Privacy Policy

Last updated: April 8, 2026

realgoals ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights under applicable data protection laws, including the EU General Data Protection Regulation (GDPR / BDAR) and the California Consumer Privacy Act (CCPA).

1. Data Controller

The data controller is Voras Digital, MB, a limited partnership (maža bendrija) registered in the Republic of Lithuania (company code: 307551703), represented by Lukas Baranovas. For any privacy-related inquiries, contact us at [email protected].

2. What Data We Collect & Legal Basis

Under GDPR Article 6, we process personal data only when we have a lawful basis. Below we describe each category of data, its purpose, and the legal basis for processing:

• Email address - provided when you join our waitlist or create an account. Legal basis: consent (Art. 6(1)(a)) for the waitlist; contract performance (Art. 6(1)(b)) when you create an account. Waitlist emails are submitted via Google Apps Script (a Google LLC service acting as our data processor) and stored in Google Sheets.
• Calendar data - synced from Google Calendar or other calendar providers when you connect your account. Legal basis: contract performance (Art. 6(1)(b)) - necessary to provide the planning service you signed up for.
• Usage data - goals, progress, and interactions within the app. Legal basis: contract performance (Art. 6(1)(b)) for delivering the service; legitimate interest (Art. 6(1)(f)) for product improvement.
• Analytics cookies - via Google Analytics, only with your explicit prior consent. Legal basis: consent (Art. 6(1)(a)). See Section 9.
• IP address - when you visit our website, your IP address is transmitted to Google LLC via Google Fonts and (if you consent) Google Analytics. Legal basis: legitimate interest (Art. 6(1)(f)) for Google Fonts (necessary for consistent website rendering); consent (Art. 6(1)(a)) for Google Analytics.

3. How We Use Your Data

• To provide and improve the realgoals service - building your adaptive roadmap, scheduling, and replanning.
• To communicate with you about your account, updates, and support.
• To analyze aggregated, anonymized usage patterns to improve the product.

4. Calendar Data & AI Processing

Your calendar data is handled with strict privacy safeguards:

• Calendar data is encrypted in transit.
• Calendar sync is performed dynamically on demand - we do not store a persistent copy of your full calendar.
• Our AI backend only sees anonymized calendar entries. All personally identifiable information - participant names, email addresses, and other personal details - is stripped from events before AI processing.
• AI processing is provided by Google Gemini (Google LLC, acting as a data processor). Anonymized event data is sent to Google Gemini solely for the purpose of generating your adaptive plans. No other third-party AI services receive your data.

5. Automated Decision-Making

realgoals uses AI (Google Gemini) to generate personalized plans and schedules based on your goals and calendar availability. This constitutes automated processing but does not produce legal or similarly significant effects - it generates suggestions that you can review, modify, or ignore. You have the right to request human review of any AI-generated recommendation by contacting us at [email protected].

6. Data Sharing & Sub-processors

We do not sell, rent, or otherwise transfer your personal data or derived data to third parties for their own purposes. We share data only with the following sub-processors, solely to operate the service:

• Google LLC (United States) - provides Google Gemini (AI processing of anonymized calendar data), Google Analytics (website analytics, with consent only), Google Apps Script & Google Sheets (waitlist email storage), and Google Fonts (website rendering). Google acts as a data processor under our instructions.

We do not sell your personal information as defined by the CCPA. We have not sold personal information in the preceding 12 months.

7. International Data Transfers

Your personal data is stored on servers in the European Union. However, some data is processed by Google LLC, which is headquartered in the United States. These transfers are protected by the following safeguards:

• Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), which the European Commission has recognized as providing an adequate level of data protection (adequacy decision of 10 July 2023).
• Where applicable, transfers are additionally covered by Standard Contractual Clauses (SCCs) approved by the European Commission.

We only transfer data to third countries where adequate safeguards are in place, as required by GDPR Chapter V (Articles 44–49).

8. Data Storage & Security

• All primary data is stored on servers located in the European Union, in compliance with GDPR requirements.
• Data is encrypted in transit (TLS).
• We apply the principle of data minimization - we only collect and retain what is necessary to provide the service.

9. Cookies & Tracking Technologies

We use the following cookies and similar technologies:

• Analytics cookies (Google Analytics: _ga, _gid) - help us understand how visitors use our website. They are only set after you explicitly consent via the cookie banner. You can withdraw consent at any time using the cookie settings on our website.
• Google Fonts - when you visit our website, your browser connects to Google's servers to load fonts. This transmits your IP address to Google LLC. No cookies are set by Google Fonts, but the connection constitutes a data transfer.

We do not use advertising, marketing, or social media tracking cookies.

10. Your Rights Under GDPR (EEA Users)

If you are in the European Economic Area, under the GDPR you have the right to:

• Access (Art. 15) - request a copy of the personal data we hold about you.
• Rectification (Art. 16) - request correction of inaccurate or incomplete data.
• Erasure (Art. 17) - request deletion of your personal data ("right to be forgotten").
• Restriction (Art. 18) - request that we limit processing of your data.
• Portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21) - object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Withdraw consent (Art. 7(3)) - at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint - you have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email us at [email protected]. We will respond without undue delay and in any event within one month, as required by GDPR Article 12(3).

11. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know - you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete - you may request deletion of your personal information.
• Right to correct - you may request correction of inaccurate personal information.
• Right to opt out of sale/sharing - we do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to non-discrimination - we will not discriminate against you for exercising any of these rights.

To exercise your CCPA rights, email us at [email protected]. We will verify your identity before fulfilling your request and respond within 45 days.

12. Children's Privacy

realgoals is not directed at children. We do not knowingly collect personal data from anyone under the age of 16 (or under 13 in the United States). If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will promptly delete it.

13. Data Retention

We retain your personal data only as long as necessary to provide the service or as required by law:

• Waitlist emails - retained until we contact you or you request removal.
• Account data - retained for the duration of your account. If you delete your account, we will erase your personal data within 30 days.
• Analytics data - Google Analytics data is retained according to Google's data retention settings (currently set to 14 months).

14. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you by email if you have an account with us.

15. Contact

If you have questions or concerns about this privacy policy or our data practices, contact us at:
[email protected]