Privacy Policy

This Privacy Policy explains what data Budgeteer (the “Service”, “we”, “us”) collects when you use this website and the application, why we process it, whom we share it with and what rights you have. It applies to visitors of the website and to registered users.

The data controller is the operator of the Service. You can reach us at [email protected].

Budgeteer is a planning tool, not a financial account. It does not connect to banks, payment systems or tax authorities and does not import account statements, card transactions or any other financial records about you. The only figures in the Service are the ones you type in yourself — planning assumptions, not records of real transactions. We do not ask for identity documents, dates of birth or similar identity data.

What we hold about you is therefore limited to: your email address (and your name and profile picture link if you sign in with Google), what you enter into the Service, and the technical data needed to run it. We do not sell this data, we show no advertising, and we use no third-party analytics or advertising trackers.

Account. • Email address, password (stored only as a salted hash), interface language, date of registration, date of acceptance of the Terms and email verification status. • When you sign in with Google: your Google account identifier, email address and its verification status, name and profile picture link (section 4).

Budget content. Everything you enter into your budgets: items, amounts, formulas, accounts, liabilities, assets, goals, rules, comments and notes, scenarios, and the change history of each scenario (needed for undo and rollback). This may include personal financial information you choose to enter.

Assistant. Your conversations with the AI assistant; files you attach to the chat (spreadsheets, CSV, Word, PDF, images), their parsed content and the results of analyses; voice messages you record for voice input — the recording is sent for speech recognition and is not kept as a file, only the recognized text is placed into the input field.

Own model connection. If you connect your own model provider: the API address, the models you selected and your API key, stored encrypted (AES-256-GCM).

Billing. When you order a paid plan or AI credits: the billing details you enter (name or organization, address, country, tax identifier, billing email), orders, invoices, payments and refunds, and your AI usage (operations and their cost in credits).

Feedback. If you use the Feedback button: your message, an optional screenshot, the page address, the names of the open budget and scenario, interface language, browser and window size.

Technical and security data. The IP address of your requests; the time and type of sign-in events (successful and failed sign-ins, registration, password and email changes, rate-limit triggers) in a security log; server logs needed to run the Service; cookies (section 6). At sign-up, sign-in and the start of a plan trial we also record device signals: the device identifier and the browser fingerprint from the cookies in section 6, the IP address of the request and the browser’s User-Agent string. Device signals are not shared with third parties.

Product events. Events about how the account is used — for example registration, creation or deletion of a budget, viewing the Pricing page, orders and subscription changes — recorded for our own statistics.

Acquisition source. With your consent to cookies (section 6): the advertising tags (UTM) of the link you came from, the website that referred you, the first page you opened, and the time and language of the first visit. It is recorded once, when you register.

• To provide the Service — accounts, budgets, forecasts, the assistant, sharing links, exports, invoices and payments: performance of our contract with you (the Terms of Service). • To keep the Service secure and prevent abuse — sign-in security log, rate limits, backups, and device signals that let us recognize a repeat sign-up from the same device so that a plan trial is granted only once per device (a matching IP address alone does not deny you the trial): our legitimate interest in protecting the Service and its users. • To understand how the Service is used and where users come from — product events and the acquisition source: our legitimate interest in developing the Service; the acquisition cookie is set only with your consent. • To communicate with you — service emails about your account, billing documents and reminders, replies to your feedback: performance of the contract. We do not send marketing emails. • To comply with legal obligations, such as accounting and tax rules for invoices and payments.

If you choose to sign in with Google, Google asks for your permission and sends us basic profile information: your Google account identifier, email address and whether it is verified, your name and a link to your profile picture. We use this information only to create your account (or to match it to an existing account with the same email address) and to sign you in. We do not request access to any other Google data — such as Gmail, Drive, Calendar or Contacts — and we do not share Google user data with anyone except the hosting provider that stores our database.

Budgeteer’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Budgeteer’s access at any time in your Google account settings (“Third-party apps & services”).

We share data only with providers that help us run the Service, and only to the extent needed: • AI model provider — when you use the assistant, your messages, the relevant parts of the budget, the content of attached files and of web pages the assistant reads, and your voice recordings for speech recognition are sent to the provider of the language model. The provider processes requests under its own terms. • Web search provider — the search queries formulated by the assistant. • Hosting provider — stores our servers and databases. • Network protection service — website traffic passes through its servers to protect the Service from attacks; it processes IP addresses and request metadata. • Email delivery service — sends service emails on our behalf. • Google — when you sign in with Google, Google knows that you signed in to Budgeteer. • Seller and its bank — when you pay an invoice, your billing details appear on the invoice and in the seller’s accounting; payments are bank transfers, and we never receive your card details. • Your own model provider — if you connect your own model, your assistant requests go to the provider you chose instead of ours.

People you share with. A sharing link gives anyone who has it read-only access to the active scenario of the budget until the link expires or you delete it.

Service administrators. Our administrators can see account, billing and feedback data and the assistant log — the full text of requests to the model and its answers for the retention period in section 7 — to operate the Service, resolve incidents and answer your requests. They are bound by confidentiality.

Legal requirements. We may disclose data when the law requires it or to protect the rights and safety of users and the Service. If the Service is transferred to another operator, your data may be transferred with it; we will notify you in advance.

The website sets the following cookies: • budgeteer_session — necessary: keeps you signed in. With “Remember me” it lasts 30 days, otherwise until the browser session ends. • budgeteer_consent — necessary: keeps your choice in the cookie banner (Accept or Decline) for 12 months. • budgeteer_device — necessary: a random device identifier that the server sets on your first visit to the app; kept for 400 days. It protects the Service against repeat sign-ups (section 3). • budgeteer_fp — necessary: a browser fingerprint, that is, a SHA-256 hash (a one-way digest) of browser and device characteristics; kept for 365 days. It serves the same purpose as budgeteer_device. • budgeteer_ft — first touch: advertising tags (UTM), the site you came from, and the first page you opened, without its parameters; kept for 30 days. It helps us understand where users come from and is set only after you click Accept. • During sign-in with Google, short-lived technical cookies protect the sign-in flow and are removed when it finishes.

The app computes the budgeteer_fp fingerprint right in your browser from the browser string (user agent), platform, number of processor cores, memory size, screen size and color depth, pixel density, time zone, languages, touch support, the result of drawing text on a canvas, and the graphics card vendor and model. These characteristics are not sent anywhere: the cookie holds only their hash. The budgeteer_device and budgeteer_fp cookies are strictly necessary to protect the Service from abuse, so they are set without cookie consent and do not depend on your choice in the cookie banner.

You can change your cookie choice at any time via the Cookie settings link at the bottom of the website, sign-in and sign-up pages, or the Cookie settings item in the profile menu; choosing Decline deletes the first-touch cookie.

The browser’s local storage keeps interface preferences (for example the theme and the display currency on the Pricing page). It does not leave your browser.

We use no third-party analytics, advertising or tracking cookies.

• Account and budget content — while your account exists. • Assistant log — the full texts of requests and answers are deleted 90 days after the request; token counts and costs are kept for billing statistics. • Files attached to the chat — 30 days after upload. • Feedback — until the account is deleted. • Billing records (orders, invoices, payments) — for as long as accounting and tax law requires, also after the account is deleted. • Sign-in security log — for as long as needed for security auditing. • Device signals recorded at sign-up, sign-in and the start of a plan trial — one year (365 days), then deleted automatically. After your account is deleted, the device identifier and the browser fingerprint of its signals are kept until the end of the same year without the IP address and the browser string, so that the plan trial is not granted again on the same device. • Backups — daily database backups are kept for 14 days; data deleted from the Service disappears from backups within that period.

When your account is deleted, the data listed above is deleted or anonymized at once, except billing records that we must keep by law, backups until they expire and the device identifiers and browser fingerprints described above.

We protect data with encryption in transit (TLS), password hashing (argon2), encrypted storage of API keys, HttpOnly cookies, access control on every request, isolated containers for analysis programs and regular backups. Access to production systems is restricted to administrators. No method of transmission or storage is completely secure; if a breach affecting your data occurs, we will notify you as the law requires.

Depending on your jurisdiction, you have the right to access your data, to correct it, to delete it, to receive it in a portable form, to restrict or object to processing, to withdraw consent, and to complain to a supervisory authority.

In the Service you can change your email address and password, export budgets (CSV, XLSX), delete budgets, scenarios, files and conversations, revoke sharing links, change your cookie choice and disconnect your own model. You can delete your account with all its data yourself: in Settings, section Account, press “Delete account” and confirm the deletion by the link that we send to the account’s email address. If you write to [email protected] from the account’s email address instead, we delete the account with the same operation within 30 days. To exercise any other right, write to the same address; we answer within 30 days.

The Service is intended for adults. We do not knowingly collect data from persons under 18; if we learn that we have, we delete the account.

We may update this Policy as the Service changes. The current version with its date is always on this page. For material changes we will notify you by email or in the Service before they take effect.

Questions about privacy and requests regarding your data: [email protected].