Privacy policy

1. Controller

Controller: [TO COMPLETE: name or company name of the controller] ([TO COMPLETE: individual, sole trader or company]), [TO COMPLETE: controller's address]. Email for any privacy request: [TO COMPLETE: email for privacy requests]. [TO COMPLETE if applicable: VAT number / tax code]

[TO CHECK: has a DPO been appointed? If so, add their contact details; if not, remove this sentence]

2. What data we process and where it comes from

Account data you give us: email, name, password (stored only as a bcrypt hash, never in clear text), language and theme. If you sign in with Google or Facebook we receive the account ID, name, email and profile picture from the provider. Optional: a profile photo (we re-encode it into a smaller image) and two-step verification (the secret is stored encrypted, recovery codes only as hashes).

Data you enter to use the app: income and salary, categories and budgets, expenses with notes, savings goals, household and split rules, trips (including names of people without an account that you add), shopping list. If you invite someone, you give us their email.

Statement import: CSV, Excel, Word and text PDFs are read in your browser; only the transactions you confirm reach the server. Photos and scanned PDFs are read in the browser with Tesseract; only if the controller enables external text-recognition services is the single page sent to Google Cloud Vision or Microsoft Azure to extract the text.

Support requests: the name, email, topic and message you write in the form.

Technical data: your IP address and request data are processed by the servers hosting the app; the IP (together with the email on sign-in attempts) is also used for anti-abuse limits, stored only as an encrypted hash and deleted the day after the limit expires. For security emails about new sign-ins we store a random device identifier (only as a hash) and the browser and system type (for example "Chrome on Android"), never the IP. If you turn on notifications we store the delivery address your browser gives us. We store your cookie choice (see section 9).

Technical errors: when something goes wrong, the error-monitoring service receives the technical details of the error (page, browser, code location), configured not to send personal data such as IP, cookies or form contents.

3. Why we process data and on which legal basis

a) Providing the app you asked for: account, budgets, expenses, household, trips, shopping list, import, notifications you turn on, service emails (password reset, invites). Basis: performance of a contract, Art. 6(1)(b) GDPR.

b) Security of the app and of accounts: attempt limits, anti-spam checks on forms, emails about sign-ins from new devices, two-step verification, error monitoring. Basis: legitimate interest in protecting the service and users, Art. 6(1)(f) (Recital 49).

c) Answering support requests. Basis: contract or steps at your request (Art. 6(1)(b)) and, for people without an account, legitimate interest in replying (Art. 6(1)(f)).

d) Advertising (Google AdSense), only for people using the app for free and only if you consent in the banner. Basis: consent, Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code. You can withdraw it at any time with no effect on how you use the app.

e) Demonstrating cookie consent and complying with legal obligations. Basis: legal obligation, Art. 6(1)(c) (Art. 7(1) GDPR).

f) Establishing, exercising or defending legal claims. Basis: legitimate interest, Art. 6(1)(f).

[TO CHECK with a professional: the legal bases above, especially b, c and f.]

4. Whether you must provide data

Email and password (or a Google or Facebook account) are needed to create an account: without them you can't use the app. Budget data is the substance of the service: enter only what you want. Profile photo, two-step verification, notifications, import and advertising consent are optional.

5. Automated decisions and profiling

The app automatically calculates suggestions for you (proposed category for an expense, end-of-month forecasts, how much to set aside): they have no legal effect and are not decisions under Art. 22 GDPR. We do not profile users for marketing. If you consent to advertising, Google may use cookies and device data to select and measure ads under its own rules.

6. Who receives the data

Providers processing data on our behalf (processors, Art. 28): Vercel Inc. (app hosting); Neon (PostgreSQL database, EU region); Brevo (email delivery, France); Functional Software Inc. – Sentry (error monitoring, data in the EU); if enabled: Google Cloud Vision or Microsoft Azure (reading text in photos), Cloudflare Turnstile (anti-spam check).

Independent controllers: Google and Meta, when you choose to sign in with their account; PayPal, if you donate from the Support page (payment happens on its website); Google Ireland Ltd. for advertising, if you consent [TO CHECK: Google's role under the AdSense terms accepted]. Notifications go through your browser's push service (for example Google, Mozilla or Apple).

Other people: your household partner sees the Home data you share; trip participants see that trip's expenses and balances. Expenses in personal categories are not visible to your partner.

We do not sell personal data.

7. Transfers outside the European Economic Area

Some providers are based in the United States (Vercel, Sentry, Google, Meta, Microsoft, Cloudflare) even when data is hosted in Europe. For each, the transfer relies on [TO CHECK for each provider: EU-US Data Privacy Framework certification and/or the European Commission's standard contractual clauses].

8. How long we keep data

For as long as you have an account. If you delete it from Settings, your data is deleted immediately from the app database, with these exceptions: trips you created pass to another participant with an account (they are theirs too); your partner's expenses in Home categories stay with them; cookie-consent records remain without any link to you; support requests sent while signed in are deleted. Copies in database backups and provider logs: [TO DECIDE: how long data remains in backups and logs after deletion]

Support requests without an account: [TO DECIDE: retention period]. Cookie-consent records: [TO DECIDE: retention period]. Anti-abuse counters: deleted the day after they expire.

9. Cookies and similar tools

We use necessary technical tools (sign-in, security, language, preferences you choose) and, only with your consent, Google AdSense advertising cookies. Details are in the Cookie Policy; you can change your choice at any time from "Cookie preferences" at the bottom of the pages and in Settings. Each choice is recorded on our server with a random ID, the categories chosen, the date and the policy version, without the IP.

10. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Arts. 15-22 GDPR); you can withdraw consent at any time. The app already offers: editing your data, full export (CSV and JSON) and account deletion in Settings. For anything else write to [TO COMPLETE: email for privacy requests]: we reply within one month (Art. 12(3)).

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the country where you live or work.

11. Security

Encrypted connections (HTTPS), passwords never stored in clear text, optional two-step verification, app lock with Face ID or fingerprint (on the device), data access limited to its owner, no screen recording (no Session Replay). In case of a data breach we follow Arts. 33 and 34 GDPR.

12. Minors

WeBudget is meant for adults. [TO CHECK: minimum age and how to handle it, Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code.]

13. Changes

If we change this policy substantially we will tell you in the app or by email before the changes apply. The revision date is at the top of the page.