Privacy Policy

Who is responsible for your data

SavingStat is operated by a private individual based in the Netherlands (the "Operator"), who is the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR).

You can reach the Operator about anything in this policy at support@savingstat.com.

What data we collect

Account data. Your email address, the name you choose to show, and your password, which is stored only as a hash. If you sign in with Google, we receive your name and email address from your Google account instead of a password.

Financial data you bring in. The wallets, transactions, budgets, events and categories you create, and the files you upload: bank statement files, receipt photos and other attachments, together with the data extracted from them.

Technical data. Server logs with IP addresses and request details, kept for security and debugging, and the cookies described below.

The Service does not connect to your bank and never asks for your online banking credentials. Everything in your account is there because you or someone you share with put it there.

Why we use your data, and on what legal basis

• To provide the Service: storing your records, reading your uploaded documents, calculating statistics, converting currencies, and showing shared data to people you invited. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• To send account emails such as address verification and password reset messages. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• To keep the Service secure and working: logs, debugging, abuse prevention. Legal basis: our legitimate interest in running a safe service (Article 6(1)(f) GDPR).
• To understand how the Service is used, through analytics cookies set via Google Tag Manager, and only if you accept them in the cookie banner. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• To comply with legal obligations where the law requires it (Article 6(1)(c) GDPR).

We do not use your data for advertising, we do not build marketing profiles, and we do not sell personal data to anyone.

AI processing of your documents

When you import a bank statement or receipt, or use the guided setup chat, the relevant content (the document text or image and your chat messages) is sent to OpenAI, our AI provider, to extract structured data or generate a response.

This happens through OpenAI's business API. Under OpenAI's API terms, data sent this way is not used to train their models, and is retained by OpenAI for a short period only for abuse monitoring before deletion.

The extracted results are shown to you as drafts and stored in your account like any other record you create.

We may switch to a different AI provider, or add another one, if it serves the Service better. Any provider we use processes your documents as a processor on our behalf, under safeguards equivalent to those described here, and we will update this policy to name the current provider before the change takes effect.

Who we share data with

We use a small number of service providers (processors) to run SavingStat:

• DigitalOcean: hosting of the Service and storage of the files you upload.
• Supabase: hosting of the Service's database, where your account data and financial records are stored.
• OpenAI: reading imported documents and powering the setup chat, as described above.
• MailerSend: delivery of account emails.
• Google: sign-in, if you choose to sign in with Google, and analytics through Google Tag Manager, only if you accept analytics cookies.

Beyond these providers: people you invite see the data that the sharing features show them, and we may disclose data if the law obliges us to. There are no other recipients.

International transfers

Some of our providers process data outside the European Economic Area. In particular, OpenAI and Google process data in the United States. Where that happens, the transfer is protected by an adequacy decision such as the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

How long we keep your data

We keep your data for as long as your account exists. When you delete your account, or a record inside it, the data is removed from the live Service, and residual copies disappear as routine backups rotate out.

Server logs are kept only as long as needed for security and debugging, then deleted.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• restrict or object to processing based on legitimate interests;
• receive a copy of the data you provided in a portable format.

To exercise any of these rights, email support@savingstat.com. We will respond within one month.

If you believe we handle your data unlawfully, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the supervisory authority of the country where you live.

Cookies

Essential cookies. The Service always sets cookies that are strictly necessary to run it: session cookies that keep you signed in (set as HttpOnly, so scripts cannot read them), a cookie that remembers your language preference, and a cookie that remembers your cookie choice itself. These need no consent, because the Service cannot work without them.

Analytics cookies. If you accept them in the cookie banner, the Service loads Google Tag Manager, which sets cookies that help us understand how the app is used. If you decline, nothing is loaded and the Service works exactly the same. Legal basis: your consent (Article 6(1)(a) GDPR).

You can change your choice at any time through the "Cookie settings" link in the footer. Withdrawing consent stops analytics from that moment on; it does not affect what was collected while consent was in place.

There are no advertising cookies and no cookies from advertising networks.

Security

Connections to the Service are encrypted with TLS. Passwords are stored only as hashes. Access to production systems is restricted to the Operator. No system is perfectly secure, but if a breach ever affects your personal data, we will inform you and the supervisory authority as the GDPR requires.

Children

The Service is not directed at children under 16, and you may not create an account if you are younger than that. We do not knowingly collect data from children under 16.

Changes to this policy

If we change how we handle personal data, we will update this policy and, for meaningful changes, notify you by email or inside the Service before the change takes effect. The date of the latest version is shown at the top of this page.

Contact

Questions about privacy: support@savingstat.com.