Privacy notice

Who operates it

The household that owns the bank accounts it reads. For data protection matters, contact the address registered with the application in the Enable Banking control panel.

What data is processed

When a member of the household authorises one of their own bank accounts, the following is retrieved through Enable Banking's Account Information Service:

• account identifiers (IBAN, account name, product, currency)
• account balances
• transaction history: dates, amounts, currency, counterparty names and accounts, payment descriptions and bank transaction codes

Whose data it is

Only the household's own accounts. The application is registered in restricted mode, which limits it to accounts explicitly linked to it. It cannot read anyone else's accounts.

Transaction data unavoidably includes the names of counterparties the household has transacted with. That data is not used to contact, profile or evaluate those counterparties. It is not shared, sold, published or transferred to any third party.

Where it is stored

In a PostgreSQL database hosted by Neon in Frankfurt, Germany (EU), reachable only by the application, which is hosted by Vercel and protected by Google sign-in restricted to the two household members. A copy is kept on the household's own computer as a backup. There are no analytics and no telemetry.

Legal basis and purpose

The household processes its own financial data for personal and household purposes: reviewing spending and planning a budget. Under Article 2(2)(c) GDPR, purely personal or household processing falls outside the Regulation's scope; this notice is published for transparency regardless.

Data sharing

None beyond the providers needed to run the application. Data flows from the bank, through Enable Banking Oy as the licensed account information service provider (supervised by the Finnish Financial Supervisory Authority), to the application's database, and stops there. Enable Banking's handling is governed by its own terms at https://auth.enablebanking.com/terms. Vercel Inc. and Neon Inc. host the application and its database as processors under their standard data processing terms.

Retention

The household keeps the data as long as it is useful and deletes it by removing the database. Bank access itself expires automatically when the PSD2 consent lapses unless renewed.

Access, correction and erasure

The household holds the data and can inspect, export or delete it directly. Consent to access the accounts can be withdrawn at any time in the bank's own online banking, which immediately stops any further retrieval.

Payments

The application requests account information only. It has no payment initiation capability and cannot move money.