Privacy Policy

1. Introduction

SpendSpace ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our personal finance management service. Please read this policy carefully. By using SpendSpace, you consent to the practices described in this Privacy Policy.

2. Information We Collect

We collect information you provide directly to us, as well as information collected automatically when you use our services.

Information You Provide:

• Account information (name, email address, password)
• Payment information (processed securely by Stripe; we do not store full payment card details)
• Financial transaction data you upload via CSV files
• Categories, budgets, and financial goals you create
• Communications you send to us

Information Collected Automatically:

• Device information (browser type, operating system)
• Log data (IP address, access times, pages viewed)
• Usage data (features used, interactions with the service)

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract Performance: To provide and maintain our services as agreed when you created your account
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Consent: For marketing communications (which you may withdraw at any time)
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your subscription payments through Stripe
• Send transactional emails (account verification, password resets, billing)
• Provide personalized financial insights and AI-powered analysis
• Respond to your comments, questions, and support requests
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

Service Providers:

We work with trusted third-party service providers who assist in operating our service:

• Stripe: Payment processing (PCI-DSS compliant)
• Firebase/Google Cloud: Authentication and infrastructure
• Railway: Application hosting

These providers are contractually obligated to protect your information and may only use it to provide services to us.

Legal Requirements:

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court order, government agency).

Business Transfers:

If SpendSpace is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

6. Data Security

We implement appropriate technical and organizational security measures to protect your information:

• All data is encrypted in transit using TLS 1.2+ (HTTPS)
• Data at rest is encrypted using AES-256 encryption
• Secure authentication via Firebase Authentication
• Regular security assessments and monitoring
• Access controls limiting employee access to personal data

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specifically:

• Account data: Retained until you delete your account
• Transaction data: Retained until you delete your account or remove specific data
• Payment records: Retained for 7 years for tax and legal compliance
• Log data: Retained for up to 90 days

Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

All Users:

• Access and update your personal information through your account settings
• Delete your account and associated data
• Export your data in a portable format
• Opt out of marketing communications

EEA Residents (GDPR):

• Right to access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

California Residents (CCPA):

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to say no to the sale of personal information (we do not sell your data)
• Right to request deletion of personal information
• Right to non-discrimination for exercising your rights

To exercise any of these rights, please contact us at support@spendspace.io.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential cookies: Required for authentication and security
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Understand how users interact with our service

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our service.

10. Children's Privacy

SpendSpace is not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

11. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (sent to the address associated with your account) and/or by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of SpendSpace after the effective date constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

SpendSpace
Email: support@spendspace.io
Website: https://spendspace.io

For data protection inquiries or to exercise your rights, please include "Privacy Request" in your subject line. We will respond to your request within 30 days.