Privacy Policy

1. Responsible person

The person responsible within the meaning of the General Data Protection Regulation (GDPR) is:

Justin Mkrtcjan

Glückaufstraße 1F, 31157 Sarstedt, Germany

Email:support@jmrkt.com

A data protection officer has not been appointed because the legal requirements for this do not exist.

2. Overview of the processed data

• Account details: Email address, password (stored exclusively as a cryptographic hash, not in plain text), time of registration.
• Budget data: Categories, monthly values and sub-items you entered.
• Technical data: IP address, browser type and version, operating system, referrer URL, request timestamp.
• Communication data: Content and metadata of emails you send me, as well as information from the feedback form.
• Payment details: currently none. Once a paid subscription is offered, Section 3.6 applies.

3. Processing in detail

3.1 Provision of website and app (server log files)

When accessed, technical data is automatically processed to enable delivery and to ensure operational security (defense of attacks, error analysis).

Legal basis: Art. 6 paragraph 1 lit. f GDPR. Legitimate interest: secure and stable operation of the service.

Storage period: 14 days, then automatic deletion or anonymization.

3.2 user account

For registration and login I process email address and password hash.

Legal basis: Art. 6 paragraph 1 lit. b GDPR (fulfillment of the user contract).

3.3 Budget data

The budget data you enter is stored to provide you with the service and to make the data available across devices. This data is not evaluated, not passed on to advertising partners and is not included in analysis or advertising services.

Legal basis: Art. 6 paragraph 1 lit. b GDPR.

3.4 Email sending (password reset and system messages)

I use Cloudflare's email service (Workers EMAIL Binding) to send password reset links and similar system messages. Your email address and the message content are processed as part of order processing at Cloudflare. The domain receives email via Cloudflare Email Routing.

Legal basis: Art. 6 paragraph 1 lit. b GDPR.

There is no open or click tracking in these emails.

3.5 Contact via email

If you write to me, I will process your information to process the request.

Legal basis: Art. 6 Para. 1 lit. b GDPR for contract-related inquiries, otherwise Art. 6 Para. 1 lit. f GDPR (legitimate interest in answering).

Storage period: until final processing, provided there are no legal retention periods to the contrary.

3.6 Paid subscription (currently not offered)

No paid subscription is currently offered, but it is planned. Once you take out a paid subscription, the following applies:

Payment processing is carried out via Stripe Payments Europe, Limited. You enter your payment details (e.g. card details) directly into Stripe; I do not receive complete card data, but only the information necessary for contract processing such as payment status, invoice number and the last digits of the payment method. Stripe processes payment data as an independent controller in accordance with its own data protection regulations.

Legal basis: Art. 6 Para. 1 lit. b GDPR for contract processing, Art. 6 Para. 1 lit. c GDPR for tax and commercial storage.

Storage period: Invoice and booking data are stored for ten years in accordance with § 147 AO and § 257 HGB. This data is excluded from account deletion.

3.7 Affiliate redirects

Redirects to partner offers run on the server via addresses of the form/go/{id}. I record the identifier of the link clicked, the time and, if applicable, the domain of the referring page in a data-efficient manner. No partner pixel is loaded in the browser and no link is created with your user account.

After forwarding, the data protection regulations of the respective partner apply. The partner can set their own cookies there to assign the completion of a commission. I have no influence on this processing.

Legal basis: Art. 6 paragraph 1 lit. f GDPR. Legitimate interest: Billing and measurement of the success of partner links.

Storage period: 12 months.

3.8 Consent Management

We use CookieConsent by Orest Bida as self-hosted software. Your choices, a timestamp, a random consent identifier and the settings version are stored in the “jmrkt_consent” cookie on your device for up to 182 days. No consent data is sent to Orest Bida or CookieYes, and no IP addresses are stored for this consent management.

You can change your choices at any time using “Cookie settings” in the footer. Withdrawing analytics consent removes analytics cookies and stops further analytics events. If Google Analytics has already loaded, the page reloads to stop the script completely.

Cookie settings

Legal basis: Article 6 Paragraph 1 Letter c GDPR (obligation to provide proof in accordance with Article 7 Paragraph 1 GDPR); Storing the consent information on your device is permitted without consent in accordance with Section 25 Paragraph 2 No. 2 TDDG.

3.9 Audience measurement with Google Analytics 4

When analytics is technically enabled, Google Analytics 4 loads only on public pages and only after you consent to the “Analytics” category. No analytics script loads without consent. The personal budget area, settings, sign-in and administration are excluded. No budget values, email addresses or account identifiers are sent to GA4.

Legal basis: Art. 6 paragraph 1 lit. a GDPR and § 25 paragraph 1 TDDG (consent).

Storage duration for GA4: maximum 14 months, configured to 2 months.

3.10 Advertising (disabled)

Advertising is currently disabled on JMRKT. No Google AdSense scripts load, and no advertising consent is collected.

3.11 Feedback form

If you use the feedback form on the public website or in the Budget app, I process your message, an optional email address, the page URL, your browser user agent, your IP address only as a salted hash and the result of the Turnstile check. The information is used to process your feedback, enable queries and prevent abusive automated entries.

The legal basis for processing is Art. 6 paragraph 1 lit. f GDPR (legitimate interest in improving and secure operation of the offer); For contract-related feedback, additional Art. 6 Para. 1 lit. b GDPR. Cloudflare Turnstile is used as a security measure based on Art. 6 Para. 1 lit. f GDPR. The legitimate interest is to protect the form from spam and automated misuse.

The recipient is the operator's feedback mailbox, to which the information is sent via email transport. The feedback data is stored for 24 months and then deleted, unless there are legal retention requirements.

4. Cookies and storage on your device

Technically required (no consent required, § 25 Para. 2 No. 2 TDDG):

• Login Token (JWT) in browser storage — keeps you logged in; deleted when you log out.
• Offline buffer storage of budget data (IndexedDB) — allows use without a continuous connection; remains locally on your device and can be deleted via the browser settings.
• Consent tool’s consent storage — remembers your decision.

Requires consent (§ 25 para. 1 TDDG), currently not active: Cookies and similar storage from Google Analytics 4 and Google AdSense.

Comparison filters on public pages are only displayed in the address bar and are not saved on your device.

5. Recipients and processors

There are contracts for order processing with all processors in accordance with Art. 28 GDPR.

6. Transfer to third countries

Some of the service providers used are based in the USA or process data there. This involves a transfer to a third country.

• For providers certified according to the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision from 10. July 2023 (Art. 45 GDPR).
• For all other US providers, the transfer is based on the European Commission's standard contractual clauses (Art. 46 para. 2 lit. c GDPR), supplemented by additional protective measures such as encryption during transmission and at rest.
• There is an adequacy decision from the European Commission for the United Kingdom.

Despite these measures, it cannot be ruled out that US authorities will access data based on local laws and that you will not have legal protection against such access comparable to EU law.

A copy of the Standard Contractual Clauses can be requested from the address set out in section 1.

7. Storage duration at a glance

• Account and budget details: until you delete the account or until you request deletion. After 24 months without registration, the account will be deleted after prior notice via email.
• Server log files: 14 days.
• Password reset token: approx. 1 hour.
• Click logs of affiliate redirects: 12 months.
• Feedback data: 24 months.
• Cookie choices: up to 182 days on your device; no central storage of consent records.
• Invoice and booking data: 10 years (§ 147 AO, § 257 HGB).

8. Your rights

You have the right to:

• Information about the data stored about you (Article 15 GDPR)
• Correction of incorrect data (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability in a machine-readable format (Article 20 GDPR)
• Revocation of consent given with effect for the future (Article 7 Paragraph 3 GDPR). The lawfulness of the processing carried out until the revocation remains unaffected. You can change your consent to optional services at any time via the cookie settings.

To exercise, an informal message is sufficientsupport@jmrkt.com.

Right to object according to Art. 21 GDPR

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which is carried out on the basis of Art. 6 paragraph 1 lit. f GDPR. This applies in particular to the processing described in sections 3.1, 3.5, 3.7 and 3.11. I will then no longer process the data unless I can demonstrate compelling legitimate reasons that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right of appeal

You can complain to a data protection supervisory authority, in particular the authority responsible for me:

The state representative for data protection in Lower Saxony

Prinzenstrasse 5, 30159 Hanover

poststelle@lfd.niedersachsen.de

9. No automated decision making

Automated decision-making including profiling in accordance with Art. 22 GDPR does not take place.

10. Necessity of provision

Providing your email address and password is required to create a user account and use the service. Registration is not possible without this information. The use of the public pages is possible without an account. There is no legal or contractual obligation to provide the data.

11. Data security

The transmission is encrypted via TLS. Passwords are stored exclusively as a cryptographic hash using a modern process. Access to the database is limited to the operation of the service.

12. Changes to this privacy policy

This data protection declaration will be adjusted if the processing described changes - for example when the range measurement, advertising or the paid subscription are activated. The version published on this page applies.

13. Note on the offer

JMRKT is used for manual budget planning and editorial guidance on financial products. It does not constitute investment, tax or legal advice.