Privacy Policy

1. Introduction

This Privacy Policy explains how Gantto (“Gantto,” “we,” “us,” or “our”) — operated by Nut Teppimol — collects, uses, and protects your information when you use our service at gantto.dev.

We are committed to handling your data responsibly. This policy covers our practices under applicable privacy laws including the EU General Data Protection Regulation (GDPR), Thailand’s Personal Data Protection Act (PDPA), and the California Consumer Privacy Act (CCPA).

2. Information We Collect

We collect the following categories of information:

Account information

When you sign in with Google, we receive your name, email address, and profile photo from your Google account via Firebase Authentication. We store this to create and maintain your Gantto account.

Project content

We store the Gantt charts, Mermaid source code, project names, and organizational data you create within Gantto. We also store collaboration data such as member roles and invite email addresses for projects you share.

Usage and analytics data

We use Firebase Analytics (provided by Google) to collect anonymized usage information such as page views, feature interactions, and session data. This data helps us understand how Gantto is used and improve the service.

Server logs

Our servers automatically record standard request logs, which may include your IP address, browser type, pages visited, and timestamps. These logs are used for security monitoring and debugging.

3. How We Use Your Information

We use the information we collect to:

• Create and maintain your account and authenticate you securely.
• Store, display, and synchronize your Gantt chart projects.
• Enable collaboration features such as project invites and role-based access.
• Send project invitation emails to collaborators you invite.
• Analyze usage patterns to improve the service and fix bugs.
• Ensure the security and integrity of the service.

We do not use your personal information for advertising, sell your data to third parties, or use your project content to train machine learning models.

4. Data Sharing

We share your information only with the following parties:

Google / Firebase

We use Google Firebase for authentication (Firebase Auth) and analytics (Firebase Analytics). Google processes your account data in accordance with Google’s Privacy Policy.

Hosting infrastructure

Your project data is stored in a PostgreSQL database managed by our hosting provider. Our provider has access to the infrastructure but is contractually bound to confidentiality.

Legal requirements

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of Gantto, its users, or the public.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

5. Data Retention

We retain your account information and project data for as long as your account is active. If you request account deletion, we will delete your personal information and project data within 30 days, except where retention is required by law.

Analytics data collected by Firebase Analytics is subject to Google’s own retention policies. Server logs are typically retained for up to 90 days.

6. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

EU / EEA residents (GDPR)

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data (“right to be forgotten”).
• Portability: Receive your data in a machine-readable format.
• Object: Object to processing based on legitimate interests.
• Lodge a complaint: You have the right to lodge a complaint with your local data protection authority.

Thai residents (PDPA)

• Access and receive a copy of your personal data.
• Request correction or deletion of your data.
• Request data portability.
• Withdraw consent at any time.

California residents (CCPA)

• Right to know: Request details about the categories and specific pieces of personal information we collect.
• Right to delete: Request deletion of personal information we hold about you.
• Right to non-discrimination: We will not discriminate against you for exercising your rights.

Note: We do not sell personal information. The CCPA “opt-out of sale” right is not applicable.

To exercise any of these rights, contact us at legal@gantto.com. We will respond within 30 days (or within the timeframe required by applicable law).

7. Cookies and Tracking

Gantto uses cookies and similar storage mechanisms for the following purposes:

• Session cookie: An HTTP-only, secure session cookie that keeps you signed in. This is strictly necessary for the service to function.
• Firebase Analytics: Google Firebase Analytics may use cookies or local storage to collect anonymized usage data (page views, feature usage, session duration).

You can opt out of Firebase Analytics data collection by using the Google Analytics Opt-out Browser Add-on or by configuring your browser to block third-party cookies. Note that blocking the session cookie will prevent you from signing in.

8. Children’s Privacy

Gantto is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected information from a child under 13, we will delete that information and the associated account promptly.

If you believe a child under 13 has provided us with personal information, please contact us at legal@gantto.com.

9. International Data Transfers

Gantto is operated from Thailand, and your data may be processed and stored in countries other than your own — including the United States — via Google’s Firebase and cloud infrastructure.

For users in the European Economic Area, Google Firebase relies on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure that data transferred outside the EEA is adequately protected. By using Gantto, you consent to these transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

11. Contact

If you have questions, concerns, or requests regarding your privacy or this policy, please contact us at:

Gantto (Nut Teppimol)
legal@gantto.com