Privacy Policy
This Privacy Policy explains how Wallymanager collects, uses, and protects your personal information.
1. Who processes your personal data
The controller of personal data is „Уолимениджър“ ЕООД / „Wallymanager“ LTD, UIC: 208882840, with its registered seat and management address at: 1A Skopie Street, floor 4, apt. 16, Yuzhen district, Plovdiv 4003, Republic of Bulgaria, represented by its manager Mihail Merkov, email: office@wallymanager.com. Contact point for matters relating to the protection of personal data: Mihail Merkov, email: support@wallymanager.com. As at the date of this revision the company has not appointed a data protection officer; if one is appointed, their details will be stated here. This Policy explains what personal data we process, for what purposes, on what legal basis, to whom we disclose it, how long we store it and what rights you have.
2. What categories of data we process
| Category | Examples |
|---|---|
| Account data | name, email address, account identifier, profile picture/avatar, language, settings, registration date, account status |
| Google sign-in data | name, email, unique identifier, profile picture, technical authentication data |
| Financial data | transactions, balances, expense/income categories, budgets, savings goals, notes, virtual wallets, shared wallets, manually entered or imported financial records |
| Receipts and images | receipt image, merchant, date, items, values, currency, tax information, extracted text data, manually entered corrections |
| AI requests and results | data sent to the AI provider after the AI functionality has been activated, including financial records, receipts, categories, requests, results and corrections |
| Subscription and payment data | selected plan, payment date, subscription status, payment identifier, invoicing data, refund data; for purchases made through the website/web application, the full payment card data is processed by Stripe; for in-app purchases made through the mobile application, the payment method is held and processed directly by Apple or Google, and neither the Provider nor Stripe receives or processes that card data |
| Technical and security data | IP address, device, browser, session identifiers, logs, tokens, reCAPTCHA data, errors and observability data in Elastic Stack |
| Communication and support | content of messages, requests, replies, attachments, communication history, where stored in the email/communication system |
| Consents and preferences | consents for cookies, AI features and marketing, privacy settings, withdrawals of consent, consent history |
As a rule, financial data does not constitute a special category of personal data within the meaning of the GDPR. It is possible, however, for an uploaded receipt or text to reveal sensitive information, for example about medication, medical services, or religious or political organisations. The User should avoid uploading unnecessary sensitive information. Where such information is uploaded voluntarily by the User, it is processed only to the extent necessary for the requested feature and subject to additional restrictions. Where consent has been given for the “Analytics” and/or “Marketing” category, we also process the following data: a client identifier generated by Google Analytics; the _fbp and _fbc identifiers from Meta; screens visited in the application; traffic source (UTM parameters); the “registration”, “trial started” and “purchase completed” events; an email address hashed by SHA-256 and transmitted to the Meta Conversions API for matching.
3. Sources of data
We process personal data from the following sources: directly from you, when you register, enter financial records, upload receipts, communicate with us or change settings; from external providers, where you choose to sign in via Google or to connect a financial account through an open-banking provider; from a payment provider when you pay for a subscription; automatically from your device, your browser and your interaction with the Service, including logs and security events.
4. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases, including analytics of usage and measurement of advertising performance (cookie identifiers, IP address, device, browser, screens visited, traffic source, registration, trial and purchase events, an email address hashed for the Meta Conversions API — on the basis of consent):
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing an account | account data, email, identifier, settings | performance of a contract; steps prior to a contract |
| Personal finance features | financial records, categories, budgets, goals, receipts | performance of a contract |
| AI features | financial records, receipts, requests, results of analysis | consent/express activation for optional AI features; performance of a contract for a requested paid feature |
| Subscriptions, payments and invoicing | plan, payment, invoice and accounting data | performance of a contract; legal obligation |
| Support and communication | email, messages, requests, support history | performance of a contract; legitimate interest |
| Security and prevention of abuse | logs, IP addresses, devices, tokens, reCAPTCHA, Elastic Stack logs | legitimate interest; legal obligation |
| Marketing messages | email, preferences, consents | consent |
| Compliance with legal obligations and defence against claims | contractual, accounting and payment data, logs, communication | legal obligation; legitimate interest in the protection of rights |
5. Is providing data mandatory
Providing data for registration and for basic financial records is necessary in order to use the corresponding features of the Service. If you do not provide this data, the corresponding feature may not be available. The use of the AI features, the receipt of marketing and the optional cookies/similar technologies are optional, unless a specific paid plan defines a given feature as core and this is clearly stated before the purchase.
6. Recipients and processors
Personal data may be disclosed only where this is necessary, lawful and proportionate. The main categories of recipients and providers as at the date of this revision are: principal cloud provider, servers, databases and infrastructure: DigitalOcean, Germany region; provider of the wallymanager.com domain: Network Solutions; provider of payment services and subscriptions for purchases made through the Wallymanager website/web application: Stripe; for in-app purchases made through the Wallymanager mobile application, the payment for that transaction is processed directly by Apple Distribution International Limited (for App Store purchases) or by Google Commerce Limited (for Google Play purchases), each of which determines the purposes and means of that processing independently of the Provider and acts as an independent controller of the payment data for that transaction, applying its own privacy policy; the Provider does not receive and does not process the User's payment card or payment method data for such in-app purchases; provider of artificial-intelligence features: Eden AI through a European endpoint, subject to the applicable contract/DPA and confirmed settings for data residency/data retention; Google Identity Services and Google reCAPTCHA, where used for sign-in and protection against abuse; provider of email, notifications, support and customer communication: Mailgun; observability, logs, metrics, errors and security: Elastic Stack on Google Cloud in the Germany region; provider of analytics for the website and the application: Google Ireland Limited (Google Analytics 4) — data is transmitted only where consent has been given for the “Analytics” category; provider of advertising-measurement technologies: Meta Platforms Ireland Limited (Meta Pixel and Meta Conversions API) — data is transmitted only where consent has been given for the “Marketing” category; the email address is transmitted only in an irreversibly hashed form (SHA-256); accountants, legal advisers, auditors, banks, insurers and other professional advisers where necessary; competent state authorities, courts and regulators, where this is required by law or is necessary for the protection of rights. Where a third party processes data on behalf of the Provider, a data processing agreement must be in place with that party. Where a third party independently determines the purposes and the means of the processing, it may act as an independent controller and apply its own privacy rules.
7. International transfers
The principal cloud infrastructure of Wallymanager is configured in the Germany region through DigitalOcean. Elastic Stack is deployed on Google Cloud in the Germany region. AI processing is carried out through Eden AI with a European endpoint, in so far as this is confirmed in the contract and the documentation of the provider. As at the date of this revision, the Service is organised so that the principal storage and processing takes place within the EU/EEA. Nevertheless, some providers form part of international groups or may use sub-processors/support outside the EEA. Where there is access or a transfer outside the EEA, it is permitted only where a valid mechanism under the GDPR is in place, for example an adequacy decision, standard contractual clauses, additional technical and organisational measures or another ground provided for in the GDPR. Where consent has been given for analytics or marketing technologies, personal data is transmitted to Google Ireland Limited and/or Meta Platforms Ireland Limited. These companies form part of groups headquartered in the USA and transfer data to the USA. The transfer is carried out on the basis of the European Commission's adequacy decision under the EU-US Data Privacy Framework, or, where that is not applicable, on the basis of standard contractual clauses. Where consent is withdrawn, the transmission of new data ceases.
8. Retention periods
We retain personal data for the following periods:
| Category | Period/criterion |
|---|---|
| Account data | while the account is active; upon deletion — erasure or anonymisation without undue delay, unless a longer period is required by law or for the protection of rights |
| Financial records, receipts, avatars, custom categories and other user data | while the account is active or until the User deletes them; upon express deletion of the account, the individual content is erased or anonymised without undue delay, with the exception of data in a shared wallet that is necessary for the integrity of the wallet and the rights of the other participants; the receipt images are automatically deleted from the database and from the file storage 12 months after the date of upload, irrespective of the status of the account |
| Payment and invoice data | for the periods applicable to accounting and tax documents, usually up to 10 years where the law so requires |
| Security and observability logs | usually up to 12 months, except in the event of an incident, a dispute or a statutory requirement; the logs should be limited to what is necessary |
| Support requests | not stored as a separate database in the application; they pass through the technical infrastructure and/or Mailgun and are stored according to the retention period of the mailbox/communication system: 12 months |
| Consents and withdrawals | while the account is active and for a reasonable period after withdrawal/closure for the purpose of demonstrating compliance: 12 months after the withdrawal of consent or the closure of the account |
| Backups | daily backups valid for up to 30 days, after which they are overwritten or deleted in accordance with the backup policy |
9. Your rights
Under the conditions of the GDPR you have the right of access, rectification, erasure, restriction of processing, portability, objection to processing on the basis of legitimate interest, withdrawal of consent and the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you. You can exercise your rights by email: support@wallymanager.com. We may request additional information in order to confirm your identity where this is necessary. As a rule we reply within one month, and that period may be extended by up to two further months in the case of complex or numerous requests. You have the right to lodge a complaint with the Commission for Personal Data Protection or with a competent court if you consider that your rights have been infringed.
10. Automated processing and profiling
Wallymanager may use automated means to categorise transactions, extract data from receipts, calculate budgets, visualise trends and provide informational suggestions. These results do not constitute decisions with legal effects or with a similarly significant effect for the User. The User can review, edit and ignore them. Where consent has been given for the “Marketing” category, data on actions you take in the application is transmitted to Meta Platforms Ireland Limited and may be used by that provider for advertising profiling, including forming audiences of persons with similar characteristics. This profiling does not produce legal effects for you and does not similarly significantly affect you. You may stop it at any time by withdrawing consent for that category.
11. Security
We apply technical and organisational measures according to the risk, including access control, restriction of access according to role, encryption in transit, protection of sessions, backups, security logs, vendor management, training/instructions for persons with access and incident procedures. The specific measures are to be described in the internal rules and in the data processing agreements.
12. Children
The Service is not intended for persons under the age of 16. If we establish that an account has been created by a person under the age of 16 without the required consent, we may restrict or delete the account, unless the law permits a different outcome.
13. Cookies and similar technologies
The use of cookies, local storage, identifiers and similar technologies is described in the Cookie Policy. Technologies that are not strictly necessary are activated only where valid consent is in place, where such consent is required.
14. Changes to this Policy
We may update this Policy in the event of changes to the Service, the providers, the legal framework or the manner of processing. In the event of material changes we will notify you through the application, by email or through another appropriate channel.
15. Contact
„Уолимениджър“ ЕООД / „Wallymanager“ LTD, UIC: 208882840, address: 1A Skopie Street, floor 4, apt. 16, Yuzhen district, Plovdiv 4003, Republic of Bulgaria, email: office@wallymanager.com, contact point for the protection of personal data: support@wallymanager.com.
For any privacy-related inquiries, please contact our data-protection contact point at support@wallymanager.com.