Privacy policy
Website, business orders and licence delivery. Updated 27 October 2026.
1. Controller and contact
Peter Kannengießer, trading as WestCoast Software, Dorfstraße 19, 25764 Hellschen-Heringsand-Unterschaar, Germany, is responsible for the processing described here. Further contact details are in the Imprint. For privacy requests, contact service@pekagi.io.
2. Visiting this website
The website and order service run on OVHcloud infrastructure. Delivering pages necessarily processes your IP address and technical request information, such as the requested resource, time and browser headers. Our Caddy web server has access logging disabled, and the website application does not keep a visitor-access log. Operational error information may be needed to diagnose failures; we do not deliberately record payment bodies, licence keys or purchase-recovery URLs in application logs.
The order API uses temporary, in-memory counters associated with IP addresses to limit abusive requests. These counters are not an analytics history and are not written to the order database. They use one-minute request buckets. Expired counters are deleted every minute, normally within two minutes of their creation, and all counters are cleared when the service shuts down. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in operating a secure, available website and preventing abuse. OVHcloud also processes infrastructure data under its own applicable arrangements; see OVHcloud's data-protection information.
3. Browser storage and external resources
This website does not use advertising or audience-analytics trackers and does not set an account or checkout cookie. It remembers interface preferences in your browser's local storage: wcc-theme for light/dark mode, wcc-reader for the documentation reader, and wcc-sc-preset/wcc-sc-mode for examples. These preferences are used locally; they are not submitted to our order service. You can remove them in your browser settings.
Fonts, chart scripts and example assets are served locally. Following a link to an external service sends a request to that service. Stripe Checkout and its billing portal are separate hosted pages with their own cookies, technical data processing and privacy information; the statement about this website's cookies does not describe Stripe's services.
Google Fonts, hosted on this website
We use IBM Plex Sans, IBM Plex Mono, Inter, Roboto, Source Sans 3, Space Grotesk and Lora. Their font files are hosted on our own website. Opening a page or the Playground font picker does not contact Google Fonts or send your IP address to Google for these fonts. Additional previews load from our server when you open the picker; system fonts are supplied by your device. The font licences are linked in the Imprint.
Local preference storage supports the display and example functions you select, such as theme, documentation view and optional Gantt or Stock drawing state. Necessary storage for an expressly requested function is based on section 25(2)(2) TDDDG; related personal-data processing uses Art. 6(1)(f) GDPR. Local storage has no automatic expiry: it remains until you clear the site's browser data. Preferences are not advertising identifiers.
Data in the chart Playground
Values, labels, colours and font choices entered into the chart Playground are processed in your browser and are not sent to our order service or to an AI provider. Clipboard paste reads the values you paste; copying or exporting requires your action. Original examples can retain optional view, selection or drawing state locally. Downloaded JSON and private licence confirmations remain on your device until you delete them. Avoid entering personal or confidential production data into public demonstrations.
4. Checkout, subscriptions and licence delivery
We process the selected plan, business identity, contact and billing details, tax information where applicable, and—for SaaS or OEM—the named licensed product to supply your order. Stripe processes your payment details directly on its hosted checkout. Our website does not receive your full card number or card security code.
Stripe sends payment and subscription events to our order service. We verify their signatures and the relevant payment records before issuing a licence. Our local database stores order identifiers, organisation and licensed product, plan and seat count, the accepted terms version, Stripe customer/subscription/invoice references, paid periods and refund status, the issued licence and a hash of the current delivery-access token. The licence identifies the licensed organisation. Event records contain the event identifier, event type and processing time, rather than a stored copy of the complete webhook payload.
Your purchase-confirmation URL contains an opaque session identifier. It is a recovery credential: someone who obtains it may be able to access your licence and billing portal. Keep that link private. The page exchanges it for a delivery token held only in page memory and sends that token in an authorisation header for licence, download and billing requests. We do not put the delivery token in URLs or browser storage. The confirmation page and order API use a no-referrer policy; order responses are not intended to be cached.
Processing needed for orders, delivery and subscription management is based on Art. 6(1)(b) GDPR where you are our contractual customer. For a company's representatives and contact persons, the basis is Art. 6(1)(f): our legitimate interest in administering the company's order. Tax and accounting duties use Art. 6(1)(c). Payment verification, access control and prevention of fraudulent use also serve our legitimate interests under Art. 6(1)(f).
Stripe is a recipient of the data needed for payments, tax calculation, invoices and subscription management. It acts as a processor for some activities and as an independent controller for others, including its own legal and fraud-prevention obligations. Stripe may process data outside the European Economic Area. Its applicable safeguards, recipient entities, processing purposes and your choices are described in the Stripe Privacy Policy and Privacy Center.
Our Stripe contracting entity for EEA services is Stripe Payments Europe, Limited, Ireland. Depending on the service, Stripe Technology Europe, Limited and Stripe Technology Company, Limited also process data under the roles described in Stripe's Privacy Center. When Stripe transfers data to the United States or other countries, its Data Transfers Addendum describes the applicable safeguards, including the EU–US Data Privacy Framework for covered US recipients and the relevant standard contractual clauses. Copies and further information are available through those documents or our privacy contact.
Stripe's checkout is loaded only after you choose a paid plan; the billing portal opens only when you request it. On the hosted checkout, Stripe also receives technical information about your device and may process data you enter before you complete payment. We do not use abandoned checkout details for marketing. No payment details are required for the separate free trial.
Card-free evaluation
When you request a trial, we store your self-declared business name and contact email, a contact digest for duplicate detection, the confirmed terms language/version/hash, issue and expiry times, the signed licence, the release version, and a hash of the private trial access token. We do not verify the email address or automatically send email. The information supports trial delivery, licence records and prevention of repeated automated issuance; the contractual and legitimate-interest bases described above apply as appropriate.
Trial issuance limits use a keyed digest of your IP address, not a stored plain IP address. It is used for a rolling 24-hour issuance limit and removed from older trial records when subsequent trials are issued. The contact digest remains for duplicate detection; trial licence and acceptance records are not automatically erased at expiry and follow the necessity-based retention and rights assessment below.
Your private trial link contains a browser-only URL fragment. The page removes it from the visible URL and uses its token in an authorisation header; it is not submitted as a query parameter or kept in browser storage. Saving the private confirmation downloads your licence and access link to your device. Anyone holding that link can access the active trial. Keep it private. No payment provider is involved, and a trial creates no automatic payment or renewal.
5. Contact and support
If you email us, we process your contact details and message to answer the request and, where applicable, provide contractual support. This uses Art. 6(1)(b) for your own contract or pre-contractual request and Art. 6(1)(f) for other business correspondence. Please send only the information needed to reproduce a problem. Do not email payment-card data, private signing credentials or unnecessary personal data from your application.
6. Retention
We retain order and licence records while needed to administer the subscription, support continued licensed use, recover access and establish the applicable licence scope. Cancellation does not immediately delete these records: an existing licensed deployment may continue after the paid term. The current order system does not automatically erase a record when a subscription ends. A deletion request is assessed against continuing licence-record needs, legal duties and any relevant claims; data no longer needed for those purposes is eligible for deletion.
German statutory retention periods depend on the record: invoices and accounting vouchers generally have an eight-year period, commercial correspondence six years, and books and financial statements ten years. The relevant period generally starts at the end of the calendar year in which the record was created or received; pending tax matters can require longer retention. These periods do not justify retaining every website request. See § 14b UStG, § 147 AO and, where applicable, § 257 HGB.
Stripe applies its own retention rules for records it controls, including legal payment and compliance obligations; these are described in its privacy information. We do not promise that cancelling a subscription deletes Stripe's statutory records.
7. Your rights
Subject to the applicable conditions, you can request access, correction, erasure, restriction and data portability under Articles 15–20 GDPR. You can object under Article 21 to processing based on legitimate interests for reasons relating to your particular situation. If processing relies on consent, you may withdraw it for the future. Acceptance of licence terms is not consent to advertising.
Contact service@pekagi.io to exercise these rights. We may need proportionate information to verify that a request concerns your data. You may complain to a data-protection supervisory authority, in particular in the EU country of your habitual residence or workplace or the place of an alleged infringement, under Article 77 GDPR.
You can also contact the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), the supervisory authority in the state where our business is established. This does not limit your right to contact another competent supervisory authority.
The information required for a business order is needed to provide and administer it; without it we cannot complete that order. We do not use website activity for advertising profiles. Stripe's own risk checks and data-processing practices are explained in its privacy information.