Privacy Policy

Last updated: 16 August 2026

1. Who we are

Shimshon & Co OÜ (registry code 14350442), a private limited company established in Estonia, operates Scenario Planner (the “Service”) at scenarioplanner.ai. For the personal data described here, Shimshon & Co OÜ is the data controller. You can reach us about privacy at hello@scenarioplanning.app.

2. What we collect

  • Account data — your email address and the identifier from your sign-in provider (Google or email/password), created through Firebase Authentication.
  • Content you provide — the documents you upload, text you paste, and the analysis you build (organisation, horizon, scenarios, notes). This is stored against your account so your work syncs across devices.
  • Payment data — when you buy analyses or a course pool, payment is processed by Stripe. We receive confirmation and a receipt record; we never see or store your full card details.
  • Technical data — server logs and limited request metadata (including IP address) used to keep the Service secure, enforce usage limits, and diagnose faults.
  • Local storage — your browser stores a working copy of your project and your sign-in session so the app works smoothly; this stays on your device.

3. Why we use it, and our legal basis

  • To provide the Service — creating your account, storing your work, running analyses, and processing payments. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
  • To keep the Service secure and working — abuse prevention, rate limiting, fraud prevention, and troubleshooting. Legal basis: our legitimate interests (Art. 6(1)(f)).
  • To meet legal obligations — e.g. tax and accounting records for payments. Legal basis: legal obligation (Art. 6(1)(c)).

4. AI processing of your content

To generate an analysis, the documents and text you provide are sent to Google’s Gemini API, which acts as our processor and returns the generated output to you. Your content is used to produce your analysis; it is not sold, and we do not use it to train our own models. Google’s handling is governed by its API terms. Do not upload information you are not permitted to share, or that you would not want processed by a third-party AI service.

5. Who we share it with (processors)

  • Google (Firebase Authentication, Cloud Firestore, Gemini API, Google Cloud Run hosting) — authentication, data storage, AI processing, and hosting.
  • Stripe — payment processing.

We do not sell your personal data, and we do not use it for advertising.

6. International transfers

Some of our processors (including Google and Stripe) may process data outside the European Economic Area. Where they do, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

We keep your account and content for as long as your account is active. If you ask us to delete your account, we delete your content, retaining only what we must for legal or accounting reasons (for example, payment records) for the period the law requires.

8. Your rights

Under the GDPR you have the right to access, correct, delete, or restrict processing of your personal data, to data portability, and to object to processing based on our legitimate interests. Where we rely on consent, you may withdraw it at any time. To exercise any of these, email hello@scenarioplanning.app.

You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your country of residence within the EU.

9. Security

We protect data in transit with encryption (HTTPS), restrict access to your data to your own account through server-enforced access rules, and keep billing and capacity records on the server where clients cannot reach them directly. No system is perfectly secure, but we take reasonable measures appropriate to the risk.

10. Cookies and local storage

We use your browser’s local storage and the cookies/tokens set by Firebase Authentication to keep you signed in and to save your work. These are necessary for the Service to function. We do not use advertising or cross-site tracking cookies.

11. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data.

12. Changes

We may update this policy; we will change the “last updated” date above and, for material changes, take reasonable steps to notify you.

13. Contact

Questions about this policy or your data: hello@scenarioplanning.app. See also our .