Privacy Policy

1. Introduction

This policy explains what information we collect, how we use it, and how we keep it safe. When we say "we" or "us," we mean Budget Spotlight.

By using Budget Spotlight, you agree to this policy.

2. Information We Collect

2.1 Account Information

2.2 Financial Information

2.3 Security Information

2.4 Automatically Collected Information

2.5 Subscription Information (Premium Users)

Note: Payment card details are processed and stored by Stripe. We never see or store your full card number.

3. How We Use Your Information

3.1 We Use Your Information To:

• Provide the service - Store and display your financial data, calculate budgets
• Secure your account - Authenticate logins, detect suspicious activity, enforce MFA
• Enable collaboration - Allow household members to share budgets
• Communicate with you - Password resets, security alerts, account notifications
• Process payments - Manage Premium subscriptions via Stripe
• Comply with law - Maintain audit logs for legal and regulatory requirements
• Improve the service - Analyze aggregated, anonymized usage patterns

3.2 We Never Use Your Information To:

• ❌ Sell your data - We do not sell personal information to third parties
• ❌ Show targeted ads - We do not display advertising
• ❌ Share with data brokers - Your financial data stays private
• ❌ Profile you for marketing - No behavioral tracking for marketing purposes

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data under these legal bases:

5. Data Sharing & Third Parties

5.1 Service Providers

We share data with these trusted service providers who help us operate Budget Spotlight:

These companies have signed agreements to protect your data and only use it as we direct.

5.2 Future Bank Integrations

When we launch automatic bank synchronization, we may integrate with:

• SimpleFIN / MX - Bank account transaction synchronization
• Plaid - Secure bank account linking via OAuth

Key protections for bank integrations:

• Your bank credentials are never stored on our servers
• Credentials go directly to the secure aggregation service
• You can disconnect any bank connection at any time
• Bank connections require re-authorization every 12 months

5.3 Household Members

When you join or create a household:

• Other household members can see shared financial data (accounts, transactions, budgets)
• Your email and name are visible to household members
• Household owners can manage member access and roles

Household roles and what they can see:

5.4 Legal Disclosures

We may disclose your information if required by:

• Valid legal process (subpoena, court order)
• Government request with proper legal authority
• To protect our rights, property, or safety
• To prevent fraud or illegal activity

We will notify you of legal requests unless prohibited by law.

6. Data Security

We implement industry-standard security measures to protect your information:

6.1 Technical Safeguards

6.2 Account Protection

6.3 Incident Response

We maintain documented incident response procedures as required by SOC 2 compliance.

If a data breach affects your personal information:

• For European residents (GDPR): We will notify you and authorities within 72 hours.
• For California residents (CCPA): We will notify you as quickly as possible.
• For all users: We will explain what data was affected and what steps you can take.

Found a security issue? Report it to security@budgetspotlightapp.com. We respond within 48 hours.

7. Your Privacy Rights

7.1 Rights for All Users

7.2 California Residents (CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect and why
• Delete your personal information
• Opt-out of sale - We do not sell personal information
• Non-discrimination - We will not discriminate against you for exercising your rights

Sensitive Personal Information: Your financial data (account balances, transactions, budgets) is considered sensitive under CCPA. We only use it to provide the budget management service. You can limit its use by deleting your account.

To exercise your rights: Use the in-app controls in Settings, or email privacy@budgetspotlightapp.com

7.3 European Residents (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access - Get a copy of your data
• Fix mistakes - Correct wrong information about you
• Delete - Ask us to delete your data
• Download - Export your data in JSON format to take elsewhere
• Say no - Stop us from using your data for certain purposes
• Limit use - Ask us to use your data less
• Withdraw consent - Take back your permission at any time

Data Protection Authority: You can complain to your local data protection authority if you're unhappy with how we handle your data.

To exercise your rights: Use the in-app controls in Settings, or email privacy@budgetspotlightapp.com

7.4 Automated Decision-Making

We do not currently use automated decision-making or profiling that produces legal or significant effects on you. If we add features like AI-based transaction categorization in the future, we will update this policy.

8. Data Retention

8.1 Retention Periods

8.2 Account Deletion

When you delete your account:

1. Email is anonymized (e.g., deleted-abc123@deleted.local)
2. Name and personal details are cleared
3. Avatar is removed
4. All active sessions are revoked
5. MFA backup codes are deleted
6. Audit logs are retained (anonymized, for compliance)
7. Financial data in shared households is preserved for other members but unlinked from your identity

Account deletion is permanent and cannot be undone.

9. Cookies & Local Storage

9.1 What We Use

9.2 What We Don't Use

• ❌ Analytics tracking cookies
• ❌ Advertising cookies
• ❌ Third-party tracking pixels
• ❌ Social media tracking

10. Children's Privacy

Budget Spotlight is intended for users 18 years of age or older.

We do not knowingly collect data from children under 18. If you believe a minor has shared information with us, email privacy@budgetspotlightapp.com. We will delete it promptly.

11. International Data Transfers

11.1 Data Location

Your data is stored on Supabase servers located in the United States.

11.2 International Users

If you are outside the United States:

• Your data will be transferred to and stored in the United States
• We use legal agreements approved by European regulators to protect your data
• By using Budget Spotlight, you consent to this transfer

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• Minor changes: Updated on this page with a new "Last Updated" date
• Material changes: Email notification to your registered email address

We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights:

For GDPR-related inquiries, you may also contact your local data protection authority.