asked long afterwards.
Your rights
Under the GDPR you may ask us for a copy of your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), a portable copy (Art. 20), and you may object to processing we base on legitimate interest (Art. 21). Write to almarmollenhorst@gmail.com and we will answer within one month.
You may also complain to a supervisory authority. For us that is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, since we are established in Ludwigsburg; you may equally complain to the authority where you live or work.
Security
Each organisation’s data is separated in the database itself by row-level security, so isolation does not depend on the application getting every check right, and a test suite proves it on every change. Traffic is encrypted in transit. Cost data is visible only to admins and executives. Nobody here has standing access to customer data; support access is time-bounded, needs a stated reason, and the grant is itself the audit record. The security page describes this in more detail.
Changes
If we change this policy in a way that matters, we will tell account holders by email before it takes effect rather than quietly reposting it.