Privacy Policy
Your privacy is foundational to Savyy. This policy applies to both our website (savyy.net) and our mobile application. It explains what we collect, how we use it, and the choices you have.
Our Privacy Commitment
At Savyy, protecting your personal data is our top priority. Our mission is to use technology to help you manage your finances: to reclaim your banking and transaction data, understand it, and optimize your financial strategy. We collect certain personal data to fulfill this mission and provide you with the best possible service. Because we understand the importance and sensitivity of personal data, we comply with the latest data protection requirements, and we do not sell, and will never sell, your personal data to third parties.
- ✓Your data is never sold to third parties
- ✓Your data is never used to train external AI models
- ✓All sensitive data is encrypted with AES-256-GCM
- ✓We operate our own servers and database infrastructure
We collect and use only the personal data necessary for our operations and the purposes listed below, enabling us to provide you with personalized services tailored to your profile.
Account Information
- Identification data: name, email address, profile image
- Authentication data: encrypted passwords, OAuth tokens (Google, Apple)
- Session data: IP address and user agent for security purposes
Financial Data (when you connect your bank)
- Bank account information: account names, types, balances, currency, IBAN (encrypted)
- Transaction details: dates, amounts, descriptions, merchant names, payment status
- Connection data: consent status, synchronization timestamps
- User preferences: custom categories, budgets, alert configurations
Technical & Usage Data
- Navigation data: pages visited, features used, errors encountered
- Device information: browser type, operating system, mobile identifiers
- Performance data: response times, usage patterns for service improvement
We process your data for the following purposes, each with a specific legal basis:
Provide and maintain the Service (account management, bank synchronization, transaction display)
Contract performanceAI features: assistant, budget suggestions, coach, and automatic transaction categorization (only after you enable AI features in the app)
ConsentSecurity measures: fraud prevention, rate limiting, abuse detection
Legitimate interestService improvement: analytics, performance monitoring, bug fixes
Legitimate interestLegal compliance: responding to legal requests, regulatory requirements
Legal obligationSavyy offers optional AI features: the Vaulty assistant, AI budget suggestions, the Financial Freedom coach, and automatic transaction categorization. These features are off by default and only run after you explicitly enable AI features in the app. When enabled, the data described below is processed by our AI providers, Anthropic and OpenAI, routed through Vercel AI Gateway.
How AI processing works:
- Consent first: apart from instrument search (described below), no data is sent to any AI provider until you enable AI features. Every request from these features is checked against your consent on our servers, including background processing such as automatic categorization.
- Named providers: requests are routed through Vercel AI Gateway to Anthropic (Claude) and OpenAI (GPT) models. These providers process your data solely to generate the response and do not use it to train their models.
- Anonymization for automatic categorization: before transactions are categorized in the background, we strip identifiers from descriptions (account numbers, IBANs, card numbers, phone numbers, email addresses).
- Your control: you can withdraw your consent at any time in your profile settings. This immediately stops all AI processing, including automatic categorization.
What can be sent to our AI providers, depending on the feature you use:
- Assistant and coach: your messages, plus the financial data needed to answer them (transaction amounts, dates, descriptions, merchant names, account names, balances, categories, budgets, recurring payments)
- Budget suggestions: spending aggregated by category, detected income, recurring payment names and amounts, and the goals you type
- Automatic categorization: sanitized transaction descriptions (identifiers removed) with amount and credit/debit direction
- Instrument search: the search text you type when looking up a stock, crypto, or other instrument, used only to resolve the matching ticker symbol. This search works whether or not AI features are enabled and includes no account, transaction, or profile data.
What is NEVER sent to AI providers:
- Your name, email address, or profile information
- Banking credentials: Savyy never holds your bank passwords
- Account numbers, IBANs, or card numbers stored by Savyy (they remain encrypted)
- Anything other than the instrument search text above, while AI features are disabled
Under the EU General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide our services as agreed when you create an account.
- Legitimate Interests: Processing for service improvement, security, and fraud prevention, where our interests don't override your rights.
- Legal Obligations: Processing required to comply with applicable laws and regulations.
We only share your data with trusted partners necessary to provide our services, all operating under strict contractual obligations:
Data Recipients:
- Banking Aggregator (Bridge): Securely connects to your bank accounts with your explicit consent. Your banking credentials are never stored by Savyy. Authentication is handled directly by this regulated partner.
- Payment Processor (Stripe): Processes subscription payments. We store only a customer reference, not your payment details.
- Email Service (AWS SES): Sends transactional emails (verification, password reset, notifications).
- Error Monitoring (Sentry): Production-only error tracking with automatic PII filtering.
- Infrastructure Providers: Hosting and database services with appropriate security certifications.
- AI Providers (Anthropic and OpenAI, via Vercel AI Gateway): process the data described in section 3 to power AI features. Apart from instrument search text, this happens only after you have enabled AI features in the app. They are contractually prohibited from using your data to train their models.
We retain your data only as long as necessary for the purposes described in this policy:
- Account Data: Retained for the duration of your account. Upon account deletion, your data is permanently removed.
- Session Data: Sessions expire after 24 hours of inactivity and are automatically cleaned up.
- Transaction Data: Retained for the lifetime of your account to provide historical analysis and insights.
- Verification Tokens: Email verification and password reset tokens expire within hours and are then deleted.
When you delete your account, all associated data (bank accounts, transactions, categories, budgets, alerts) is permanently deleted through cascading deletion. This action is irreversible.
Your data is primarily stored and processed within the European Union. If you enable AI features or use instrument search, the data described in section 3 may be processed in the United States by our AI providers (Anthropic and OpenAI), under appropriate safeguards such as the EU Standard Contractual Clauses.
Under GDPR, you have comprehensive rights regarding your personal data:
- Right of Access: Obtain a copy of all personal data we hold about you.
- Right to Rectification: Correct inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten").
- Right to Restriction: Limit how we process your data in certain circumstances.
- Right to Data Portability: Receive your data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests.
- Right to Withdraw Consent: Withdraw any consent previously given, without affecting prior processing.
To exercise these rights, contact us via our contact page. We will respond within one month. If we need additional information to verify your identity, we will let you know.
We implement comprehensive security measures to protect your data:
- Encryption: All sensitive data (IBANs, tokens, passwords) is encrypted using AES-256-GCM, the industry standard for authenticated encryption.
- Secure Authentication: Battle-tested authentication library trusted by the community, with OAuth 2.0, email OTP, and password security checks (Have I Been Pwned integration).
- Request Signing: All API requests between services are HMAC-SHA256 signed with short expiration windows.
- Rate Limiting: Redis-based rate limiting protects against abuse and brute-force attacks.
- Webhook Verification: All incoming webhooks from banking providers are verified using HMAC signatures.
- Infrastructure: Own database servers (PostgreSQL), no shared infrastructure with other applications.
For any questions about this privacy policy or to exercise your rights, please contact us via our contact page.
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
