Privacy Policy

Under the GDPR (EU Regulation 2016/679), the data controller is:

• Identity: [TO COMPLETE — Name, legal form]
• Address: [TO COMPLETE]
• Registration number: [TO COMPLETE]
• Email: [email protected]

Data Protection Officer (DPO): [TO COMPLETE — or state if none is required]

a) Authentication data

• Email address and name (from Google or entered at sign-up).
• Unique Firebase UID.
• Timestamp of acceptance of the Terms and this Policy.

b) Financial data (manually entered)

• Accounts (name, type, opening balance).
• Transactions (amount, date, category, optional note).
• Custom categories and groups.
• Scheduled recurring transactions (frequency, amount, dates).
• Display preferences (currency, language, theme).

c) Open Banking data (Premium)

• Bank transaction history (amounts, dates, labels).
• Masked IBAN and account name.
• PSU consent metadata.

Important: your banking credentials are never collected, transmitted, or stored by Plio.

d) Technical data

• FCM token (push notifications).
• Login timestamps (anonymous internal statistics).

e) Subscription data

• Subscription status and entitlement ID, managed by RevenueCat Inc.

• Authentication and account security — Performance of contract (Art. 6.1.b GDPR).
• Budget management features (transactions, accounts, analytics…) — Performance of contract.
• Open Banking connection — User consent (Art. 6.1.a GDPR), revocable at any time.
• Push notifications — User consent.
• Premium subscription management — Performance of contract.
• Anonymous usage statistics — Legitimate interest (service improvement).

Your data is never used for advertising purposes, nor sold or rented to third parties.

Data Processing Agreements (DPAs) compliant with the GDPR have been signed with the following sub-processors:

No other third party has access to your personal data.

Google LLC, RevenueCat Inc., and Apple Inc. are based in the United States. Transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46 GDPR). Enable Banking Oy is based in Finland (EU): no transfers outside the EU. For copies of applicable safeguards: [email protected].

• Account and financial data: retained while the account is active, deleted within 30 days of account deletion.
• FCM token: deleted upon notification deactivation or account deletion.
• Open Banking data: deleted upon consent revocation or account deletion.
• RevenueCat data: subject to RevenueCat's retention policy.
• Login logs: maximum 12 months.

• In-transit encryption: HTTPS/TLS on all communications.
• At-rest encryption: native Google Cloud encryption (Firestore).
• Access control: Firestore security rules — each user only accesses their own data.
• Authentication: Firebase Auth (password hashing, brute-force protection).
• Open Banking RSA keys: stored in Firebase Secret Manager.

Under the GDPR, you have the following rights:

• Access: obtain a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: exercised directly via Settings → Delete my account in the app.
• Portability: receive your data in a structured, machine-readable format.
• Objection: to processing based on legitimate interest.
• Withdrawal of consent: for push notifications and Open Banking, at any time.

To exercise your rights (except account deletion, available in the app): [email protected]. You may also lodge a complaint with your national supervisory authority (in France: CNIL).

Plio does not use advertising or tracking cookies. Local storage (localStorage, IndexedDB, PWA cache) is used only for offline functionality and remembering your display preferences (theme, language). This data remains on your device and is not shared with third parties.

Plio is intended for adults (18 or older). If you become aware that a minor has created an account, please contact us at [email protected] so we can delete it.

We may update this policy to reflect changes to the service or legal requirements. For material changes, you will be notified by in-app notification or email. The date of the latest update appears at the top of this page.

• Email: [email protected]
• Mail: [TO COMPLETE — Postal address]

We will respond to any request within 30 days.