Privacy Policy

1. Introduction

Ntropy Space S.R.L., operating 27th ("we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our bill tracking application.

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data promptly.

2. Data Controller

The data controller responsible for the processing of your personal data is:

• Company: Ntropy Space S.R.L.
• CUI: RO44150743
• Address: Bd. 1 Decembrie 1918, 032463 Bucharest, Romania
• Email: [email protected]
• Contact: Administrator

3. Data We Collect

3.1 Account Information

• Email address (required for authentication)
• Full name (optional)
• Profile avatar (optional)

3.2 Financial Tracking Data

This data is entered manually by you for your own tracking purposes. We do not connect to banks, payment providers, or any external financial systems. We simply store what you choose to record:

• Bills: Names, amounts, due dates, and currencies you assign to track your recurring expenses
• Payment records: Amounts and dates you enter to mark bills as paid — these are your personal notes, not actual transaction data
• Wallets: Labels you create to organize bills (e.g., "Personal", "Business") — these are not real financial accounts or payment methods
• Categories: Custom tags you create for organization
• Service providers: Names and optional logos for companies you pay

3.3 User-Uploaded Files

You may optionally upload files to the Service:

• Payment invoices/receipts: PDF or image files you attach to payment records
• Provider logos: Custom images for service providers you create
• Wallet logos: Custom images for your payment methods
• Profile avatar: Your profile picture

For any personal data relating to third parties contained in uploaded files (such as invoices), you act as an independent data controller. We act solely as a data processor for such data and process it only to store and display the files at your request.

3.4 Subscription and Billing Data

When you subscribe to a paid plan, the following data is processed:

• Subscription status: Whether you are on a free trial, active subscription, or read-only state
• Plan type: Monthly or yearly subscription
• Billing dates: Trial start/end dates, subscription start date, next renewal date
• Transaction identifiers: Subscription and transaction IDs from Paddle for reconciliation

3.5 Application Data

• User preferences and settings: Display options, timezone, currency preferences, and notification settings you configure
• Activity history: A personal timeline of actions you performed in the app (e.g., "created a bill", "marked as paid") — this is your own history for your reference, not tracking data. We do not monitor or analyze this information.
• Notifications history: Records of reminders and alerts sent to you within the app
• Consent records: Timestamps and versions of the legal documents you accepted, and your marketing email preferences
• Processing restriction status: Whether your account is currently in a restricted state (e.g., pending acceptance of updated Terms) and the reason for the restriction

3.6 Security and Audit Data

For security, fraud prevention, and compliance purposes, we collect:

• IP addresses: Logged with each request to detect unauthorized access and investigate security incidents
• User agent (browser/device information): Helps identify the device and browser used for each request
• Request identifiers: Used to trace and debug issues

This data is stored in our audit trail for up to 2 years and is automatically deleted when you delete your account. We use this data solely for security purposes and never for tracking or advertising.

3.7 What We Do NOT Collect

To be clear about the boundaries of our service:

• Credit or debit card numbers: We do not collect or store any card details — all payment processing is handled by Paddle
• Bank account numbers or credentials: We never ask for or store your banking login details, account numbers, or routing information
• Billing address: Your billing address is collected and stored only by Paddle, not by us
• Real transaction data: We do not connect to banks, payment processors, or financial institutions. We cannot see your actual transactions.
• Precise location data: We do not request GPS coordinates or track your physical location
• Biometric data: We do not collect fingerprints, face scans, or any biometric identifiers
• Browsing history: We do not track what websites you visit or your activity outside of our app

4. How We Use Your Data

4.1 Purposes

We use your data solely to:

• Provide the bill tracking and management service
• Send you notifications about upcoming payments
• Display statistics and summaries about your spending for your own reference
• Manage your subscription and account status
• Maintain and improve the application

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4.2 Legal Bases for Processing

We process your personal data under the following legal bases as defined by the GDPR:

• Contract performance (Article 6(1)(b)) – to provide and operate the Service you requested, including managing your subscription
• Legitimate interests (Article 6(1)(f)) – to ensure security, prevent fraud, and maintain system reliability
• Consent (Article 6(1)(a)) – for optional features that are not essential to the core service, specifically:
  • Marketing emails: Product announcements, tips, and feature updates sent via email (you can opt out in Settings → Notifications at any time)

Where consent is used as the legal basis, you may withdraw it at any time through your account settings (Settings → Notifications). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. The core bill tracking service operates under contract performance and does not require separate consent.

5. Data Retention

• Activity logs: Retained based on your settings (30-365 days, default 90 days)
• Deleted items (trash): Retained based on your settings (7-90 days, default 30 days)
• Audit trail: Retained for up to 2 years for security and compliance purposes and deleted immediately upon account deletion, even if the maximum retention period has not been reached
• Subscription data: Retained for the duration of your account. Transaction identifiers may be retained for up to 5 years after account deletion for tax and legal compliance purposes, in anonymized form
• Account data: Retained until you delete your account
• Inactive accounts: Accounts in read-only state for more than 12 months may be scheduled for deletion. Before deletion, we will notify you by email and your account will enter a 30-day grace period during which you may cancel the deletion by logging in or resubscribing (see our Terms of Service, Section 4.2). After the grace period, all data is permanently deleted as described in Section 6.2

6. Your Rights (GDPR)

Under GDPR, you have the right to:

6.1 Right to Access

You can export all your data at any time from Settings → Export Data. This includes all bills, payments, activity logs, notifications, consent records, and your authentication provider profile (data held by Clerk on your behalf). You can also export all user-uploaded files (avatars, logos, and payment invoices) as a ZIP archive.

6.2 Right to Erasure (Right to be Forgotten)

You can delete your account from Settings → Delete Account. When you request deletion:

• Your account enters a 30-day grace period
• You can cancel the deletion at any time during this period
• After 30 days, ALL your data is permanently deleted
• This includes all bills, payments, settings, activity logs, audit trails, uploaded files, and your authentication account with Clerk
• Anonymized transaction identifiers required for tax compliance may be retained as described in Section 5

Important: Once your account is permanently deleted, we cannot investigate any historical issues as we no longer retain your data.

6.3 Right to Data Portability

Your data export is provided in JSON format, which is machine-readable and can be imported into other systems. User-uploaded files (avatars, logos, payment invoices) can be exported separately as a ZIP archive.

6.4 Right to Rectification

You can edit your personal information and all your financial data directly within the application.

6.5 Right to Restrict Processing

You have the right to request restriction of processing of your personal data under Article 18 GDPR. When processing is restricted:

• You can view all your existing data (bills, payments, settings)
• You can export your data (Settings → Export Data)
• You can delete your account (Settings → Delete Account)
• Data modifications (creating, editing, or deleting records) are temporarily blocked
• Scheduled notifications and automated processing are paused

Processing may be restricted automatically when updated Terms or Privacy Policy require your acceptance (see our Terms of Service, Section 18). In this case, the restriction is lifted immediately once you accept the updated documents.

To request processing restriction for other reasons under Article 18 GDPR, contact us at [email protected].

6.6 Right to Object

You have the right to object to the processing of your personal data where we rely on legitimate interests (Article 6(1)(f)) as our legal basis. This includes the security and audit data processing described in Section 3.6.

If you object, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims. Where we accept your objection, we will place your account in a restricted state as described in Section 6.5.

To exercise this right, contact us at [email protected].

6.7 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. If you are located in Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Website: https://www.dataprotection.ro

If you are located in another EU/EEA member state, you may also lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at edpb.europa.eu.

6.8 Data Subject Access Request (DSAR)

For detailed technical audit logs or any privacy-related inquiries, contact us at [email protected]. We will respond within 30 days as required by GDPR. If your request is particularly complex, we may extend this period by up to two additional months, in which case we will inform you of the extension and the reasons for the delay within the initial 30-day period.

Users located in the United States may exercise similar rights to access and delete personal data by contacting us using the details in Section 14.

7. Data Security

• Encryption in transit: All data is encrypted using HTTPS/TLS. Database connections use SSL-only PostgreSQL
• Encryption at rest: Database and file storage are encrypted at rest by our cloud providers:
  • Database: PostgreSQL hosted on Railway with storage-level encryption
  • File storage: Railway Object Storage (powered by AWS S3, EU Central) with AES-256 server-side encryption at rest
• Access control: Database access is protected by row-level security (RLS) — users can only access their own data. RLS is enforced at the PostgreSQL level, not just the application layer
• Authentication: Handled by Clerk (SOC 2 Type II certified) with industry-standard security practices
• Audit logging: All data changes are logged for security monitoring with automatic redaction of sensitive fields (emails, names, tokens) before storage
• Security headers: HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), and other protective headers are enforced on all responses
• Rate limiting: Per-user and per-IP rate limiting protects against abuse

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the supervisory authority (ANSPDCP) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• Notify affected users without undue delay via email if the breach is likely to result in a high risk to your rights and freedoms, as required by GDPR Article 34

The notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

Given the nature of our Service — a personal bill tracking tool that does not store financial credentials, bank account details, or payment card information — the risk profile of any potential breach is limited to the data categories described in Section 3.

9. Third-Party Services

We use the following third-party services to provide the Service:

9.1 Clerk (Authentication)

We use Clerk (clerk.com) to handle user authentication and account management. When you create an account or sign in:

• Your email address is processed by Clerk for authentication
• Your name and profile picture (if provided) are stored by Clerk
• Session tokens are managed by Clerk
• Password reset and email verification are handled by Clerk

If you sign in with a social provider (e.g., Google, GitHub), we receive your email, name, and profile picture from that provider through Clerk. We do not access your social account or any other data from that provider.

Clerk also sends transactional emails on our behalf for account-related communications, including email verification, password resets, and security notifications.

Clerk is SOC 2 Type II certified and GDPR compliant. For details, see Clerk's Privacy Policy and Data Processing Agreement.

9.2 Hosting and Infrastructure

• Railway: Cloud hosting provider where our application and database are hosted. Data is stored in EU West (Amsterdam, Netherlands). See Railway's Privacy Policy.
• Railway Object Storage: Used for file storage (avatars and uploaded files). Powered by AWS S3, data is stored in EU Central. See Railway's Privacy Policy.

9.3 Open Exchange Rates (Currency Data)

We use Open Exchange Rates (openexchangerates.org) to provide currency exchange rate data for multi-currency bill tracking.

• Exchange rate data is fetched server-side — your personal data (IP address, browser information) is not shared with Open Exchange Rates
• Only our server's IP address is visible to their service when fetching rates
• You may also manually enter custom exchange rates, bypassing this service entirely

For details, see Open Exchange Rates Privacy Policy.

9.4 Mailjet (Transactional Emails)

We use Mailjet (mailjet.com) to send application emails such as payment reminders, bill due date notifications, and monthly summaries. Authentication-related emails (verification, password resets) are sent by Clerk (see Section 9.1).

When we send you an email through Mailjet:

• Your email address is shared with Mailjet to deliver the message
• Email subject and content are processed by Mailjet
• Delivery status (sent, delivered, bounced) is logged
• We do not enable open tracking or click tracking

Mailjet is headquartered in France (EU) and is GDPR compliant. For details, see Mailjet's Privacy Policy.

9.5 Paddle (Payments)

We use Paddle (paddle.com) as our Merchant of Record to handle subscription billing and payments. Paddle.com Market Limited is registered in England and Wales (Company No. 8172165).

When you subscribe to a paid plan:

• Your email address is shared with Paddle to create your billing account
• Your payment method (credit card, PayPal, etc.) is collected and stored by Paddle — we never see or store these details
• Your billing address and VAT information (if applicable) are collected by Paddle for tax compliance
• Transaction history, invoices, and receipts are managed by Paddle

Paddle processes your payment data as an independent data controller for billing and tax purposes. We receive only your subscription status, plan type, and transaction identifiers from Paddle via webhooks — we use this data solely for product fulfillment, order processing, and product support, in accordance with Paddle's GDPR guidelines.

For details, see:

• Paddle's Privacy Policy
• Paddle's Checkout Buyer Terms

9.6 Data Processing Agreements

We have Data Processing Agreements (DPAs) with our key service providers as required by GDPR:

• Clerk DPA
• Railway Terms (includes DPA provisions)
• Mailjet DPA — Mailjet processes your email address to deliver transactional emails on our behalf
• Paddle DPA — Paddle processes buyer data for billing as described in Section 9.5. For data where we act as controller and Paddle as processor, the DPA applies under GDPR Module Two with EU Standard Contractual Clauses (SCCs)

Note on Open Exchange Rates: No personal user data is shared with Open Exchange Rates. Exchange rate data is fetched server-side, and only our server's IP address is visible to their service. As no personal data processing occurs, a DPA is not required for this provider.

These providers process data on our behalf and are contractually bound to protect your data.

10. International Data Transfers

Your primary data is stored in the European Union: database and application hosting in EU West (Amsterdam, Netherlands), and file storage in EU Central (Frankfurt, Germany). However, some data may be transferred outside the EEA through our authentication provider (Clerk, US) and our payment provider (Paddle, UK — which may use sub-processors outside the EEA).

When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Verification that providers maintain adequate security measures

In addition to contractual safeguards, we apply supplementary technical and organizational measures, including encryption and strict access controls, to protect personal data transferred outside the EEA.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. While the app helps you organize financial information, we are not a financial services provider — we do not assess creditworthiness, make lending decisions, or analyze your financial health. All features are based solely on data you manually enter for your own reference.

12. Cookies

We use strictly necessary cookies for authentication and session management. These cookies are essential for the Service to function and do not require user consent under applicable EU law. We do not use tracking cookies or third-party analytics.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service before the updated policy takes effect. You will be asked to review and accept the updated policy before continuing to use the Service. We will also update the "Version" and "Effective Date" at the top of this page.

Until you review and accept the updated Privacy Policy, your account is placed in a restricted state as described in Section 6.5 and our Terms of Service (Section 18).

If you do not agree with the updated Privacy Policy, you may access your account settings to export your data or delete your account without accepting. If you have an active paid subscription and choose not to accept the updated Privacy Policy, your subscription will be cancelled and you will receive a pro-rata refund for the unused portion of your current billing period, processed by Paddle. Previous versions of this Privacy Policy are available upon request by contacting [email protected].

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Company:
Ntropy Space S.R.L.
Bd. 1 Decembrie 1918, 032463 Bucharest, Romania

Data Protection Complaints:

• ANSPDCP (Romania): https://www.dataprotection.ro
• ANPC (Romania, consumer protection): https://anpc.ro
• EU Online Dispute Resolution: https://ec.europa.eu/consumers/odr