Privacy Policy

Last updated: April 12, 2026

Last updated: 11.04.2026

We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how zerozerofournine.com and the mobile application “Deck49” collect, process, and safeguard your information in accordance with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

This policy applies to our website (zerozerofournine.com), the Deck49 mobile app, and all related digital services, purchases, and email communications.

1. Data Controller (Art. 4 No. 7 GDPR)

Srijith Kariyattil (Einzelunternehmen)
trading as Zero Zero Four Nine
c/o Postflex #9448
Emsdettener Str. 10
48268 Greven
Germany
Email: srijith@zerozerofournine.com

2. Data We Collect

2.1 Website and Purchase Data

When you visit our website, submit a form, or purchase a product, we may collect:

  • Name and email address
  • Transaction and order details
  • IP address and browser/device information (via server logs and cookies)
  • Consent timestamp and source (recorded when you opt in to communications)

We do not store full payment card details. All card data is processed directly by Stripe (see Section 5).

2.2 Email and Marketing Data

When you download a free product or purchase from us, we collect your email address and, where provided, your first name. This data is used to deliver your product and send relevant follow-up communications. You can unsubscribe at any time.

2.3 Deck49 App Data

When you create a Deck49 account or use the Deck49 mobile app, we collect and process the following data:

  • Account data: Email address and authentication credentials (password stored as a secure hash — never in plain text)
  • Study data: Flashcard history, study session progress, card confidence ratings, and spaced repetition scheduling data
  • Device information: Device model, operating system version, and app version (used for compatibility and debugging)
  • Usage data: In-app session activity and feature interactions, used to improve the app experience

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) for account and study data; legitimate interest (Art. 6(1)(f) GDPR) for usage and device data.

All Deck49 app data is stored in Google Firebase (Google LLC), a cloud platform with servers in the EU and US. Data transfers outside the EU are covered by Standard Contractual Clauses.

Account deletion: You may request deletion of your Deck49 account and all associated personal data at any time via our account deletion page (zerozerofournine.com/deck49-account-deletion/) or by emailing srijith@zerozerofournine.com with the subject line “Delete my Deck49 account”. Requests are processed within 7 days. After deletion, anonymised and aggregated usage data (containing no personal identifiers) may be retained for product improvement purposes.

3. Platform: WordPress

Our website is built on WordPress, an open-source content management system. WordPress may set functional cookies to manage sessions and logged-in user state. We do not use WordPress to collect personal data beyond what is described in this policy. WordPress is hosted on our own server in the EU (Hetzner Online GmbH, Germany).

4. Email Marketing: FluentCRM

We use FluentCRM (by WPManageNinja) as our email marketing and customer relationship management tool. FluentCRM is a self-hosted plugin — all subscriber data is stored on our own server and is not shared with third-party email platforms.

FluentCRM stores the following data for each subscriber:

  • Email address
  • First name (where provided)
  • Product tags and purchase history
  • Consent timestamp and source
  • Subscription status and unsubscribe date (if applicable)

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) for transactional emails (delivering purchased products); consent (Art. 6(1)(a) GDPR) for marketing follow-up emails where a checkbox was ticked.

Every marketing email contains an unsubscribe link. You can also request deletion of your data at any time by emailing srijith@zerozerofournine.com.

For more information, visit: fluentcrm.com/privacy-policy/

5. Payment Processing: Stripe

All payments on zerozerofournine.com are processed by Stripe, Inc. (or Stripe Payments Europe, Ltd. for EU customers). When you make a purchase, you are entering your payment details directly into Stripe’s secure payment form.

We never see or store your full card number, CVV, or bank account details. Stripe handles all payment card data and is PCI-DSS Level 1 certified.

Stripe may collect and process:

  • Card details (number, expiry, CVV) — stored only by Stripe
  • Billing name and email address
  • IP address and device information for fraud prevention
  • Transaction amount and metadata

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

Stripe acts as an independent data controller for the data it processes. For more information, see: stripe.com/privacy

Stripe’s registered address (EU): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

5.1 In-App Purchases (Apple App Store & Google Play)

If you purchase Deck49 Plus through the Apple App Store or Google Play Store, payment is processed directly by Apple or Google respectively. We do not receive your full payment details. Apple and Google act as independent data controllers for payment data collected during in-app purchases. Please refer to their privacy policies for further information:

  • Apple Privacy Policy: apple.com/legal/privacy/
  • Google Privacy Policy: policies.google.com/privacy

6. Cookies

We use cookies to ensure the proper functioning of our website. A cookie consent banner allows you to accept or decline non-essential cookies. Essential cookies (e.g. session cookies for the WordPress admin, Stripe payment session cookies) are necessary for the site to function and do not require consent.

For a full list of cookies used on this site, please see our Cookie Policy managed via our cookie consent tool.

7. Legal Bases for Processing

  • Art. 6(1)(a) GDPR — Consent: Marketing emails and newsletter subscriptions where you ticked a consent checkbox
  • Art. 6(1)(b) GDPR — Contract: Processing your order, delivering your purchased product, and operating your Deck49 account
  • Art. 6(1)(f) GDPR — Legitimate Interest: Transactional follow-up emails, fraud prevention, security logging, app usage analytics

8. Data Retention

  • Subscriber and purchase records are retained for as long as necessary to fulfil the service or as required by German tax law (typically 10 years for invoicing records)
  • Deck49 account and study data is retained for as long as you hold an active account. Upon deletion, all personal data is removed within 7 days
  • Anonymised, aggregated usage data (containing no personal identifiers) may be retained indefinitely for product improvement purposes
  • If you unsubscribe, your email is marked as unsubscribed and no further marketing emails are sent. You may request full deletion at any time
  • Server log data is retained for up to 30 days

9. Data Sharing and Third Parties

We do not sell your personal data. We share data only with the following processors where strictly necessary:

  • Stripe — payment processing for website purchases (see Section 5)
  • Apple Inc. — in-app purchase processing via the App Store (see Section 5.1)
  • Google Firebase (Google LLC) — cloud storage and backend infrastructure for the Deck49 app (account data, study data, usage data)
  • Hetzner Online GmbH — server hosting for the website (Germany, EU)

All processors are either based in the EU or covered by adequate data transfer mechanisms (Standard Contractual Clauses).

10. Your Rights (GDPR)

Under the GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion of your data (“right to be forgotten”)
  • Restriction — request we limit how we process your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interest
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, email: srijith@zerozerofournine.com

Deck49 users may also use our account deletion page (zerozerofournine.com/deck49-account-deletion/) to request erasure of all app data.

You also have the right to lodge a complaint with your national data protection authority. In Germany: Bundesbeauftragte für den Datenschutz (BfDI) — bfdi.bund.de

11. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of our services after any changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests:
Email: srijith@zerozerofournine.com

Scroll to Top