Privacy Policy

This Privacy Policy explains how Zogal ("Zogal", "we", "us", "our") collects, uses, discloses and protects personal data when you use our website, applications and related services (together, the "Services"). By using the Services you acknowledge that you have read and understood this Policy. Capitalised terms not defined here have the meaning given in our Terms of Service.

1. Data controller

Zogal is the controller of personal data processed through the Services. Contact details are set out in Section 14.

2. Personal data we collect

2.1 Data you provide - Account data: name, email address, password (stored as a salted hash), and any profile details you choose to add. - Financial records you enter: income, expenses, bills, goals, categories, currencies and notes. - Documents you submit for reading: receipt images, forwarded bank notifications and similar files. We extract the transaction details (amount, date, merchant, category) and retain those; the original image or message is retained only for as long as needed to complete the extraction and to allow you to correct the result, after which it is deleted. - Communications: messages you send us through the Services, by email or through our contact form.

2.2 Data collected automatically - Device and usage data: device type, operating system, browser, language, approximate location derived from IP address, pages viewed, actions taken and timestamps. - Diagnostic data: error reports and performance metrics.

2.3 Data from third parties - Payment data: when you purchase a subscription, our payment processors provide us with the transaction status, the last four digits and brand of your card, and a token that lets us charge you on renewal. We never receive or store your full card number.

We do not collect your online banking credentials and the Services never connect to your bank account.

3. Purposes and legal bases

We process personal data for the following purposes: - To provide the Services, including calculating what is safe to spend, sending reminders and producing summaries (performance of a contract). - To create and administer your account, and to process payments and renewals (performance of a contract). - To communicate with you about the Services, including service notices, security alerts and responses to your requests (performance of a contract; legitimate interests). - To improve, secure and monitor the Services, including fraud prevention, abuse detection and debugging (legitimate interests; legal obligation). - To comply with legal obligations, including tax, accounting and lawful requests from authorities (legal obligation). - To send marketing communications where you have opted in (consent), which you may withdraw at any time.

We do not sell personal data and we do not use personal data for third-party advertising.

4. Automated processing

The Services use automated calculations to produce figures such as your daily allowance and warnings about spending pace. These are informational outputs derived from data you have supplied; they are not decisions with legal or similarly significant effects. Where the Services use machine-learning models to read a document you submit, the result is shown to you for confirmation before it is relied upon.

5. Disclosure of personal data

We disclose personal data only: - To service providers acting on our instructions under written contracts, for hosting, database services, email delivery, push notifications, payment processing, document reading and error monitoring. - To payment processors, to the extent necessary to take and refund payments. - To professional advisers, auditors and insurers under duties of confidentiality. - To competent authorities where required by law, regulation or legal process, or to protect the rights, property or safety of Zogal, our users or others. - To a successor in the event of a merger, acquisition or sale of assets, subject to this Policy.

Our staff access your data only when necessary to support you or to maintain the Services, and every such access is logged.

6. International transfers

Our service providers may process personal data in countries other than the one in which you reside. Where personal data is transferred internationally we rely on appropriate safeguards recognised by applicable data protection law, including contractual clauses approved by the relevant authorities and, where available, adequacy decisions.

7. Retention

We retain personal data for as long as your account is active and for such further period as is necessary to fulfil the purposes described above, to comply with legal obligations (including financial record-keeping requirements), to resolve disputes and to enforce our agreements. When you delete your account, your data is placed beyond use immediately and permanently erased after a short grace period during which you may cancel the deletion, save for records we are legally required to keep.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls, least-privilege staff access, logging and regular review. No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

9. Your rights

Subject to applicable law, you have the right to: - access the personal data we hold about you and receive a copy in a portable format; - have inaccurate or incomplete data corrected; - have your personal data erased; - restrict or object to certain processing, including processing based on legitimate interests; - withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and - lodge a complaint with a supervisory authority.

You can exercise the rights of access, portability, correction and erasure directly from inside the Services, at any time, without contacting us. For any other request, contact us using the details in Section 14. We may need to verify your identity before acting on a request.

10. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences and keep the Services secure. We do not use advertising cookies or cross-site tracking. Our contact forms are protected by Google reCAPTCHA, which is subject to Google's Privacy Policy and Terms of Service.

11. Children

The Services are intended for persons aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Third-party links

The Services may link to third-party websites and services. This Policy does not apply to them and we are not responsible for their practices.

13. Changes to this Policy

We may update this Policy from time to time. The date at the top indicates when it was last revised. Where a change is material we will notify you through the Services or by email before it takes effect.

14. Contact

Questions, requests and complaints regarding this Policy or our handling of personal data may be sent to privacy@getzogal.com.