Privacy Policy

1. Types of Data We Collect

Among the types of Personal Data that Figet.ai collects, by itself or through third parties, are:

• Identification and contact details: email address, User ID, profile name (obtained via Google OAuth verification or direct registration);
• Basic profile and demographic data: name / preferred salutation, gender, age bracket, profession/field of work, country, and preferred currency (used solely for interface personalization, providing, operating, and continuously improving the service and its features);
• Technical and operational data: IP address, browser fingerprint, browser information, device details, session metrics, user counts, Usage Data, and Trackers (cookies);
• Commercial and transaction data: purchase history, subscription tier and status (payment processing is executed directly by Paddle.com as Merchant of Record);
• Client-Side Encrypted data: sensitive financial records (budgets, envelopes, debts, cash flow) are encrypted locally on the User's device (AES-256-GCM) prior to cloud synchronization. The Controller has no access to unencrypted financial amounts and holds no decryption keys.

Unless specified otherwise, all Data requested by Figet.ai is required to provide the Service. Users are responsible for any third-party Personal Data obtained, published, or shared through Figet.ai.

2. Mode, Security & Place of Processing

Methods of processing: The Controller implements appropriate technical and organizational security measures (TLS/HTTPS encryption, client-side AES-256 cryptographic protection, strict access control) to prevent unauthorized access, disclosure, alteration, or destruction of Data. Processing is carried out using computers and IT systems strictly following stated purposes.

Place of processing & international transfers: Data is processed at the Controller's operating offices and on secure servers located in the European Union (Germany – Supabase/Google Cloud data centers) and authorized international locations. Transfers to third countries (e.g. USA) rely strictly on adequacy decisions (EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs).

Retention period: Personal Data is retained for the duration of the contractual relationship and active account status, for statutory archival requirements (tax and accounting laws), or until the User withdraws consent. Once periods expire, data is securely erased or anonymized.

3. Detailed Information on Third-Party Processors

Below is a detailed overview of the primary third-party processors and integrated services in Figet.ai:

• A. Analytics – Google Analytics 4 (GA4): Provider: Google Ireland Limited (EU) / Google LLC (USA). Processed data: user counts, session metrics, truncated anonymized IP address, Trackers, Usage Data. Purpose: Measuring website traffic and anonymous interactions without storing complete IP addresses. Users may opt out via the Google Opt-out browser add-on.
• B. Hosting & Backend Database – Supabase & Netlify: Providers: Supabase, Inc. (EU database in Frankfurt) & Netlify, Inc. (static hosting). Processed data: User ID, email address, encrypted application records, request logs, Usage Data. Purpose: Powering cloud infrastructure, encrypted data persistence, and secure web application delivery.
• C. Payment Processing – Paddle.com (Merchant of Record): Provider: Paddle Payments Ltd (UK) / Paddle.com Inc (USA). Processed data: email address, purchase history, User ID, billing details, Trackers. Purpose: Subscription payments, invoicing, and global tax compliance. The Controller does not process or hold credit card numbers.
• D. Authentication & Registration – Google OAuth: Provider: Google Ireland Limited / Google LLC. Processed data: email address, basic profile name, and Google account identifier for secure user verification.
• E. Bot Mitigation & Content Distribution – Cloudflare & Bunny CDN: Providers: Cloudflare, Inc. (Cloudflare Turnstile) & BunnyWay d.o.o. (Slovenia – Bunny CDN). Processed data: browser fingerprint, request headers, IP address, spam defense, and anti-DDoS telemetry.
• F. Error & Performance Monitoring – Sentry: Provider: Functional Software, Inc. (Sentry.io). Processed data: technical application error logs and diagnostic stack traces excluding sensitive financial data.

4. User Rights under GDPR (European Union & UK)

Users in the EU/UK enjoy enforceable statutory rights under the General Data Protection Regulation (GDPR):

• Right to access: confirm whether Data is being processed and obtain a copy;
• Right to rectification: rectify inaccurate or incomplete Data;
• Right to erasure ("right to be forgotten"): request permanent removal of Personal Data;
• Right to restrict processing: suspend active processing except for mere storage;
• Right to data portability: receive Data in a structured, commonly used, and machine-readable format (JSON/CSV);
• Right to object: object to processing based on legitimate interests or direct marketing;
• Right to withdraw consent: withdraw previously given consent at any time without penalty;
• Right to lodge a complaint: submit a complaint with a supervisory authority (e.g. Czech Office for Personal Data Protection, uoou.cz).

Requests can be exercised free of charge by contacting info@floxee.io; the Controller will respond promptly, at the latest within 1 month.

5. US State Privacy Rights (CCPA / CPRA & Other States)

This section applies to residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other US states:

• No Sale / No Sharing: Figet.ai does NOT sell or share personal information with third parties for monetary or valuable consideration;
• Right to Know, Correct, and Delete: US consumers may request category disclosures, access, correction, and erasure of collected data;
• Non-Discrimination: Exercising privacy rights will not result in discrimination or degraded service quality;
• Global Privacy Control (GPC): We fully honor browser-based Global Privacy Control signals.

6. Switzerland (FADP) and Brazil (LGPD)

Switzerland: Data processing complies with the Swiss Federal Act on Data Protection (FADP/DSG), ensuring lawful processing and cross-border transfer guarantees.

Brazil: Brazilian residents hold statutory rights under the Lei Geral de Proteção de Dados (LGPD), including processing confirmation, anonymization of excessive data, and complaints to the ANPD.

7. Cookie Tracking & Policy Amendments

Figet.ai uses technical cookies and optional analytics trackers (GA4). For full tracker management, consult our Cookie Policy. Cookie Policy

The Controller reserves the right to amend this Privacy Policy at any time. Changes will be posted on this page with an updated revision date.

8. Legal Definitions