Privacy policy — Bucklet

Why we process your data

We process your account, accounts, transactions and receipt photos to provide the service, that is to perform our contract with you. The location of a photo is saved only if you turn it on, based on your consent, which you can withdraw at any time in settings without affecting what was already saved. If you choose so, people on our team may look at your receipt photos and their readings, and keep a copy to measure and improve reading, based on your consent, which you can withdraw at any time in settings. We keep the model's readings to check their quality and answer your questions, based on our legitimate interest, and you can object by writing to us.

Without your account and expense data Bucklet cannot work. Photo location and dictation are optional.

What data we collect

We keep:

• your account: email or sign-in with Google or Apple, your chosen language and currency
• the accounts and transactions you record, including amount, date, category and notes
• the receipt photos you take, for as long as they are attached to a transaction
• the text you dictate. We never record or store the audio: your phone's speech recognition turns it into text, which on some Android devices goes through Google's servers and on iPhone through Apple's, and only the text reaches us
• the usage events needed to run the plans, without the content of your expenses
• the place of a photo, only if you turn it on, with coordinates rounded to about ten metres and the name of the city, visible only to you

Reading with artificial intelligence

When you photograph a receipt, dictate or share an expense, we read it with an artificial intelligence model from Mistral AI, based in Paris, or from Google (Gemini), in both cases through their service for the European Union. We send the model the photo or text, your language, currency, time zone and today's date, the names of your accounts and categories, the merchants you use most with their categories and the bucklet's last 40 transactions, including other members', to spot duplicates. In shared bucklets and trips we also send the names of the members, yours included, and of the guests, with the way expenses are split. If you turned it on, we send the city where the photo was taken, never the coordinates. We do not send your email or any identifier of your account.

Mistral AI and Google process this data on our behalf, under a data processing agreement, and neither uses it to train its models. Mistral AI keeps it for up to 30 days to monitor abuse of the service, then deletes it. Google keeps it in memory for 24 hours at most, and keeps it for up to 90 days, in the European Union, only if an automated check flags possible abuse.

The model can get an amount, a date or a merchant wrong. When a reading is uncertain we show it to you for review; when it is very confident the transaction is saved on its own, and you can always correct or delete it. If you prefer to review everything, turn off automatic confirmation in settings. We make no automated decisions that produce legal effects on you or affect you in a similarly significant way.

Your expenses can say a lot about you, for example when you buy at a pharmacy. That is why we send the model only what the reading needs. Before your first photo, dictation or share the app tells you who reads it and what it receives, and asks you to go on. Without your yes nothing is sent, and you can always enter transactions by hand.

If a provider's filter blocks one of your photos, we record that it happened, with the reason and the date and without the photo, to protect the service, and we delete the record after 12 months.

When you say or write a request to Backy, the app’s assistant, we send it to Mistral AI to understand it, to perform our contract with you. Along with the sentence, up to 300 characters, we send the names of your bucklets, of their members, of your accounts and of the categories you created, each one marked with an alias and never with our identifiers, your time zone and today’s date. We also send the names of the shops you use most, up to 30, each with its category. Within the same conversation we also send the previous messages, up to 12, with what Backy understood of them, amounts included, but never your recorded transactions or your balances. We keep the sentence only if you agreed to let us use photos and sentences to improve reading, for 12 months, and we delete it when you withdraw your consent or delete your account. If a request is a disallowed attempt, for example asking for another person’s data, we keep its sentence for 90 days for the security of the service, on the basis of our legitimate interest, even without your consent.

Where your data lives

The database, attachments and server functions are hosted by Supabase, in a data centre in Frankfurt, European Union. Push notifications go through Expo's service, which does not declare a European region for the sole routing of the message: they never contain amounts or merchant names.

How long we keep it

Transactions and accounts stay as long as your account exists. A photo not attached to any transaction is deleted after 30 days. An export archive is deleted after one day. Copies kept to improve reading are deleted when you withdraw your consent or delete your account. Proposals read by the model are kept for 24 months for quality and verification purposes, then deleted; the statistical aggregate remains, with no reference to you. Mistral AI deletes the data of a reading after 30 days at most; Google after 24 hours, or after 90 days at most if an automated check flagged possible abuse.

Your rights

You have the right to access, correct and delete your data, to restrict its processing, to object to processing based on our legitimate interest and to receive it in a readable format. You can export all your data as JSON and CSV, with attachments, from the app settings. You can delete your account at any time: your profile, attachments and captures are deleted, and transactions in a bucklet shared with others remain visible to them with you shown as «removed user», because they belong to them too.

To exercise your rights, or for any question about the processing, write to [email protected].

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the country where you live.

How to delete your Bucklet account

In the app, tap the gear at the top of Home to open Settings, then choose «Delete your account» in the Account section. In the same section you can first download a copy of your data with «Export your data».

We permanently delete your sign-in, your profile, accounts, transactions, recurring items, photos and attachments, the readings of your photos with the model's proposals, and the place of your photos.

In shared bucklets your transactions and their photos stay with the other members, with «removed user» in your place, because they also belong to them. The suggestions you sent stay in anonymous form, with no author or device data. Usage events stay only as totals, with no reference to you.

If the app is no longer installed, write to [email protected] from the address you sign in with and we delete the account for you within 30 days, replying once it is done.

Plans and codes

A plan can be granted to you by whoever runs Bucklet or activated with a code. We record the plan, its expiry and who granted it. Of a code we keep only a one-way fingerprint, never the code itself.

Who we share data with

We do not sell your data and we do not use it for advertising. We share it only with the providers that let Bucklet work, each under a data processing agreement:

• Supabase (United States, infrastructure in the European Union in Frankfurt): database, authentication, attachments, server functions
• Mistral AI (France, Paris): reading photos, dictated text and shared expenses with artificial intelligence, and understanding the requests said or written to the app’s assistant
• Google Cloud (United States, servers in the European Union): the same reading with artificial intelligence (Gemini), when we use it instead of Mistral AI
• Expo (United States): sending of push notifications, without amounts or merchant names
• Scaleway (France, Paris): sending of system emails, such as the sign-in link, without amounts or merchants and without tracking opens or clicks
• Google (United States): signing in with Google and delivering notifications on Android; on some Android phones, transcribing dictation; with photo location on, the phone asks Google for the city name and the mini-map
• Apple (United States): signing in with Apple; on iPhone, transcribing dictation and, with photo location on, the city name and the mini-map

Transfers outside the European Union

Supabase, Expo, Google and Apple are based in the United States. When one of their services processes data outside the European Union, the transfer relies on the provider's certification under the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission. You can ask us for a copy of the safeguards by writing to us.

If you are a guest on a trip

Whoever added you to a trip wrote your name to split expenses. Your name is visible to anyone with the trip link and, when a member records an expense, it is sent to the artificial intelligence model to work out who paid and how it is split. To have it removed, write to whoever invited you or to [email protected].

Minors

Bucklet is only for people aged 18 or over. We do not knowingly collect data from anyone under 18.

Security

Data is isolated per bucklet at the database level: the app's code is not what decides who sees what. Attachments are private, reachable only with a short-lived signed link, and the location metadata of photos is removed before upload.

Changes to this notice

If it changes substantially, we tell you inside the app before you have to accept it again. The date at the top of this page shows when it last changed.

Data controller

Bucklet Team.