How We Protect Your Data

Last updated: August 29, 2026

1. Introduction

GanttPad is operated by Andrii Sassa, Individual Entrepreneur (registration number: 3573110073), registered in Ukraine with the registered address at Pavla Tychyny Ave. 28, 109, Kyiv, 02152, Ukraine ("we", "our", "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and website (collectively, the "Service").

2. Data Controller

Andrii Sassa, Individual Entrepreneur, is the data controller responsible for the personal data we collect about users of the Service. For users in the European Economic Area and the United Kingdom, we process personal data in accordance with the EU General Data Protection Regulation (GDPR). If you have concerns about how we process your data, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

3. Information We Collect

We collect information you provide directly to us:

  • Account information: When you create an account, we collect your name, email address, and password.
  • Project data: Tasks, timelines, and other content you create within the Service.
  • Payment information: If you subscribe to a paid plan, payments are processed by Paddle, our merchant of record. Paddle collects and processes your payment details as an independent data controller — we do not see or store your credit card details on our servers. Please refer to Paddle's Privacy Policy for details on how Paddle handles your payment data.
  • Usage data: We automatically collect information about how you interact with the Service, including pages visited, features used, and time spent.

4. How We Use Your Information

  • To provide, maintain, and improve the Service
  • To process transactions and send related information
  • To send you technical notices, updates, and support messages
  • To respond to your comments, questions, and support requests
  • To monitor and analyze trends, usage, and activities to improve user experience
  • To detect, investigate, and prevent fraudulent transactions and other illegal activities

5. Data Sharing

We do not sell your personal information. We share information with two categories of recipients: Paddle, our merchant of record, which processes data relating to the sale of paid plans — subscription management, payments, tax compliance, and invoicing — as an independent data controller; and third-party service providers who assist us in operating the Service (e.g., hosting and analytics), who are contractually obligated to protect your data and process it only on our behalf. We may also disclose information to professional advisers or to authorities where required by law.

Some of these providers are located outside your country of residence, including outside the European Economic Area. Where required, such transfers are protected by appropriate safeguards, such as standard contractual clauses.

6. Google Workspace Integration

GanttPad integrates with Google Drive to allow users to export project data. When you connect your Google account:

  • What we access: We use the drive.file scope, which only allows GanttPad to create and manage files that GanttPad itself created in your Google Drive. We cannot see, read, or modify any other files in your Drive.
  • What we store: We store an encrypted OAuth refresh token to maintain your Google Drive connection, and your Google email address to display your connected account. We do not store your Google password.
  • What we create: When you use "Export to Google Drive," we create an Excel (.xlsx) file containing your project data (tasks, schedules, team, costs) in your Google Drive.
  • Data sharing: We do not share your Google data with third parties.
  • Revoking access: You can disconnect your Google account at any time from GanttPad Settings. You can also revoke access at myaccount.google.com/permissions.

GanttPad's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption in transit (TLS) and at rest.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law.

9. Your Rights

Under the GDPR (if you are in the EEA or UK) and other applicable data protection laws, including the Law of Ukraine "On Personal Data Protection", you have the following rights:

  • Access, correct, or delete your personal data
  • Export your data in a portable format
  • Object to or restrict certain processing
  • Withdraw consent at any time
  • Lodge a complaint with your local data protection supervisory authority

To exercise these rights, contact us at [email protected]. We respond within one month.

10. Cookies

We use essential cookies to keep you signed in and remember your preferences. We use analytics cookies via Google Analytics to understand how the Service is used; you can opt out using your browser settings or Google's opt-out browser add-on. We do not use advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].

Andrii Sassa, Individual Entrepreneur
Pavla Tychyny Ave. 28, 109, Kyiv, 02152, Ukraine
Registration number: 3573110073