Last updated: October 20, 2026

Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how Tremble Oy (Finnish business id: 3235618-3) ("we", "us", or "our"), collects, uses, and protects your personal data when you use our website seatingchartmaker.app (the "Website") and seating chart creation service (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner. We act as the data controller for personal data collected directly from you, and as a data processor for any third-party personal data you input into the Service.

2. Age Restrictions

The Service is not intended for users under the age of 16. By using the Service, you confirm that you are at least 16 years old. If we discover or have reason to suspect that a user is under 16, we will terminate their account and delete their data.

3. Personal Data We Collect

3.1 Data You Provide Directly

  • Email address for account creation and transactional communication
  • If you log in via a third party (e.g., Google login), we might receive your name and link to a profile picture from the third party. The standard functionality of the authentication service we use is to save these data if provided.
  • Payment transactions are handled by Paddle.com Market Limited, who acts as the Merchant of Record for all purchases. Paddle collects and processes payment data directly. For information about how Paddle processes your payment data, please refer to Paddle's Privacy Policy.
  • Email address and other data you provide through the contact form (processed via Formspree for communication purposes). Form submissions are also forwarded to our email system.

3.2 Technical Data

The information systems and software procedures used to operate this Website and Service acquire personal data as part of their standard functioning. The transmission of such data is an inherent feature of Internet communication protocols. This data includes:

  • IP addresses
  • Browser type and version
  • Operating system
  • Date and time of access
  • URLs of referring websites

This data may be saved in log files and used for the proper functioning of the Service.

When you use the app, we also collect error reports and records of how the app is used (such as which features are used). When you are logged in, these are linked to your internal account ID, but not to your name or email address. They never contain the names or photos you enter into rosters and seating charts.

3.3 Your Content

When using our Service, you may input personal data about third parties (such as names) into seating charts. For such data:

  • You are the data controller
  • You are responsible for having the legal basis to process such data
  • You must fulfill all obligations as a data controller under applicable privacy laws
  • You must handle any data subject requests from individuals whose data you have input
  • We act solely as a data processor and process such data according to your instructions and our Terms of Service

4. How We Use Your Personal Data

4.1 Purposes

  • To provide and maintain the Service
  • To process your payments
  • To communicate with you about the Service
  • To ensure the security and proper functioning of the Service
  • To diagnose and fix errors
  • To understand how the Service is used, in order to improve it
  • To prevent misuse, such as repeated free trials

4.2 Legal Basis (GDPR)

We process your personal data based on:

  • Contract performance (providing the Service)
  • Legal obligations (accounting requirements, responding to lawful authorities)
  • Legitimate interests (implementing necessary security measures, maintaining technical functionality, diagnosing errors, understanding how the Service is used to improve it, preventing fraud and misuse)

5. Data Storage and International Transfers

We use Google Firebase for hosting, authentication and database services, Formspree for contact form processing, Sentry for error tracking and PostHog for usage analytics, all located in the United States. Your account data and the content you create (including rosters and seating charts) are stored in Google Cloud data centers in the United States. Your data is protected during international transfers through appropriate safeguards:

  • Legally approved data transfer mechanisms
  • Technical security measures including encryption

6. Third-Party Service Providers (Sub-processors)

We use the following service providers, which act as our sub-processors for the purposes described:

  • Paddle.com Market Limited acts as our Merchant of Record and handles all payment processing. When you make a purchase, you enter into a direct relationship with Paddle for payment processing. Any payment-related data protection requests should be directed to Paddle.
  • Firebase (hosting, server functionality, authentication and database)
  • Formspree (contact form processing)
  • Sentry (error tracking; receives your internal account ID, but not your name, email address, IP address or student data; no cookies)
  • PostHog (usage analytics; stores one identifier in your browser once you open the app; linked to your internal account ID when you are logged in, but not to your name, email address or student data; you can opt out; see section 8)

7. Links to third party websites

Our Website contains links to other websites that are not operated by us and whose privacy practices may differ. The relevant third-parties' privacy policies will govern any submission of your personal data to third-party websites.

8. Cookies and Similar Technologies

We use essential cookies and similar technologies necessary for the functioning of the Service, to:

  • Maintain your session
  • Remember your authentication status
  • Ensure the security of your account
  • Remember your application settings

Your consent is not required for these, which is why we don't have a cookie popup or a banner for them.

We also use one non-essential identifier to understand how the app is used. It is created the first time you open the app. It is anonymous until you log in; after that, it is linked to your internal account ID, but never to your name or email address. It is never linked to advertising networks and never sold. You can opt out at any time, here:

9. Data Retention

We retain your personal data for as long as necessary to provide the Service. Specifically:

  • Account data is retained while your account is active. An account is inactive when it has not been used: no log-ins and no use of the Service while logged in.
    • Accounts that have never had a subscription are deleted, together with their data, after 24 months of inactivity
    • Accounts whose subscription has ended are deleted, together with their data, after 24 months of inactivity, but not until at least 12 months have passed since the subscription ended
    • Accounts with an ongoing subscription are never deleted for inactivity
  • Account deletion deletes your account content: rosters, rooms, seating charts and uploaded photos. The following are kept after account deletion, for the periods below, so that we can fix errors, understand how the Service is used and prevent misuse:
    • Server logs: 30 days
    • Error reports (Sentry): 30 days
    • Usage analytics (PostHog): 1 year
    • Usage and misuse-prevention records in our database, linked only to an internal account ID: kept indefinitely
    • A one-way hash of your email address, to prevent repeated free trials: kept indefinitely
  • Logs, error reports and usage analytics never include the names or photos you enter into rosters and seating charts.
  • Contact form submissions:
    • Stored by Formspree for 30 days
    • Submissions forwarded to our email system are retained until you request their deletion

10. Your Rights Under GDPR

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of your data
  • Restrict or object to processing
  • Data portability
  • Withdraw consent, if the personal data processing is based on consent

To exercise these rights, contact us.

11. Security

We implement appropriate technical and organizational measures to protect your data, including:

  • HTTPS encryption for all data in transit
  • Encryption of data at rest
  • Regular security assessments
  • Access controls and authentication

12. FERPA and COPPA Compliance

We recognize that some users of the Service are educators or institutions subject to U.S. laws governing student data privacy. We are committed to supporting compliance with the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA).

12.1 FERPA

When educators or schools use the Service and input student names or other personally identifiable information (“PII”) to create seating charts, we act as a data processor (or “school official” under FERPA) on behalf of the educational institution. We use such data solely to provide and maintain the Service and never sell, share, or use it for advertising or other commercial purposes. Student data is never included in logs, error reports or usage analytics. Educational institutions retain ownership and control of all student data and may request deletion of their data at any time by contacting us. For schools and districts that require a formal data privacy agreement, see our For Schools & Districts page.

12.2 COPPA

The Service is designed for use by teachers and schools, not by students directly. We do not knowingly collect personal information from children under 13 years of age. In cases where teachers or schools input student information for classroom management purposes, the school provides any necessary consent on behalf of parents in accordance with COPPA. If we learn that a child under 13 has created an account or provided personal information directly, we will delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Therefore, it is advisable that you check this Privacy Policy regularly.

14. Contact Us

For any questions about this Privacy Policy or our data practices, contact us: Contact form or ppa.rekamtrahcgnitaes@ycavirp.

For EU residents: You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with applicable law.