Privacy Policy

This Privacy Policy sets out the rules for processing and protecting personal data provided by Users in connection with their use of the services available in the Finanse Menadżer web application (the "App").

This is an English translation provided for your convenience. The Polish version is the governing text; in case of any discrepancy, the Polish version prevails.

The Controller of your personal data is Rafał Prokopiak, operating a sole proprietorship at Gdańska 31, 85-005 Bydgoszcz, Poland, e-mail: [email protected] (the "Controller").

Your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), on the following legal bases:

• Article 6(1)(a) GDPR — consent given during registration in the App and for optional features (e.g. push notifications, connecting an external AI assistant);
• Article 6(1)(b) GDPR — processing necessary for the performance of the paid subscription contract (handling billing and payment data);
• Article 6(1)(c) GDPR — compliance with the Controller's legal obligations, in particular tax and accounting obligations related to settling payments and issuing invoices;
• Article 6(1)(f) GDPR — the Controller's legitimate interest in ensuring the stability, security, and development of the App (error monitoring and fully anonymous usage analytics);
• Article 6(1)(f) GDPR — the legitimate interest of members of a shared Project in using the Project data visible to them with tools of their choice, including AI assistants (see section 12).

In providing the services, the App collects the following personal data:

• Registration data: e-mail address, first and last name
• Social sign-in data (Google): e-mail address, first and last name, profile photo (optional)
• Financial data entered by the User: information about transactions, expense/income categories, accounts, financial Projects, and notes on transactions
• Bank statement import data (if you use this feature): booking date, amount, transaction title, and the account it belongs to — read from the file you pick and stored as entries awaiting a category
• Billing data (subscription): Stripe customer and subscription identifiers, subscription status, billing period, and next payment date
• Push notification data (if enabled): browser push provider endpoint address, subscription encryption keys, and browser type
• Technical data: IP address, browser type, operating system (stored in server logs and session data)
• Diagnostic and analytical data: fully anonymous, aggregated visit statistics (Umami) and application error data logged at the time of a crash (Sentry) — see section 10 for details
• AI assistant connection data (if you use this feature): name and address of the connected app, date and scope of the consent you gave, and access and refresh tokens

Statement import: the statement file is read solely in your browser, on your device. The file itself is never sent to the Controller nor stored anywhere — only the entries you choose to import reach the server. The import does not connect to your bank and never asks for online banking credentials.

Important: the App does not collect or store bank card numbers, online banking passwords, or other sensitive authentication data. Card details and payment method details are processed solely on the side of the payment operator Stripe — the Controller only displays them live in settings (e.g. card brand and last digits) without storing them in its own database.

Your personal data is processed for the following purposes:

• Enabling registration and sign-in to the App
• Providing the personal and family finance management service
• Storing and organizing the financial data you enter
• Real-time data synchronization across your devices
• Communicating with Users on matters related to the App's operation
• Ensuring the security and integrity of data
• Providing and administering the paid subscription (renewals, payment processing, and issuing invoices)
• Fulfilling the Controller's legal obligations (including tax and accounting obligations related to the paid subscription)
• Sending your data to the AI assistant you choose — only at your request (see section 12)

Your personal data will be stored for as long as you have an active account in the App, plus any additional period necessary to fulfil the Controller's legal obligations (e.g. for tax or archiving purposes).

After you delete your account, all your personal data will be permanently deleted from the system within 30 days, except for data that must be retained for legal reasons.

Billing data: accounting documents related to the paid subscription (invoices, payment confirmations) are stored for the period required by tax and accounting law, i.e. 5 years from the end of the tax year in which the settlement was made — even after account deletion, as an exception to the 30-day deletion period.

Account deletion: we delete your account at your request, sent to the Controller’s e-mail address or through the contact form (see section 15). Database backups expire automatically after 30 days (see section 8), so your data disappears from them within that period as well.

AI assistant connections: an access token is valid for 1 hour and a refresh token for 30 days from its last refresh; expired tokens are deleted automatically once a day. The consent and all tokens tied to it are deleted immediately when you disconnect the app in Settings, or when your account is deleted. Records used to rate-limit sign-in and authorization attempts (which contain an IP address) are deleted after 24 hours.

Data sent to an AI assistant is subject to its provider’s retention periods, which the Controller cannot influence — see section 12.

Your personal data may be shared with the following processors providing services to the Controller. Each one's scope corresponds to how the App actually operates:

• Hetzner Online GmbH — server infrastructure provider (VPS in Nuremberg, European Union), on which the Controller self-hosts the application and the PostgreSQL database (storage of all data, including authentication data)
• Google LLC / Google Ireland Ltd. — only when signing in with a Google account is used (e-mail address, first and last name, profile photo)
• Stripe Payments Europe, Ltd. / Stripe, Inc. — payment and subscription processing provider; processes e-mail address, first and last name, billing address, tax identification number, and card data (on Stripe's side only)
• Sentry — error monitoring and crash diagnostics provider; processes diagnostic data at the time an error occurs (European Union region)
• Cloudflare, Inc. — bot protection provider (Cloudflare Turnstile on the contact form) and encrypted database backup storage (Cloudflare R2, located in the European Union)
• Plunk (useplunk.com) — transactional e-mail delivery provider (e.g. messages from the contact form and notices about your account and changes to this Policy)
• Browser push notification providers (e.g. Google, Mozilla, Apple) — only if you enable push notifications; used to deliver notifications to your device (see section 11 for details)

The AI assistant you choose (e.g. OpenAI — ChatGPT, Anthropic — Claude) — only if you connect it to the App yourself. Its provider is not a processor acting on the Controller’s behalf but a separate, independent controller to which data is sent at your request; it may process the data outside the EEA under the terms of its own privacy policy. See section 12 for details.

Self-hosted solutions (no third-party involvement): authentication (Better Auth), real-time data synchronization (ElectricSQL), and visit analytics (Umami) run entirely on the Controller's infrastructure — this data is not shared with any external provider.

Transfers outside the EEA: some data may be processed outside the European Economic Area (including in the United States) — billing data via Stripe and e-mail message data via Plunk. Transfers are based on Standard Contractual Clauses approved by the European Commission or on a European Commission adequacy decision (e.g. the EU-U.S. Data Privacy Framework). You can obtain a copy of the safeguards applied by contacting the Controller at the address given in section 15.

All processors act under data processing agreements and provide an adequate level of data protection in line with GDPR requirements.

Under GDPR, you have the following rights:

• Right of access — you can obtain information about which personal data is being processed
• Right to rectification — you can request correction of inaccurate data
• Right to erasure ("right to be forgotten") — you can request deletion of your data
• Right to restriction of processing — you can request that processing be restricted in certain situations
• Right to data portability — you can receive your data in a structured format and transfer it to another controller
• Right to object — you can object to processing carried out for certain purposes
• Right to withdraw consent — you can withdraw your consent to processing at any time (this does not affect the lawfulness of processing carried out before the withdrawal)
• Right to lodge a complaint — you can lodge a complaint with the supervisory authority (President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland)

To exercise the rights above, contact the Controller at: [email protected]. We respond no later than one month after receiving the request.

The Controller applies appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

The security measures applied include:

• Encrypted connections (HTTPS/TLS)
• Access control over personal data (authentication and authorization)
• Regular, automatic database backups, encrypted in transit and stored in Cloudflare R2 (located in the European Union) with a 30-day retention period
• Using providers that meet GDPR compliance requirements
• Storing core data on servers located in the European Union
• Secure session management using encrypted tokens and HTTPOnly cookies
• AI assistant connections secured with OAuth 2.1 (consent required, PKCE, access tokens valid for 1 hour), which you can disconnect immediately in Settings

The App uses cookies and similar technologies to ensure proper operation, including:

• Session cookies — necessary for the sign-in and authorization system to function
• Preference cookies — used to remember user settings (e.g. the selected language)

Important: to analyze traffic, the App uses the cookieless tool Umami, which does not set any cookies, does not profile users, and does not receive any identifier that could link the statistics to a specific person (e.g. an e-mail address or account ID) — see section 10 for details. Because the tool operates on fully anonymous, aggregated data, its use does not require your consent. Cookies used by the payment operator Stripe during the payment process serve solely to process the transaction and prevent fraud. The App does not use advertising or marketing tracking cookies.

The App’s only source of revenue is the paid subscription — a single flat plan, with no extra charge for additional Project members. Payments and subscriptions are handled by the Stripe payment operator, in accordance with the rules described in sections 3 and 6.

The Controller does not sell, rent, or otherwise share your data — including in anonymized or aggregated form — with third parties for commercial or marketing purposes. The App does not use advertising tracking tools (e.g. Google Analytics, advertising pixels).

To ensure the App's stability, security, and development, the Controller uses the following tools, which process data on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR):

• Umami (self-hosted) — private, cookieless usage analytics (number of visits, most-visited pages). The tool does not set cookies, does not receive the user's e-mail address or account identifier, and collects only fully anonymous, aggregated statistics that cannot be linked to a specific person. Data remains on the Controller's infrastructure within the European Union.
• Sentry — application error monitoring and crash diagnostics. When an error occurs, the tool logs diagnostic data (the type and content of the error, the URL, browser and operating system type, and in some cases the user identifier and IP address) solely to fix the issue. Data is processed within the European Union region. Before a report is sent, values passed to the database (e.g. transaction amounts and notes) are removed from it.

The App may send push notifications (e.g. about recurring transactions or subscription status), only if you consent to this in your device and App settings.

Notifications are delivered via the Web Push standard and your browser's notification service (e.g. Google, Mozilla, Apple). The Controller manages its own VAPID keys and does not use an external push notification provider. In connection with the notification subscription, we store the endpoint address, encryption keys, and browser type.

You can disable push notifications at any time in the App or browser settings — the related subscription data will then be deleted.

The App offers an optional OAuth 2.1-compliant MCP (Model Context Protocol) server that lets you connect an AI assistant of your choice (e.g. ChatGPT by OpenAI, Claude by Anthropic, or another) to your financial data.

The connection is entirely voluntary and initiated only by you. The Controller does not, on its own initiative, send your data to any artificial intelligence provider, nor does it use AI models to process it. Data reaches the assistant only after you give explicit consent on the authorization screen — and only when the assistant retrieves it during a conversation with you.

What data the assistant can receive:

• profile data covered by your consent: first name, e-mail address, and profile photo
• the list of your Projects (name, currency, your role, member count, balance)
• accounts and their balances, categories, transactions including notes, budgets, savings goals, and recurring transactions
• content you give the assistant yourself (e.g. a photo of a receipt) — the assistant processes it, and only the transactions recorded from it reach the App

The assistant can also add, edit, and delete transactions; edits and deletions require an extra confirmation.

Data of other Project members: the assistant sees the same data you see in the App — across all Projects you belong to, including entries added by other members (a member with the “Child” role sees only their own entries). If you belong to a shared Project, another member may connect their own AI assistant — the Project data visible to them, including your entries, is then sent to the provider they chose. The legal basis is the legitimate interest of Project members in jointly using the Project’s data (Article 6(1)(f) GDPR). You can object by contacting the Controller (see section 15).

The assistant’s provider is a separate, independent controller, not a processor acting on the Controller’s behalf. Data sent to the assistant is processed and stored under its provider’s terms and privacy policy — possibly outside the EEA (including in the United States) — and, if your settings with the provider allow it, may be used to train AI models. The provider sets the retention period, which depends among other things on your plan and settings (e.g. deleting a conversation, temporary chats, consent to model training). The Controller has no influence over this data and cannot delete it. Before connecting, review the provider’s privacy policy, e.g. OpenAI or Anthropic, and consider turning off model training on your conversations in the assistant’s settings.

On the Controller’s side only the connection data is stored: the app’s name and address, the consent you gave, and access tokens (retention periods in section 5). The Controller does not store the content of your conversations with the assistant.

Revoking access: at any time in Settings → AI connection → Connected apps. Disconnecting immediately cuts the app off from your data. Data already sent to the assistant can be deleted in its own settings (e.g. by deleting the conversation). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The App is a Progressive Web App (PWA), meaning it can be installed on your mobile device or computer.

Installing the PWA does not involve any additional collection of personal data. All data continues to be stored on the servers in accordance with this Privacy Policy.

The Controller reserves the right to make changes to this Privacy Policy. We will inform you of any change in advance:

• by e-mail — sent the day after the change is published, containing a brief summary of what has changed,
• by an in-App notice.

The new version of the Policy takes effect 14 days after the notice, giving you time to review the changes. Until then, the previous version applies.

All previously published versions of the Privacy Policy are archived for compliance and audit purposes, and their full content is available in the version history.

If you have questions about the processing of your personal data or this Privacy Policy, please get in touch: