1. Controller
P.Amini & M. Witt GbR, Fleiderweg 108, 50859 Cologne, Germany
Privacy email: support@pamagames.de
2. Website
When the site is requested, technically necessary connection data such as IP address, timestamp, requested resource, transferred volume, browser information, and error status is processed to deliver the site and protect it from attacks and failures. Our legitimate interests provide the legal basis where GDPR applies.
The public pages use no cookies, analytics, advertising pixels, remote fonts, contact forms, or embedded third-party media. Caddy access logging is disabled, although infrastructure and security providers may temporarily process technical connection data.
3. Account and authentication
We process a Firebase user ID, email address, display name, authentication provider, and sign-in/security metadata to register users, secure accounts, sign them in, and synchronize their data. Sign in with Apple may provide an Apple relay address. Where GDPR applies, this is necessary to perform our agreement and for our legitimate security interests.
4. Households and purchases
We store household name and currency, membership and display names, invitations, stores, categories, purchases including date, items, quantities and prices, and assignment/change metadata. The data is shared with members of the selected household to provide the service.
Free-form item or household names could unintentionally contain personal information. Do not enter sensitive information.
5. Receipt scanning and AI
Apple Vision converts a receipt photo to text on the iPhone; we do not upload or store the photo. For a Premium scan you initiate, we send the recognized receipt text, household currency, and necessary category context to our Cloud Functions and OpenAI. Premium insights use summarized purchase data. Results may contain errors and are presented for review.
This processing provides the requested receipt extraction, classification, and insight features. It does not make decisions producing legal or similarly significant effects.
6. Premium and Apple
Apple processes purchases and payments. We process product, transaction and original-transaction identifiers, app account tokens, status, duration, environment, and household assignment to unlock and restore Premium, prevent fraud, and handle transfers. We do not receive full payment-card details.
7. Support
When you contact support, we process the email address, message, technical references, and evidence you voluntarily provide. Premium transfers may require verification of an order number, transaction status, and account metadata. Support drafts may be processed briefly by OpenAI after automatic redaction.
8. Usage and security data
We use no Firebase Analytics or advertising SDKs. To limit abuse, control operating costs, and diagnose errors, we store text-free function/token counts, durations, results, household identifiers, and bounded error codes. Security logs may include IP address, device/app identifiers, and App Check attestations.
9. Service providers
- Google Ireland Limited and/or Google LLC: Firebase Authentication, Cloud Firestore, Cloud Functions, and App Check. Firestore is hosted in the
eur3multi-region and our Cloud Functions ineurope-west3. Firebase Authentication also processes data in the United States. - OpenAI, L.L.C.: processing recognized receipt text, category context, and summarized purchase data for receipt extraction, item classification, and Premium insights. API response storage is disabled; standard abuse-monitoring logs may be retained for up to 30 days.
- Apple Distribution International Ltd. and related Apple entities: Sign in with Apple, in-app subscriptions, purchase verification, and subscription management.
- FranTech Solutions / BuyVM: operation of our web server in Zürich; administrative access by the U.S. provider cannot be excluded.
- ALL-INKL.COM – Neue Medien Münnich: receiving and sending support and privacy email.
10. International transfers
Google, OpenAI, Apple, and FranTech may process data in the United States or other countries outside the EEA. Depending on the provider, transfers rely on adequacy decisions, including the EU-U.S. Data Privacy Framework for certified recipients, and/or EU Standard Contractual Clauses with supplementary protections. Switzerland has an EU adequacy decision.
11. Retention
- Personal account data: until account deletion is confirmed; it is then deleted immediately and permanently.
- Shared purchases: after departure or account deletion, retained without identifying creator information while at least one person remains in the household; when nobody remains, all household and purchase data is deleted immediately and permanently.
- Invitations and support jobs: generally 7 days; receipt classification sessions: 24 hours.
- Text-free AI and catalog usage telemetry: 180 days; Premium transfer audit: 365 days.
- OpenAI API abuse-monitoring logs: under standard configuration, potentially up to 30 days.
- Support email and legally required business records: as long as needed for the request, legal claims, or mandatory retention.
12. Account deletion
Confirm deletion at “Profile → My Profile → Delete Account.” Your personal account data is then deleted immediately and permanently. Ownership of a shared household must be transferred first.
Purchases in a shared household remain without your name while at least one person is still a member. As soon as nobody remains in the household, all household and purchase data is also deleted immediately and permanently. Deleting the app account does not automatically cancel an Apple subscription. Records strictly required by law or for legal claims remain unaffected and are retained in restricted form only for the periods stated above.
13. European privacy rights
Where GDPR or similar law applies, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent prospectively and complain to a data protection authority, particularly the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. Send requests to the address above.
14. U.S. State Privacy Notice
Where applicable U.S. state law grants these rights, you may request information, access, correction, deletion, or a portable copy and may appeal a refusal. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or offer financial incentives for personal information. During the preceding twelve months, the identifier, purchase, usage, device, support, and household categories described above were disclosed only to service providers for the stated operational purposes.
Requests and appeals: support@pamagames.de. We will verify identity and respond within the applicable period. Authorized agents may act with proof of authority. We do not discriminate against anyone for exercising privacy rights.
15. Children
Market Expenses is not directed to children under 13, and we do not knowingly collect their personal information. If notified, we will investigate and delete it. A parent or guardian may contact us.
16. Security and changes
We use access controls, transport encryption, App Check, separated permissions, and data minimization. No system is entirely risk-free. We update this policy when features, providers, or law materially change and will provide an appropriate notice of significant changes.