Privacy notice

This policy explains which personal data [Company legal name] processes when you use Depense, why, and the rights you have. We collect only what we need, never sell personal data and never use your documents to train AI models.

1. Who is responsible

For your account and our relationship with you, [Company legal name] is the data controller.

For the records a business or household keeps in its workspace, the workspace owner decides what is recorded and who sees it; we process those records on its behalf, following its instructions.

2. What we collect

Depending on how you use the service:

• Account data: name, email address, password (stored only as a secure hash), language and security settings.

• Workspace data: expenses, receipts, invoices, budgets, projects, comments and the people invited, as entered by you or your workspace.

• Technical data: sign-in times, device and browser information and security logs, used to protect accounts and investigate misuse.

• Billing data for paid plans: plan, invoices and payment status. Card details are handled by the payment provider, not by us.

3. Why we use it

• To provide the service you asked for (performance of our contract with you).

• To keep the service secure, prevent fraud and keep an audit history of sensitive actions (our legitimate interest, and legal obligations where they apply).

• To send service emails: confirmations, invitations, security alerts and billing notices. We send marketing only if you agree, and you can stop it at any time.

• To meet legal obligations, for example keeping invoices for the period required by law.

4. Automatic document reading

When you use automatic reading, the document is sent to an AI provider to extract fields such as supplier, date and amounts. Providers process it on our behalf under contract, may keep it briefly for safety monitoring, and do not use it to train their models under the terms we use.

Extracted values are suggestions until a person confirms them. No decision with legal effect is taken automatically about you.

5. Who receives your data

People in your workspaces see what their role allows. We do not sell personal data. We use service providers (subprocessors) bound by contract and confidentiality:

• hosting and storage: [hosting provider and region];

• email delivery: [email provider];

• automatic document reading: Google (Gemini) and OpenAI, when the feature is used;

• payments: Stripe, for paid plans.

6. International transfers

Some providers may process data outside your country. Where the law requires it, we rely on adequacy decisions or standard contractual clauses and additional safeguards.

7. How long we keep it

Account data is kept while your account is open. When you close it, we anonymise your profile at once; records you created in shared workspaces stay with their owner, under the name "Closed account". Workspaces you alone used are deleted after a recovery period of [30] days.

Security logs are kept for [12] months. Invoices and accounting records are kept for the period required by applicable law.

8. Security

Data is encrypted in transit, passwords are hashed, access is limited by role inside each workspace, files are served through short-lived private links and sensitive actions are recorded in an audit history. You can turn on two-step verification on your account.

9. Your rights

Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict some processing, and withdraw consent. Many of these you can do yourself from your profile. For anything else, write to us; we answer within one month.

You may also complain to your data-protection authority. In the European Union, this is the authority of your country of residence.

10. Children

The service is not designed for children. A minor may only use it under the responsibility of a parent or guardian, who must not enable automatic document reading for them where provider terms do not allow it.

11. Changes and contact

We will tell you about important changes to this policy before they apply.

Contact: [Privacy email] · [Company legal name], [Registered address].