Política de privacidad
Última actualización: 2026-10-31
Este documento solo está disponible en inglés.
This policy explains what personal data ByeByeBudget processes, why, and what rights you have. We collect only what we need to run the Service, and we earn money from subscriptions only, never from your data.
1. Controller
SMART SHARK s.r.o., Studienka 643, 908 75 Studienka, Slovakia
Company ID (IČO): 47580151
Privacy contact: hello@byebyebudget.com
We are the controller of the personal data described below. For payments, Paddle is a separate controller (see section 4).
2. What we process, why and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Account: e-mail, name, password (stored only as a bcrypt hash), language | Creating and running your account, signing in, service e-mails | Contract (Art. 6(1)(b) GDPR) | Until you delete your account |
| Household data: payments, descriptions, categories, recurring bills, groups, settlements, member names and shares | Providing the Service to you and your household | Contract (Art. 6(1)(b)) | Until deleted by you or your household |
| Invitations: the invited person's e-mail address | Sending a household invitation chosen by a member | Legitimate interest of the inviting member (Art. 6(1)(f)) | Until accepted, revoked or expired (7 days), then deleted with the household |
| Sign-in tokens (stored only as a hash), time of last use | Keeping you signed in on your devices | Contract (Art. 6(1)(b)) | Until you sign out or delete your account |
| IP address and technical data in server logs and in short-lived attempt counters | Security, preventing password guessing and abuse, fixing errors | Legitimate interest (Art. 6(1)(f)) | Attempt counters: IP stored only as a hash, used for at most one hour; server logs: limited period set by our hosting provider |
| Billing: name, e-mail, country, subscription status, invoices (from Paddle; we never see your card details) | Managing your subscription, accounting | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Subscription data while the subscription exists; accounting records 10 years as required by Slovak law |
| Messages you send us | Answering your questions and complaints | Contract or legitimate interest (Art. 6(1)(b), (f)) | As long as needed to resolve the matter, at most 3 years |
Giving us your e-mail and password is necessary to create an account; everything else you enter is up to you. We do not make automated decisions or profiles about you.
3. What we don't do
- No advertising, no analytics or tracking scripts, no social-media pixels.
- We do not sell or rent personal data, and we do not use your payments for any purpose other than showing them to you and your household.
- Fonts and all other files are served from our own server, so your browser does not contact third parties when you use the site or the app.
4. Who receives data
- WebSupport s.r.o. (Slovakia): hosting, database and e-mail delivery, as our processor.
- Paddle.com Market Ltd (United Kingdom): our reseller and Merchant of Record. Paddle processes payment and billing data as an independent controller under Paddle's privacy notice.
- Our accountant and professional advisers, bound by confidentiality, to the extent needed for accounting and legal obligations.
- Public authorities, only where the law requires it.
- Other members of your household see the household's shared data (not your private payments, not your password).
5. Where data is stored
We store your data in the European Union (Slovakia). Paddle is in the United Kingdom, which the European Commission recognises as providing adequate protection (adequacy decision). Any further transfers by Paddle are described in its privacy notice and protected by standard contractual clauses.
6. Cookies and local storage
We do not use tracking cookies. The app stores your sign-in token, cached data for offline use and your preferences (such as language) in your browser's local storage. This is strictly necessary for the app to work, so no consent is needed; signing out removes the token. The Paddle checkout, when you open it, may use its own cookies as described by Paddle.
7. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. In the app (Household → My data) you can download all your data as JSON and delete your account yourself. For anything else, write to hello@byebyebudget.com; we answer within one month.
When you delete your account, your personal data is erased. If other members stay in the household, the shared payment history stays with them and your name is removed from it. Accounting records we must keep by law are kept until the legal period ends.
You can also lodge a complaint with a supervisory authority, in Slovakia the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk), or with the authority in your country.
8. Security
All traffic is encrypted (HTTPS). Passwords and sign-in tokens are stored only as one-way hashes, every request is limited to your own household's data, and sign-in attempts are rate-limited.
9. Children
The Service is not intended for children under 16, and we do not knowingly collect their data.
10. Changes
We will publish any change to this policy here and tell you about material changes by e-mail or in the app.