Privacy policy
Privacy policy · Privacyverklaring · Politique de confidentialité
Last updated: 31 October 2026
1. Controller · Verwerkingsverantwoordelijke · Responsable du traitement
LineForge (eenmanszaak (sole trader)), Steven Whitacre, Willem de Zwiggerlaan 207-3, 1056 JP Amsterdam, Netherlands, KvK 42117921. Contact for all privacy questions: info@project-timeline.com. This policy covers this website, Project Timeline and Step to SVG.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: email, name, password hash or Google sign-in identifier, app data you create (Project Timeline) | Providing your account and the app | Contract, art. 6(1)(b) | Until you delete your account; backups up to 30 days after |
| Google sign-in: name, email, profile picture from your Google account (only if you choose “Sign in with Google”) | Logging you in | Contract, art. 6(1)(b) | As account data |
| Payment and billing data: name, email, country, subscription status, invoices (card details are handled only by Stripe) | Processing payments, invoices, VAT | Contract, art. 6(1)(b); legal obligation, art. 6(1)(c) | 7 years (Dutch tax retention duty) |
| Emails you send us | Answering your questions | Legitimate interest, art. 6(1)(f) | Up to 2 years after the matter is closed |
| Technical server logs (IP address, browser, time) by our hosting provider | Security and operating the site | Legitimate interest, art. 6(1)(f) | Short-term, per the hosting provider’s policy |
Step to SVG: your STEP files are processed locally in your browser and never leave your computer. We do not receive or store them.
We do not sell your data, and we do not use it for automated decision-making or profiling.
3. Processors and recipients · Destinataires
- Supabase – authentication and database, hosted in the EU (AWS eu-central-1, Frankfurt, Germany).
- Stripe – payment processing (Stripe Payments Europe Ltd., Ireland). Stripe also acts as an independent controller for fraud prevention and legal obligations.
- Netlify, Inc. (USA) – website hosting.
- Google – only when you use “Sign in with Google”.
Some of these providers may process data outside the EU/EEA (in particular in the USA). Such transfers are protected by the EU–US Data Privacy Framework where the provider is certified and/or by the EU Standard Contractual Clauses.
4. Your rights · Uw rechten · Vos droits
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting earlier processing). Email info@project-timeline.com; we respond within one month. You can delete your account in the app or by email.
You may also lodge a complaint with a supervisory authority, in particular:
- the Netherlands: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag
- France: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Residents of France may also give instructions about what happens to their data after their death (Loi Informatique et Libertés, art. 85).
5. Cookies and local storage
This website does not use tracking cookies. It only stores your cookie choice in your browser’s local storage. Our apps use strictly necessary storage to keep you logged in. Details: Cookie policy. You can change your choice at any time via Cookie settings.
6. Security
We use encrypted connections (HTTPS), access controls and reputable providers to protect your data.
7. Changes
We may update this policy; the date at the top shows the latest version. We will inform account holders of significant changes by email.