1. Who We Are and How to Contact Us

Data Controller: Culmium d.o.o., a company registered in Slovenia, is the data controller responsible for your personal data when you use the Peakyphi Process Optimizer (“the Service”).

Website: https://www.peakyphi.com

Application: https://app.peakyphi.com

Privacy contact: privacy@peakyphi.com

For any questions about this Privacy Policy or to exercise your rights under the GDPR, please contact us at privacy@peakyphi.com. We will respond within 30 days.

2. Scope of This Policy

This Privacy Policy applies to all personal data we collect and process when you visit our website (www.peakyphi.com), register for an account, use the Peakyphi application (app.peakyphi.com), or communicate with us.

This policy does not apply to third-party websites linked from our Service. We encourage you to read the privacy policies of any third-party services you use.

3. What Personal Data We Collect

3.1 Account and Identity Data

• Email address (used as your username and for account communications)

• First and last name (optional, for personalisation and support)

• Company or organisation name (optional)

• Job title or role (optional)

• Password (stored as a cryptographic hash; we never store your actual password)

3.2 Subscription and Billing Data

When you purchase a subscription, Stripe processes your payment. We do not receive or store your credit card details. We do receive and store:

• Subscription tier (Free, Pro, or Enterprise)

• Billing status (active, cancelled, past due)

• Stripe Customer ID (a reference identifier, not payment details)

• Transaction date and amount (for our accounting records)

3.3 Usage and Technical Data

When you use the Service we may collect:

• IP address and approximate geographic location (country/city level)

• Browser type and operating system

• Pages and features accessed, and actions taken within the application

• Date and time of access

• Error events and performance data

• Session duration and frequency of use

3.4 User-Generated Content

Data you enter into the Peakyphi application — such as experiment observations, factor values, response values, and project configurations — is stored on our servers to provide the Service. This data may contain process or product information of a commercial nature. We treat this data as strictly confidential and do not access it except as necessary to provide technical support when you explicitly request it.

3.5 Communications Data

If you contact us by email or through a contact form, we store the content of your message and your contact details to respond to your enquiry.

4. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under Article 6 of the GDPR:

Contract performance (Art. 6(1)(b)): Account data (email, name, tier) that is necessary to create your account and deliver the Service you have signed up for.

Legitimate interests (Art. 6(1)(f)): Technical and usage data collected to maintain service security, diagnose errors, prevent abuse, and improve the Service. We have assessed that these interests are not overridden by your rights.

Consent (Art. 6(1)(a)): Optional analytics tracking (e.g. product usage analytics via tools such as Mixpanel or PostHog) where we ask for your consent before activating such tracking. You may withdraw consent at any time without affecting prior processing.

Legal obligation (Art. 6(1)(c)): Retention of invoicing and accounting records as required by Slovenian and EU tax law (typically 7 years).

5. How We Use Your Data

• To create and manage your user account

• To provide access to the Peakyphi application and its features

• To process your subscription payment via Stripe

• To send transactional emails (account setup, password reset, subscription confirmation) via Resend

• To respond to support requests and enquiries

• To detect and prevent fraudulent or abusive use of the Service

• To monitor and improve the reliability, security, and performance of the Service

• To comply with legal obligations, including tax and accounting requirements

• With your consent: to analyse product usage patterns to guide product development

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Third-Party Data Processors

We share personal data with the following processors, each bound by a Data Processing Agreement (DPA) and appropriate technical and organisational safeguards:

Processor — Purpose — Location

Stripe, Inc. — Subscription billing and payment processing — USA (SCCs)

Resend, Inc. — Transactional email delivery — USA (SCCs)

Railway Corp. — Cloud hosting and infrastructure — USA (SCCs)

Cloudflare, Inc. — DNS, CDN, and DDoS protection — USA (SCCs)

Analytics provider (TBD) — Optional product usage analytics (consent-based) — EU/USA (SCCs)

“SCCs” means Standard Contractual Clauses adopted by the European Commission for transfers of personal data to third countries, ensuring an adequate level of protection. We do not sell your personal data to any third party.

7. Cookies and Local Storage

7.1 Strictly Necessary Storage

The Peakyphi application uses browser localStorage to store your authentication token and session preferences (such as your selected project). This is strictly necessary for the Service to function and does not require consent.

7.2 Analytics (Consent-Based)

We may in the future use analytics cookies or SDKs (such as Mixpanel or PostHog) to understand how users interact with the application. If and when we introduce such tracking, we will ask for your explicit consent before any data is collected. You can withdraw consent at any time via the account settings page.

Until such consent is obtained, no analytics tracking beyond what is functionally necessary will be active.

8. How Long We Keep Your Data

Account and application data: Retained for as long as your account is active. If you request account deletion, your personal data and project data will be permanently deleted within 30 days, except where we are required by law to retain certain records.

Billing and invoicing records: Retained for 7 years from the date of the transaction in accordance with Slovenian accounting law (ZGD-1 and ZDDV-1).

Support communications: Retained for up to 2 years from the date of the communication.

Analytics data (if consented): Retained for up to 2 years in anonymised or aggregated form.

9. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You may request a copy of all personal data we hold about you.

• Right to rectification (Art. 16): You may ask us to correct inaccurate or incomplete data.

• Right to erasure (Art. 17): You may ask us to delete your personal data (‘right to be forgotten’), subject to legal retention obligations.

• Right to restriction (Art. 18): You may ask us to restrict processing of your data in certain circumstances.

• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.

• Right to object (Art. 21): You may object to processing based on legitimate interests. We will cease such processing unless we have compelling legitimate grounds.

• Right to withdraw consent (Art. 7(3)): Where processing is based on consent (e.g. analytics), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.

• Right to lodge a complaint: You have the right to lodge a complaint with the Slovenian supervisory authority, the Informacijski pooblaščenec (IP RS), at https://www.ip-rs.si.

To exercise any of these rights, please contact us at privacy@peakyphi.com. We will respond within 30 days. We may need to verify your identity before acting on your request.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encrypted data transmission via TLS/HTTPS

• Password storage using industry-standard cryptographic hashing (PBKDF2-SHA256)

• Access controls ensuring users can only access their own data

• Infrastructure hosted on Railway with isolated compute environments

• DDoS protection and DNS security via Cloudflare

No method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, affected users without undue delay.

11. International Data Transfers

Some of our third-party processors are located in the United States. Transfers of personal data to these processors are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, which provide an adequate level of protection for your personal data in accordance with the GDPR.

We do not transfer personal data to countries without adequate protection mechanisms in place.

12. Children’s Privacy

The Peakyphi Service is intended for use by professionals and businesses and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us at privacy@peakyphi.com and we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes by email (to the address associated with your account) or by displaying a prominent notice in the application at least 14 days before the changes take effect.

The date at the top of this document reflects the date of the most recent update. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Culmium d.o.o. Privacy enquiries: privacy@peakyphi.com Website: https://www.peakyphi.com Registered in: Slovenia, European Union

You also have the right to lodge a complaint with the Slovenian data protection supervisory authority: Informacijski pooblaščenec (IP RS), Dunajska cesta 22, 1000 Ljubljana, Slovenia, https://www.ip-rs.si, gp.ip@ip-rs.si

© 2026 Culmium d.o.o. — Peakyphi Process Optimizer