1. Who We Are

The data controller responsible for your personal data is:

• Company: Pi4, d.o.o.
• Address: Copova ulica 9B, 2310 Slovenska Bistrica, Slovenia
• VAT ID: SI56295332
• Email: pro902.com@gmail.com

2. What Data We Collect

2.1 Account Data

When you create an account or purchase API access, we collect:

• Email address
• Password (stored as a secure hash — we never store plaintext passwords)
• Name (if provided via Google OAuth)
• Payment information (processed by Stripe — we never store card details)

2.2 Usage Data

When you use nextprime.app or the API, we may collect:

• API call logs (timestamp, endpoint, response time) — for billing and abuse prevention
• IP address — for security and rate limiting
• Browser type and version — for compatibility

2.3 Tool Usage (Anonymous)

The prime number tool runs entirely in your browser. Numbers you enter into the Range Finder, Prime Check, or Next Prime tool are never sent to our servers. All computation happens locally on your device.

2.4 Cookies

We use cookies as described in our Cookie Policy. You can manage cookie preferences at any time via the Cookie Settings link in the footer.

3. Legal Basis for Processing

We process your data based on the following legal grounds under GDPR Article 6:

• Contract performance (Art. 6(1)(b)) — to provide API access you have subscribed to
• Legitimate interest (Art. 6(1)(f)) — for security, fraud prevention, and service improvement
• Legal obligation (Art. 6(1)(c)) — for tax and accounting records
• Consent (Art. 6(1)(a)) — for optional analytics cookies

4. How We Use Your Data

• To provide, maintain, and improve nextprime.app and the API
• To process payments and send invoices
• To send transactional emails (API key delivery, subscription confirmations)
• To detect and prevent abuse, fraud, and security threats
• To comply with legal and tax obligations

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.

5. Third-Party Services

We use the following third-party processors:

• Stripe — payment processing. Stripe's Privacy Policy applies to payment data. See stripe.com/privacy ↗
• Google OAuth — optional sign-in. Only your email and public profile name are shared. See Google Privacy Policy ↗
• Hosting provider — server infrastructure for API endpoints

6. Data Retention

• Account data: Retained for the duration of your account plus 2 years after deletion
• Payment records: Retained for 10 years as required by Slovenian accounting law (ZGD-1)
• API logs: Retained for 90 days, then automatically deleted
• Cookie data: As specified in our Cookie Policy

7. Your Rights Under GDPR

As an EU resident, you have the following rights:

• Right of access (Art. 15) — request a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Right to restrict processing (Art. 18) — limit how we use your data
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent — at any time for consent-based processing

To exercise any right, contact us at pro902.com@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si ↗).

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including SSL/TLS encryption, secure password hashing, and access controls. No method of transmission over the internet is 100% secure; we strive to use commercially acceptable means to protect your data.

9. International Transfers

Your data is stored within the European Economic Area (EEA). If any transfer outside the EEA is required (e.g. via Stripe or Google), it is made under appropriate safeguards including Standard Contractual Clauses (SCCs) as per GDPR Chapter V.

10. Children's Privacy

nextprime.app is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or via a notice on nextprime.app at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.