Privacy policy

1. Who the data controller is

The controller is Daniele Roccaforte, an individual, who runs BuddyBudget free of charge. Address: via Lancia 62, 10141 Torino (TO), Italia.

For any privacy request, write to privacy@buddybudget.io. No data protection officer (DPO) has been appointed: it is not required at the current scale of processing. There is no certified email (PEC) address.

2. What data we process

• Account data: name, email address, currency and the preferences you choose. If you sign in with Google, also your profile photo.
• Financial data you enter or import: accounts, balances, transactions (with description, notes, counterparty and, when the imported file has it, the category your bank wrote), categories, budgets, investments, debts, pension funds and net worth. Descriptions may reveal habits, purchases or personal circumstances: we never ask you to enter data about health, opinions or other special categories, but they may appear in transaction texts.
• Bank data: if you already have an account connected through Open Banking (no new ones can be connected today), we receive through GoCardless the accounts and transactions you authorize. We neither see nor store your bank login details.
• Files you upload to import: bank and broker statements (for example CSV files or broker exports). If you choose the AI import, the file is kept encrypted only while it is processed (see the dedicated section).
• Category suggestions: if you turn on the AI assistant, for each merchant we keep the normalized name, the suggested category and whether you confirmed or changed it (never amounts or dates), together with the date of your consent.
• Searches in «Cerca» (Search): the text you type is used to search your data and to answer questions about your money, and is neither kept nor written to the logs. If you tap «Chiedi all'AI» (Ask the AI), the model's answer (the suggested form or the question it recognised, never a figure) stays in a temporary store so the same sentence is not asked twice (see the dedicated section).
• Messages to support: if you write from the Help page, we receive the text, the email address of the account and, unless you remove it, technical context (page, app version, screen size and theme, browser type).
• Technical sign-in data: date, shortened IP address (the last part is set to zero) and device type of your sessions, visible in Settings, to protect the account.
• Acceptance record: the date and version of the Terms and of this policy that you accepted.
• Pseudonymized technical logs: app events and errors, linked to you only by a code that contains no email, name, amounts or descriptions.
• Anonymous usage statistics: pages viewed and actions taken (for example "transaction added"), without amounts or any text of yours.

3. Why we process it and on what legal basis

For each purpose we state the legal basis under article 6 of the GDPR.

• To provide the service (account, accounts, transactions, investments, debts, pension, import, sync of the bank connections already active, data export): performance of the contract, art. 6.1.b.
• To send you service emails (sign-in links, bank connection expiry warnings, import results, deactivation confirmations): performance of the contract, art. 6.1.b. These emails can't be turned off because they are needed to use the account.
• To send you, only if you turn them on in Settings → Notifications, the periodic summary (with the income, spending and budget figures you already see in the app) and alerts on budgets and upcoming instalments: your consent, art. 6.1.a. They are off until you choose them, every email has a link to turn it off in one click (without signing in) and you can change your mind at any time. We send no promotional emails and no personalized advice.
• To analyse an unrecognized import file with artificial intelligence: your explicit consent, art. 6.1.a, which you give before uploading the file and can withhold by using the other import types or manual entry. Consent is not a condition for using the rest of the service.
• The AI assistant: suggesting a category for new transactions with an artificial intelligence service (and, if you choose, applying the most certain suggestions by themselves) and, when you tap «Chiedi all'AI» (Ask the AI) in «Cerca» (Search), reading the sentence you typed: your explicit consent, art. 6.1.a, which you give in Settings (or during onboarding) and can withdraw at any time. Consent is not a condition for using the rest of the service: you can categorize by hand or with rules, and search or fill in forms without AI.
• To answer messages sent from the Help page: performance of the contract, art. 6.1.b, for requests about your account; legitimate interest, art. 6.1.f, for general ideas and reports.
• Security, abuse prevention, error diagnosis and service continuity (sessions, logs, backups): legitimate interest, art. 6.1.f, balanced by logs being pseudonymized and short-lived.
• Learning which features are used to improve the product, with anonymous statistics: legitimate interest, art. 6.1.f. You can turn them off at any time (see the cookie page).
• Keeping proof of your acceptance of the Terms and of this policy: legitimate interest, art. 6.1.f, in being able to show it.
• Complying with legal obligations, if and when they apply: art. 6.1.c.

4. Bank connection (Open Banking)

Trade Republic is a direct connection separate from Open Banking, requested by you to perform the service (art. 6.1.b). BuddyBudget's form sends your phone number and PIN to Trade Republic for sign-in; we do not retain them. You approve in the Trade Republic app or with your authenticator. We store the encrypted session on the server, a hash of the account identity, balances and transactions. This private session is not a PSD2 consent restricted to reading: our code uses it only to read data. Disconnecting the account or deleting your BuddyBudget account removes it; you can also revoke the session at Trade Republic. Unfinished sign-in sessions expire after three minutes.

No new banks can be connected through Open Banking today: people who already have a connection keep it and renew it as before. The connection goes through GoCardless Bank Account Data, an account information service provider authorized under the PSD2 directive. You authorize access directly with your bank; the authorization lasts at most 90 days, after which it must be renewed, and you can revoke it at any time.

The consent you give your bank and GoCardless is separate from this policy. If you delete the account or reset your data, we revoke the active connections at GoCardless. We may also remove expired or unused connections from GoCardless.

If you press «Tienimi aggiornato» (Keep me posted) we save the request with your account and the country you chose, and we send you a single email when the connection is available again: this is based on your consent, art. 6.1.a. You withdraw it with «Non avvisarmi più» (Stop notifying me) in the same place in the app; the request is also deleted with the account.

5. Import with artificial intelligence

If you upload a CSV in a format BuddyBudget doesn't know, you can ask for it to be analysed by an artificial intelligence model that writes the rules for reading the file. You are asked for explicit consent before it is sent.

The model receives the full text of the file and the name of the source you entered, even if it contains personal data about you or others (for example counterparty names in descriptions). The service used is OpenRouter, which routes the request to a model provider. We require that the provider keeps no data after the answer (zero data retention) and doesn't use it to train models; if no provider meets these conditions, the analysis doesn't start.

The file is stored encrypted on our servers and deleted when processing ends. The preview of the result stays encrypted for 7 days, or until you save it. The reading rules generated for your format remain until you delete the account or reset your data. The rules run on our servers, in an isolated environment, without network access.

The rules are generated and checked automatically, not by a person: always check that the imported transactions match your statement. You can delete an import at any time from Investimenti (Investments) → Operazioni (Transactions) → Gestisci importazioni (Manage imports).

6. Category suggestions with artificial intelligence

If you turn it on in Settings → AI assistant (it is off until you choose it), for new transactions from syncs and imports we send an artificial intelligence model the cleaned-up merchant name, the direction (income or expense) and the list of your categories, with a few examples of your past choices and the personal instructions you choose to enter in Settings. Avoid putting personal or bank data in the instructions. We don't send amounts, dates, IBANs, notes, full transaction descriptions, transfers or names that look like a person's.

The service is OpenRouter, in the zero data retention mode described in the next section. The model suggests a category with a degree of confidence. If in Settings you leave on the option «Lascia che l'app scelga quando è abbastanza sicura» (Let the app choose when it is fairly sure), suggestions at least 70% certain apply without asking you: you find them in Categorizza (Categorize) → «Messe dall'app» (Set by the app), marked as coming from artificial intelligence, and you can change them at any time. The other suggestions wait for your confirmation, and a choice becomes a rule only if you ask for it. You can turn off automatic application or withdraw consent at any time: from then on no new requests go out and suggestions already received no longer apply by themselves.

7. Sentences and questions in «Cerca» (Search) with artificial intelligence

In «Cerca» (Search) you can type a sentence such as “paid 12 € at the café yesterday” or a question such as “how much did I spend on Netflix in 2026?”: rules running in your browser read it, without artificial intelligence. The sentence opens the form already filled in; the question is answered by our server, which computes the figure on your data. Only if the rules cannot read it and you tap «Chiedi all'AI» (Ask the AI), with the AI assistant on, is the sentence sent to an artificial intelligence model through OpenRouter, in the zero data retention mode described in the next section.

We send the model only the sentence you typed (160 characters at most), today's date and the app language: no other data from your account, no transactions, balances or amounts. For a question the model only says what it is about (for example “expenses, Netflix, 2026”): our server computes the figure on your data and it is never sent to the model. Avoid writing in it data about other people that isn't needed. The answer to a sentence fills in a form that you check and save: the model records nothing by itself.

The model's answer (the suggested form or the question it recognised, never the figure) stays for 24 hours in a temporary store, tied to your account and to a fingerprint of the sentence (not the sentence in clear), so the same sentence is not asked again. To prevent abuse there are limits on the number of questions per person and per day. The text of searches and sentences doesn't end up in the technical logs.

8. Zero data retention for artificial intelligence

Every artificial intelligence request (importing a file, category suggestions, «Chiedi all'AI» (Ask the AI) on a transaction or in «Cerca» (Search)) goes through OpenRouter in zero data retention mode: OpenRouter sends it only to model providers that keep no data after the answer and don't use it to train models. If no provider meets these conditions, the request is rejected and doesn't go out.

The condition is enforced twice: it is written into every request our servers send and it is turned on in our OpenRouter account settings for all models, so it holds even if one of the two were missing. OpenRouter doesn't keep the text of requests and answers; it keeps technical usage data (model, amount of text processed, cost).

What it doesn't cover: the mode concerns the providers OpenRouter passes the request to, not what we keep. On our side, as described in the sections above, we keep the result (the file's reading rules, the suggested category, for 24 hours the form suggested or the question recognised in «Cerca» (Search)) and technical logs without the content of the requests, for 30 days. We don't use additional OpenRouter tools such as web search.

This applies to the service at buddybudget.io. Whoever installs BuddyBudget on their own servers uses their own OpenRouter key: requests still ask for zero data retention, but the account settings are those of whoever installs it.

9. Who we share data with

We don't sell your data and don't use it for advertising. We share it only with the providers needed to run the service, appointed as processors or, where they act as independent controllers, identified as such. The price, exchange rate and instrument logo services are queried by our servers with only symbols, ISIN codes or security names, never with data that identifies you. For merchant logos, the logo service (Logo.dev) receives from our servers only a brand's website (written in the transactions or known to us) or, for names that appear in several users' transactions, the merchant name: never transfers, amounts or who made the transaction. We may disclose data to authorities when the law requires it. The providers are:

• Hostinger: server (VPS) in Germany, where the app and the database run.
• Cloudflare: traffic routing, DNS and storage (R2) of the database backups.
• GoCardless: reading the bank accounts already connected (no new ones can be connected today), under PSD2.
• Resend: sending service emails and, if you turn them on, summaries and alerts (it uses your email address and the text of the emails, which may contain figures from your budget), and delivering the messages you write to support.
• OpenRouter and the model provider it selects, always in zero data retention mode: only if you use the AI import or the AI assistant (category suggestions, «Chiedi all'AI» (Ask the AI)), with your consent (see the dedicated sections).
• Google: only if you choose to sign in with Google; it acts as an independent controller for authentication.
• Monitoring, technical alerting and anonymous statistics tools (Umami), which we run on our own servers and which receive no financial data or content of yours.

10. Transfers outside the European Economic Area

Cloudflare, Google, Resend and OpenRouter (with the model provider) are companies that may also process data outside the EEA (for example in the United States). In these cases the transfer relies on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.

11. How long we keep data

• Account data and financial data: as long as the account exists.
• Deactivation: if you deactivate the account you have 30 days to change your mind, then the data is permanently deleted. You can also delete everything right away from Settings.
• Inactivity: if you don't sign in for 90 days the account is deleted with all its data. We write to the account's address 7 days before: one sign-in, even just one, cancels the deletion.
• Backups: deleted data stays in backups for at most 14 days, then disappears with rotation.
• Sessions: they expire after 7 days without use and expired sessions are deleted. Sign-in links are valid for 10 minutes.
• AI import: the file is deleted when processing ends, the preview after at most 7 days, the reading rules when the account is deleted.
• Category suggestions: as long as the account exists or until you reset your data; withdrawing consent stops new requests.
• «Chiedi all'AI» (Ask the AI) in «Cerca» (Search): the suggested form or the recognised question for 24 hours; the sentence is not kept.
• Technical logs: 30 days.
• Messages to support: in the controller's mailbox, for the time needed to answer and in any case no longer than 12 months after the request is closed. Deleting the account doesn't delete them automatically: you can ask for them to be deleted by writing to privacy@buddybudget.io.
• Summary and alert emails: the preferences as long as the account exists; the log of sent emails (only technical keys to avoid repeating the same alert, without amounts) 90 days.
• Record of acceptance of the Terms: as long as the account exists.
• Anonymous usage statistics: they are not personal data, so they have no expiry tied to your account.

12. Your rights

You have the right to access your data, correct it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (arts. 15-22 GDPR). Where processing is based on consent (the AI import and the AI assistant) you can withdraw it at any time, without affecting processing already carried out.

• Access and portability: in Settings you download a ZIP archive with all your data in JSON and CSV.
• Erasure: in Settings you can deactivate or delete the account and erase all data.
• Correction, restriction, objection and any other request: write to privacy@buddybudget.io (in Settings → Privacy you'll find ready-made messages). We answer within one month, extendable by two in complex cases, as provided by art. 12 GDPR.
• Complaint: you can contact the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

13. If you don't provide data

Account data (email) is needed to create the account and sign you in; without it we can't provide the service. You enter all other data yourself: if you don't, the features that need it can't be used.

14. Automated decisions

BuddyBudget makes no decisions that produce legal effects on you. Transaction categorization uses rules you can see and change, your past choices, the category your bank wrote in the files you import and, if you turn it on, suggestions from an artificial intelligence model. The bank's category, when it clearly matches one of yours, applies by itself (without artificial intelligence); if you choose, the most certain suggestions apply by themselves too: they only concern the label of your transactions, are always marked as applied automatically and you can correct them at any time. Tax estimates, projections and simulations are informational tools, not decisions about you.

15. How we protect data

Encrypted connections, limited and protected administrative access, a fresh sign-in check before sensitive actions (export, reset, deletion), logs without personal data in clear text, encrypted import files and backups on a service that encrypts them at rest. If an incident exposed your data in a way that puts you at risk, we would notify the Garante and you within the time limits of articles 33 and 34 of the GDPR.

16. Minors

The service is for people aged 18 or over. If we find that an account belongs to a minor, we delete it.

17. Changes to this policy

The version in force is the one of 2026-10-26. If it changes substantially, we tell you in the app before the change applies.