Data Controller
- Company name
- The Cloudest Tomasz Iwanowski
- Tax ID (NIP)
- 1251739186
- REGON
- 523341785
- Contact
- privacy@budget-buddy.eu
- Address
- Bandurskiego 47B, 05-270 Marki, Poland
Account data
- Registration data
- e-mail address, user identifier or username and, for classic accounts, a password stored as a secure hash
- Social sign-in
- account identifier, e-mail address and profile data shared by Apple or Google; BudgetBuddy never receives the password for those services
- Profile data
- optional first and last name, avatar, user preferences and app settings
- Contact and support
- support-request content, e-mail address and information needed to reply and resolve the issue
- Login and device data
- login date and time, public IP address, trusted-device identifier, device name or model, platform, app version, operating system and browser
- Security location
- approximate city, region and country derived from the IP address when this information is provided by our infrastructure provider; we do not collect precise GPS location
Financial data
- Budgets
- budget names, planned and actual amounts
- Categories
- names of expense categories and subcategories
- Transactions
- descriptions, amounts, transaction dates
- Documents
- optionally uploaded receipt photos, PDFs, text files and statements, plus content extracted from those materials
- Budget receipt trends
- system classification tags, tag value, currency and purchase month are used to create trends for the selected budget. Results are visible to users who have access to that budget
- Shared budgets
- invitations, roles, access scope and activity required for collaboration on a budget
Technical data
- Session and local storage
- website cookies and the app's secure storage and local settings needed for sign-in, device protection and remembering preferences
- Logs and diagnostics
- IP address, request identifier, browser, operating system, app version, error information and technical data needed for security and troubleshooting
- Notifications
- push token, platform and device identifier when the user enables notifications
- Advertising data
- on Free: IP address, device identifiers and information, ad use and interactions, diagnostics, approximate location derived from IP and consent signals needed for delivery, measurement, frequency capping and fraud prevention; never budget contents. We do not use personalized ads or request App Tracking Transparency permission
Payment data
- Transaction data
- store, product, transaction identifier, status and subscription-period dates
- Identifier
- a random account identifier shared with RevenueCat to link the purchase to a plan
- Security
- card and bank details are processed by Apple or Google and are never stored in our system
Legal basis for processing
- GDPR Art. 6(1)(b)
- Performance of a contract (providing the BudgetBuddy service)
- GDPR Art. 6(1)(a)
- Consent where required by law, in particular for optional notifications and advertising technologies
- GDPR Art. 6(1)(f)
- Legitimate interests, in particular security, abuse prevention, diagnostics and handling claims
Purpose of processing
- Providing the service
- Enabling budget management, expense categorization and financial analysis.
- Security
- Protecting user accounts, detecting unauthorized access and preventing abuse.
- Maintaining the service
- Diagnosing errors, monitoring security and improving app reliability.
- Budget shopping analysis
- Creating shopping-value trends for the selected budget by system tag and month. Receipts from different budgets are not combined.
- Communication
- Sending messages required for account, security, shared-budget and subscription features, plus optional push notifications.
Scanners and AI processing
- Provider
- OpenAI processes the uploaded material and returns proposed transaction data or receipt lines as the processor providing the AI service.
- Storage by BudgetBuddy
- The original file is used to service the request and is not retained by BudgetBuddy as a separate file. Transactions and receipt data that you approve are stored in your account.
- Provider data
- OpenAI may retain limited technical data or content for the period resulting from the API terms, retention settings and security requirements. We do not use scans for advertising or marketing.
Who receives your data
- Hosting providers
- To store data on servers
- AI scanners
- OpenAI - user-initiated document analysis
- Social sign-in
- Apple and Google - authentication and transfer of permitted account data
- Subscriptions
- Apple, Google and RevenueCat - purchase, confirmation and entitlement synchronization
- Notifications
- Expo and Apple or Google system notification providers - delivery of push notifications
- Free-plan ads
- Google AdMob and the certified UMP consent platform - only after the privacy flow
- Government authorities
- Only where required by applicable law
Automated decision-making
Your rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify incorrect data
- Erasure of your data (the right to be forgotten)
- Restrict processing
- Data portability
- Object to processing
- Lodge a complaint with the supervisory authority (UODO)
Data security
- Encryption
- Data is transmitted over HTTPS. Passwords are stored as secure hashes, and secrets that must be retrieved later are encrypted.
- Secure servers
- Data is stored on servers with access controls, backups and security monitoring.
- Restricted access
- Only authorized personnel have access to data, to the extent necessary.
How long we keep your data
- Account data
- until account deletion; after a request, the account is deactivated and the user has 7 days to cancel the operation
- Financial data
- for as long as the service is actively used
- Scanner materials
- the original file is not retained by BudgetBuddy; approved output remains with the account, while retention by OpenAI follows the API service terms and configuration
- Devices and notifications
- until the device is signed out, notifications are disabled, the token is invalidated or the account is deleted, subject to a shorter technical period
- Server logs
- up to 12 months
- Cookies
- according to browser settings and user preferences
- Subscription data
- for the account lifetime and afterwards only as needed for settlements, complaints and legal obligations
Source of your data
Is providing data required?
- Mandatory data
- An e-mail address and account identifier are required. A password is required only for a classic account; a social account uses Apple or Google authentication.
- Optional data
- All other data (preferences, documents) - provided voluntarily
- If not provided
- You will not be able to create an account or use the app
- Payment data
- Required for Premium/Plus subscriptions - without it, purchase is not possible
Store subscription information
- Security
- Apple App Store or Google Play processes the payment. BudgetBuddy does not receive card details.
- Subscriptions
- Subscriptions renew automatically. Management and cancellation take place in the purchase store.
- Documents and refunds
- Purchase history and documents are available in the Apple/Google account. Payment refund requests go to the relevant store.
- Account deletion
- A request can be submitted in the app or on the public account-deletion page. The account is deactivated immediately and deleted after 7 days unless the user cancels the request. Account deletion does not cancel a store subscription. We may retain limited transaction data when required for legal, accounting or claims purposes.