Privacy Policy

Effective date: July 13, 2026

Last updated: August 24, 2026

1. Data Controller

The data controller is Rampa Studio sp. z o.o., ul. Uroczysko 7, 41-605 Świętochłowice, Poland, Tax ID: 6272794448. Contact: hey@digan.co.

2. Data We Collect

• Account data: email address, name (if provided), user identifier.
• OAuth login data: when signing in with Google or Apple, we only retrieve your email address and display name. We do not access your contacts, calendar, or other services.
• Financial data: transactions, budgets, savings goals, projects — entered manually by the user. Stored on Supabase servers and linked to the user account.
• Billing data: for paid plans — the customer and subscription identifiers issued by our payment processor, subscription status and billing period end date. We never collect or store payment card details.
• Push data: push subscription endpoint (if the user enables notifications).

We do not collect location data and do not use financial data for advertising profiles. On the public landing page, the Meta pixel may measure campaign performance only after consent.

3. Purpose of Processing

We process data solely for:

• Providing the service — syncing data across devices
• User authentication and authorization
• Sending push notifications and emails (if enabled)
• Sharing data with other users (only if explicitly enabled by the user)
• Measuring advertising performance on the public landing page, only after consent

4. Sign in with Apple

When signing in with Apple, we only retrieve your email address (which you may hide using Apple Private Relay). We do not request access to any additional data from your Apple account. You can disconnect the app from your Apple ID at any time in Apple ID settings → Password & Security → Apps Using Apple ID.

5. Sign in with Google

When signing in with Google, we retrieve your email address and profile name. We do not access Google Drive, Gmail, contacts, or other Google services.

6. Data Storage and Security

Data is stored on Supabase servers (AWS infrastructure, EU region — Frankfurt). Connections are encrypted (TLS). Local data is stored in the browser's localStorage. We do not share data with third parties for marketing purposes.

7. Data Sharing

Data may only be shared with:

• Supabase Inc. — database hosting (data processor)
• Krajowy Integrator Płatności S.A. (Tpay) — payment processing; receives your email address and the data required to complete the transaction, acting as an independent controller of payment data
• Groq Inc. — extracting and structuring data from receipt images
• Google Cloud — fallback text recognition for receipt images through the Google Cloud Vision API
• Resend Inc. — transactional email delivery
• Meta Platforms Ireland Ltd. — advertising measurement on the public landing page, only after consent
• Digan Desk — customer support operated by the same data controller
• Other users — only when the user actively shares their data through the account sharing feature

8. Receipt Scanning

To extract receipt data, an image may be sent to the Groq API and, when needed, to the Google Cloud Vision API. Moje Saldo does not store the image in its database; the providers process it under their respective privacy policies and service terms. When external services are unavailable, the app may use a local OCR engine on the server.

9. Data Retention

Data is retained as long as the user account is active. After account deletion, all data is permanently removed from servers within 30 days. Billing records are retained for the period required by tax law (5 years from the end of the tax year). Local data (localStorage) can be cleared by the user at any time.

10. User Rights (GDPR)

Under GDPR you have the right to:

• Access your data (CSV/PDF export available in the app)
• Rectification of data
• Erasure of data (account deletion in settings)
• Restriction of processing
• Data portability
• Object to processing

To exercise these rights, contact: hey@digan.co.

11. Tracking and Advertising

The application itself does not display ads and financial data is not used for advertising. On the public landing page we may use the Meta pixel to measure campaign performance, but only after explicit consent. Refusing consent does not limit the website or application. Consent can be withdrawn through “Cookie settings” in the footer. We do not share data with data brokers.

12. Children

The app is not intended for persons under 16 years of age. We do not knowingly collect data from children.

13. Changes

We reserve the right to update this privacy policy. We will notify users of significant changes via the app and/or email.

← Back to Moje Saldo · Wersja polska