PRIVACY POLICY

SUMMARY OF KEY POINTS

• Information and sources. We process account and financial information you provide, information from authentication and financial services you choose to connect, selected files and voice input, and usage and diagnostic information. See what we collect.
• Cloud and AI processing. Financial records can be stored locally and synced to Supabase. Our servers and processors can read the information needed to provide the Services. AI features use third parties, including OpenAI and OpenRouter; this is not an end-to-end encrypted service. See service providers and AI processing.
• Your choices. You can choose whether to connect a supported bank or Apple Wallet, submit files, or use voice entry. Device permissions control relevant access. You can review and edit financial records, export transactions, and request account deletion in the app or contact support. See your rights and choices.
• Retention. Retention depends on the type of information, the feature, operational needs, and legal requirements. Deletion can involve sync records, processor systems, and backups. See retention.
• Sale and advertising. We do not sell personal information or share it for cross-context behavioural advertising. We do disclose information to providers that operate the Services, as described below.

1. WHAT INFORMATION DO WE COLLECT?

Account, financial, and support information

• Account information: email address, name, account identifier, authentication information, and profile and app preferences. Supabase provides account authentication, including password and recovery flows.
• Financial records: transactions, amounts, currencies, dates, merchants, descriptions, categories, budgets, tags, account references and balances, recurring payments, import-source records, duplicate-resolution information, and derived reports or insights.
• Files you select: bank statements, spreadsheets, CSV files, PDFs, receipt photos or other supported documents, their contents, file names and technical metadata, and extracted financial records. Some imports are parsed on your device; online extraction uploads selected files for server processing. Original files can contain personal details beyond the transactions you intend to import.
• Voice input: audio you record for voice entry, transcripts, and context used to turn speech into editable transaction drafts. Relevant context can include language, time zone, categories, and account references. See AI processing.
• Support and requests: messages, feedback, bug reports, waitlist details, and information you choose to send when seeking help or exercising privacy rights.

Financial records, account login information, and some document or voice contents can be sensitive personal information under applicable law. We process this information to provide the features you use, with consent where required or another applicable legal basis.

Information from services you choose to use

• Apple and Google sign-in: account identifiers, email address, name, and authentication tokens needed to sign you in. See sign-in details.
• Connected banks: if you connect a supported bank through Plaid, we receive connection identifiers and tokens, institution and account details, balances, transactions, and recurring-payment information available through that connection. Availability depends on your institution, country, account, and access permissions.
• Apple Wallet: if you grant FinanceKit access and confirm access for your BudgetGo account, the app imports supported account, balance, and transaction information from accounts you select. Imported financial records can sync to our cloud services and be used for categories and insights.
• Bank SMS and Apple Shortcuts: automations you set up can deliver selected bank-alert messages or transaction details to the app. SMS parsing occurs on your device. Raw SMS text is not included in the resulting transaction description or remote transaction sync payload. Derived details, such as amount, merchant, date, currency, and an account suffix, can be saved and synced as financial records. Pending automation inputs may be queued locally before processing.
• Subscriptions: Apple or another supported app store and RevenueCat provide purchase, transaction, entitlement, trial, renewal, and subscription-status information associated with app or account identifiers. Store payments are handled by the store; BudgetGo does not collect your full payment-card details through its subscription purchase flow.

Usage, diagnostics, and device information

We and our service providers process IP addresses, device and operating-system information, app version, timestamps, feature and screen interactions, performance information, errors, and service logs. Analytics and diagnostics can be associated with account or device identifiers. PostHog also receives account identifiers and, where provided, email address and name for analytics and feature availability. Current import analytics exclude filenames, file contents, audio, transcripts, account details, and exception messages. These limits apply to analytics events; processing an import or AI request requires the relevant content described above. Analytics can still identify an account and should not be treated as anonymous.

Production diagnostics exclude screenshots and session replay recordings. Diagnostics may still include identifiers, error and performance details, request metadata, and view hierarchy information. Diagnostic and AI traces are discussed in section 4.

We do not request GPS or continuous device-location access for the described features. Service providers may infer an approximate location from an IP address. Biometric unlock uses your device's authentication system; BudgetGo does not receive your fingerprint or Face ID template. Motion used for privacy gestures stays on your device.

If you enable notifications, we process a push token, account identifier, platform, token activity, and last-seen information to deliver messages and manage token registration.

Website storage and external services

Our website stores your selected language in browser local storage. Hosting providers process requests and technical information needed to deliver and protect the site. External resources, such as fonts where used, can cause requests to their providers. Support forms can prepare an email draft; information is sent when you send that email. Waitlist forms may submit the details you enter to a configured service or prepare an email request. Linked Google Forms and third-party websites process information under their own notices. You can clear website storage through your browser settings.

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process information to create and authenticate accounts; store and sync financial records; import and reconcile transactions; suggest categories; produce reports, forecasts, and personalised insights; transcribe voice input; administer subscriptions; deliver notifications; answer support and privacy requests; and operate, secure, troubleshoot, and improve the Services. Analytics also helps us understand feature use and manage feature availability. We process information to comply with law, enforce our terms, and protect rights, security, and safety.

AI suggestions and financial inferences may be inaccurate or incomplete. You can review and correct your records. The features described here do not make lending, credit, insurance, or other decisions that produce legal or similarly significant effects about you.

3. WHAT LEGAL BASES DO WE RELY ON?

We process personal information only when we have an applicable legal basis. If you are in the EU or UK, the GDPR or UK GDPR requires us to explain those bases:

• Performance of a contract: processing needed to provide the Services you request and manage your account.
• Consent: processing for a specific purpose where consent is required. You may withdraw consent as described in section 10.
• Legitimate interests: where permitted, operating, securing, troubleshooting, and understanding use of the Services, subject to your interests and rights.
• Legal obligations: compliance with applicable law, lawful requests, and the exercise or defence of legal claims.
• Vital interests: where necessary to protect a person's vital interests, such as in a potential threat to safety.

If you are in Canada, we may process information with express consent, or implied consent where permitted. You can withdraw consent. In exceptional circumstances, applicable law may permit processing without consent, including:

• Where collection is clearly in your interests and consent cannot be obtained in time; investigations and fraud prevention; and business transactions where the required conditions are met.
• Information in a witness statement needed for an insurance claim; identifying injured, ill, or deceased persons and communicating with next of kin; or reasonable grounds to suspect financial abuse.
• Where seeking consent would compromise the availability or accuracy of information reasonably needed to investigate an agreement breach or contravention of Canadian law.
• Compliance with a subpoena, warrant, court order, or court rules; employment or professional information used consistently with the purpose for which it was produced; solely journalistic, artistic, or literary purposes; or publicly available information specified by regulation.

4. WHEN AND WITH WHOM DO WE SHARE INFORMATION?

We disclose information to service providers that help deliver the features and operations described in this notice. Providers receive the information needed for their role; the providers involved depend on the feature used.

• Hosting, accounts, and storage: Supabase provides authentication, cloud financial-record storage and sync, and file storage. Railway hosts backend and AI-engine services and related infrastructure. The AI engine also uses PostgreSQL storage for AI context, messages, memory, and traces. Netlify hosts our website. These systems process data in server-readable form.
• AI and transcription: OpenAI processes voice transcription and supported AI or receipt-analysis requests. OpenRouter routes model requests to model providers, including OpenAI models. Categorisation, financial analysis, document extraction, and presentation requests may include the relevant financial content and context. See section 5.
• Document processing and execution: online extraction uploads selected files to our infrastructure and can use E2B for temporary document parsing and extraction workspaces. OCR and receipt processing can also use AWS Textract or OpenAI, depending on the processing path. Document content and extracted text may be processed by these services and the AI providers described above. Do not assume uploaded files have been anonymised before processing.
• Analytics, diagnostics, and AI tracing: PostHog processes usage analytics, identity properties, and feature flags. Sentry processes app and backend errors and performance diagnostics. Langfuse and AI-engine storage process AI request and tool traces, inputs or outputs where captured, timing, model usage and cost information, and session or account-related context. Filtering reduces some exposure but does not guarantee removal of all personal or financial information. Production diagnostics exclude screenshots and session replay recordings.
• Financial connections: Plaid processes connection and financial-data requests when you link or refresh a supported bank. Apple provides Wallet access through FinanceKit and account sign-in where selected; Google provides sign-in where selected.
• Subscriptions: RevenueCat and the relevant app store process identifiers, purchases, entitlements, and subscription information to manage access and restore purchases.
• Notifications: Firebase Cloud Messaging and Apple Push Notification service process delivery tokens and notification content. Notifications can include reminders or short summaries of available insights.
• Supporting services: merchant-domain and logo requests can involve Brandfetch and Cloudflare R2 caching; exchange-rate services provide currency data. Support and waitlist requests can involve email providers, Google Forms, or Google Sheets, depending on the channel used.

We may also disclose information where required by law, to protect rights or safety, or in connection with a merger, financing, asset sale, or acquisition. We do not sell personal information or share it for cross-context behavioural advertising. Disclosures to operational providers are distinct from those activities.

Providers and infrastructure may process information outside your country. The locations and transfer arrangements depend on the provider and service involved. Contact us for information about the arrangements applicable to your data. Accepting our Terms or continuing to use BudgetGo is not blanket explicit consent to international transfers.

5. HOW DO OUR AI FEATURES PROCESS INFORMATION?

BudgetGo uses AI to help categorise transactions, transcribe voice entry, extract financial records from selected documents, analyse spending, maintain relevant context, and generate insights and their presentation. Depending on the feature, inputs can include audio, transcripts, document content or images, merchant and transaction descriptions, amounts, dates, currencies, account references, category names, budgets, relevant financial history, and your instructions or corrections. AI services return transcripts, suggested records or categories, analyses, and presentation content.

Voice entry sends audio to our servers and transcription providers, including OpenAI and requests routed through OpenRouter, and uses the transcript and relevant context for AI-assisted transaction drafts. On-device captions may be used while a connection is established, but voice entry is not an entirely on-device feature. Review before saving controls which drafts become financial records; it does not mean processing waits until you save.

For online document extraction, selected files are uploaded to our infrastructure. Processing can include OCR, parsing in temporary E2B workspaces, and extraction using OpenAI or model providers reached through OpenRouter. Credential and sensitive-data filters help reduce exposure in some processing and diagnostic paths. They can miss details, and not every file format or AI feature follows the same filtering path. We do not promise that all AI inputs are anonymised or free of sensitive information.

Categories and insights may use relevant stored financial records, including records derived from connected banks, Wallet, SMS, or imports. Some analysis runs automatically as records change. AI context, messages, remembered topics, outputs, and tracing information can be stored separately from your financial-record database to support continuity, avoid repeated insights, and diagnose failures. Removing a visible financial record does not necessarily remove every related trace or backup immediately.

Generated insight presentations may use HTML displayed within the app. This does not make the underlying analysis local: relevant evidence can be processed by AI services before presentation.

You can choose not to use voice or online file extraction and can contact support@budgetgo.ai about AI processing or an objection or withdrawal request. Avoiding those features does not by itself stop categorisation or insights based on saved records. We will explain available options and any effect on the Services when handling your request. Permissions and legal rights are described in section 10.

6. HOW DO WE HANDLE APPLE AND GOOGLE SIGN-IN?

If you choose Sign in with Apple or Google, we receive the identity and authentication information needed to establish your BudgetGo account, including an identifier, email address, and name where supplied. Apple may provide a relay email address. Authentication tokens are passed to Supabase to complete sign-in. We use these details for account authentication and management and as otherwise described in this notice. This does not grant BudgetGo general access to your contacts, friends list, email contents, or social posts.

Apple and Google process information under their own privacy notices. You can manage their permissions through their account or device controls.

7. HOW LONG DO WE KEEP INFORMATION?

We retain information for as long as needed for the purposes described in this notice, considering the feature, your account and requests, the sensitivity of the data, security and troubleshooting needs, and applicable legal, accounting, or dispute requirements.

• Financial and account records: records are retained to provide account access, sync, history, reports, and insights. Some deletions use deletion markers or source and reconciliation records so that devices can sync correctly and avoid restoring deleted items.
• Uploaded originals and extraction workspaces: uploaded import files expire 24 hours after their import batch is created and are scheduled for automated deletion. Failed cleanup attempts are retried, so expiry does not guarantee that every copy is erased at exactly 24 hours. Temporary execution workspaces have their own lifecycle. File cleanup is separate from retention of saved transactions, extracted records, job metadata, and related diagnostics.
• Voice and AI context: transient audio sessions and unsaved drafts have a different lifecycle from saved transactions, transcripts or other content captured in AI context, remembered topics, messages, and traces. Stored AI context and traces are retained according to their operational purpose, separately from transient sessions.
• Operational and purchase information: analytics, errors, security logs, support records, and purchase or subscription records may be retained for their operational purpose or applicable obligations, including in provider systems.

When information is no longer needed, we delete or anonymise it, subject to applicable retention requirements. Deletion is not necessarily immediate across all systems. Backup copies may remain until their retention cycle ends; where immediate deletion is not possible, we restrict further use except for necessary recovery, security, or legal purposes. See section 15 for deletion requests.

8. HOW DO WE PROTECT INFORMATION?

We use technical and organisational measures such as authenticated access, account-scoped permissions, secure transport, and limited service credentials to protect information. Some data and credentials are stored on your device; other data is processed and stored by our servers and service providers. Biometric unlock and amount-hiding controls protect access or visibility on your device, rather than preventing authorised server processing.

BudgetGo does not provide end-to-end encryption of synced financial information. Redaction and diagnostic filtering reduce some exposure but cannot guarantee that all sensitive content is removed. No internet transmission or storage system is completely secure, and we cannot guarantee protection against every unauthorised access or loss.

9. DO WE COLLECT INFORMATION FROM MINORS?

BudgetGo is available only to users who are at least 18 years of age. By using the Services, you represent that you are at least 18. Users under 18 may not use the Services, even with permission from a parent or guardian.

We do not knowingly collect or solicit personal information from, or market to, anyone under 18. If we learn that we have collected personal information from someone under 18, we will deactivate the account and take reasonable measures to promptly delete that information from our records.

If you believe we have collected personal information from someone under 18, contact support@budgetgo.ai.

10. WHAT ARE YOUR PRIVACY RIGHTS AND CHOICES?

Depending on your residence, including the EEA, UK, Switzerland, Canada, and US states listed below, you may have rights to access and obtain a copy of your information, correct it, request erasure, restrict processing, obtain portability, object to processing, or exercise rights relating to automated decisions. Rights may be subject to lawful limits. If a decision with legal or similarly significant effects is made solely by automated means, applicable rights may include information about the main factors and human review. We will consider requests under applicable data protection law.

If you are in the EEA or UK, you may complain to your Member State data protection authority or the UK data protection authority. In Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Consent, permissions, and feature choices

Where we rely on consent, you may withdraw it by contacting us. Withdrawal does not affect earlier lawful processing or processing based on another lawful ground. Device and provider controls let you manage microphone, photo, Wallet, sign-in, and notification permissions where available. You can stop an automation you configured in Apple Shortcuts. These controls do not erase previously saved records or stop every cloud or AI use of those records. Contact us about processing you want stopped; we will explain available controls and any feature limitations.

Notification preferences and device settings control optional alerts. Notifications may be visible on your lock screen according to your device settings. You can unsubscribe from marketing emails through an unsubscribe link where provided or by contacting support; necessary account and service messages may continue.

Account information

You can review and edit supported account and financial information in the app, export transaction records, and use the in-app account deletion option. You can also contact support to request access, correction, restriction, objection, or deletion covering information beyond those in-app controls. See section 15.

11. WHAT ABOUT DO-NOT-TRACK CONTROLS?

Some browsers and devices provide a Do-Not-Track signal. There is no uniform standard for responding to that signal, and our Services do not currently respond to it. This does not limit rights you may have under applicable law. We do not sell personal information or share it for cross-context behavioural advertising.

12. DO US RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights to access details about your information and processing, correct inaccuracies, obtain a copy, request deletion, or withdraw consent. Rights depend on the applicable law and may have limits.

Categories of information

The following categories describe information processed through the Services, including through providers, depending on the features you use. Examples are specific to BudgetGo; they do not mean every example is collected from every user. Sources are described in section 1, purposes in section 2, recipients in section 4, and retention criteria in section 7.

On smaller screens, scroll the table horizontally to read every column.

We process sensitive personal information for the described Services and other purposes permitted by applicable law, with consent where required. You may have a right to limit its use or disclosure. We disclose information for operational purposes to providers described in section 4. We do not sell personal information or share it for cross-context behavioural advertising.

Your rights

• Know whether we process your information; access it; correct inaccuracies; request deletion; obtain a copy; and receive non-discriminatory treatment for exercising your rights.
• Opt out of targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects, where applicable. The Services described here do not use information for those activities.
• Access categories of personal data being processed, where applicable, including under Minnesota law.
• Obtain a list of categories of third parties receiving personal data, where applicable, including under California, Delaware, and Maryland law.
• Obtain a list of specific third parties receiving personal data, where applicable, including under Minnesota and Oregon law.
• Obtain a list of third parties to which personal data has been sold, where applicable, including under Connecticut law.
• Review, understand, question, and correct profiling where applicable, including under Connecticut and Minnesota law.
• Limit use and disclosure of sensitive personal information where applicable, including under California law.
• Opt out of collection of sensitive data and personal data collected through voice or facial recognition where applicable, including under Florida law.

Requests, verification, and appeals

Use the request channels below. You may designate an authorised agent where permitted. We may need proof of authority and must verify your identity before fulfilling a request. Information requested for verification will be used to verify your identity or authority, including necessary security and fraud prevention. If existing information is insufficient, we may request additional details.

If we decline a request, you may appeal by emailing support@budgetgo.ai. We will explain the action taken and our reasons in writing as required by applicable law. If an appeal is denied, you may complain to your state attorney general.

California Shine the Light: California Civil Code section 1798.83 permits California residents, once a year and without charge, to request information about any disclosures to third parties for their direct marketing purposes in the preceding calendar year. Submit a written request using our contact details.

13. HOW DO WE UPDATE THIS NOTICE?

We may update this notice as the Services or applicable requirements change. The date above identifies the latest revision. For material changes, we may provide a prominent notice or contact you directly, and will provide any notice or obtain any consent required by applicable law.

14. HOW CAN YOU CONTACT US?

Email support@budgetgo.ai or write to:

15. HOW CAN YOU ACCESS, UPDATE, EXPORT, OR DELETE DATA?

Use supported app controls to review or edit records, export transactions as CSV, Excel, or PDF, or request account deletion. Exports are generated on your device and shared to the destination you choose. Transaction exports do not necessarily include all information held in authentication, analytics, AI-context, diagnostic, purchase, or support systems.

For access, correction, deletion, withdrawal, objection, or other rights requests, email support@budgetgo.ai, write to the address above, or use our privacy request form. We will consider and act on requests under applicable law, subject to identity verification and lawful exceptions.

Account deletion starts removal of account and associated data. After a successful deletion response, the app removes user-owned records and connection credentials stored on that device and signs out. This does not promise immediate removal from every processor, sync record, backup, or other device. Some information may remain for the retention purposes in section 7. Removing the app or disconnecting a source does not itself delete previously imported records.

Subscriptions are separate: deleting your BudgetGo account or app does not itself cancel a subscription. Manage or cancel it through the store that bills you. Store purchase records and obligations can outlast an app account.