Privacy Notice

Last updated: 29 July 2026

This Privacy Notice explains how Jennifer Louisa Baufeldt (“we”, “us” or “our”) collects, uses, stores, and shares personal data when you use the PhD Roadmap Builder Service (“Service”).

Who is the data controller?

Jennifer Louisa Baufeldt is the data controller for the personal data collected through this Service. If you have questions about this notice or your rights, please contact us at drjennyingermany@duck.com.

What data we collect

We collect the following categories of personal data:

Account data: email address, authentication provider information, and account identifiers.
Profile data: your country, university, field of study, expected programme duration, study mode, weekly hours, prior experience, and constraints you choose to provide.
Usage data: how you interact with the Service, including roadmap generation requests, feature usage, and approximate device and log information.
Payment data: Paddle, our Merchant of Record, processes payment information such as billing address and payment method. We do not store full payment card details on our own servers.
Communication data: messages you send to support or feedback you provide.

How we use your data and why

We use your data for the following purposes:

To provide the Service — creating your account, generating roadmaps, and saving your history (if your plan includes it). Legal basis: contract performance.
To manage payments and subscriptions — billing, renewals, cancellations, and fraud prevention. Legal basis: contract performance and legitimate interests.
To secure and maintain the Service — authentication, abuse detection, error monitoring, and technical support. Legal basis: legitimate interests and legal obligations.
To improve the Service — aggregated usage analysis and product development. Legal basis: legitimate interests.
To communicate with you — account updates, security alerts, and responses to your inquiries. Legal basis: contract performance and legitimate interests.

Who we share data with

We share personal data only with trusted service providers and where required by law:

Paddle — our Merchant of Record, for sale of the product, subscription management, payment processing, tax compliance, and invoicing.
Hosting and infrastructure providers — to store and process data securely.
Analytics and error-monitoring tools — to understand usage and fix issues.
Professional advisers — legal and accounting professionals, when necessary and under confidentiality obligations.
Authorities — when required by law, court order, or to protect our rights.

International transfers

Some of our service providers are based outside the European Economic Area (EEA) and the United Kingdom. When we transfer data outside these areas, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or adequacy decisions, to protect your data.

How long we keep your data

We keep your personal data only as long as necessary for the purposes described above. Account data is retained while your account is active. After you delete your account or stop using the Service, we delete or anonymise your data within a reasonable period, unless a longer retention period is required by law or for legitimate business purposes such as fraud prevention or legal disputes.

Your rights

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of your personal data.
Rectification — ask us to correct inaccurate data.
Erasure — request deletion of your data.
Restriction — ask us to limit how we use your data.
Portability — receive your data in a structured, commonly used format.
Objection — object to certain uses of your data.
Withdraw consent — where processing is based on consent, you can withdraw it at any time.

If you are in the EEA or UK, you also have the right to complain to your local supervisory authority. We aim to respond to requests within one month.

Cookies and similar technologies

We use essential cookies to keep you signed in and maintain the security of the Service. We may also use analytics cookies to understand how the Service is used. You can manage cookie preferences through your browser settings.

Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and regular security reviews. No online service is completely secure, and we cannot guarantee absolute security.

Children's privacy

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe we have collected such data, please contact us so we can delete it.

Changes to this notice

We may update this Privacy Notice from time to time. We will post the revised version on this page with a new “Last updated” date. Significant changes will be communicated to you through the Service or by email.

Contact

For privacy questions or to exercise your rights, please contact us at drjennyingermany@duck.com.