Privacy Policy

The controller of the personal data described here is [YOUR LEGAL ENTITY NAME], [REGISTERED ADDRESS], registered under [COMPANY REGISTRATION NUMBER]. You can reach us about anything on this page at [PRIVACY CONTACT EMAIL].

Everything falls into one of five groups.

• Account details. Your username, email address, an account number we generate, and — if you sign in that way — your phone number or the Google account identifier. We need these to give you an account and to let you back into it. Legal basis: performance of a contract with you.
• Your contract ledger. The contracts, providers, costs, currencies, dates, notice periods, categories, payment-method labels, budgets and notes you enter, plus any documents you upload. This is the service itself. Legal basis: performance of a contract with you.
• Region and language settings. The country and display currency you choose, or the one we guess from your browser’s time zone until you correct it. Used to show amounts and dates in a form that makes sense where you are. Legal basis: performance of a contract, and consent for the guessed value stored on your device.
• Billing data. If you subscribe, Stripe processes your card details — we never see or store them. We keep your plan, its status, and the Stripe customer and subscription identifiers. Legal basis: performance of a contract, and our legal obligation to keep accounting records.
• Security and audit records. A log of sensitive actions on your account (exports, deletions, permission changes, sign-in identity checks) with timestamps. Legal basis: our legitimate interest in being able to investigate account misuse, and in some cases a legal obligation.

We do not run advertising, we do not sell or rent your data, and we do not build profiles of you for anyone else’s benefit.

Some features only work by reaching into another account of yours. None of them is on by default; each one is switched on by you, and can be disconnected at any time.

• Bank sync. With your explicit authorisation through your bank’s own consent screen, an open-banking provider (GoCardless in the EEA and UK, Stripe Financial Connections in the US, Mono in Nigeria, Ghana, Kenya and South Africa) shares recurring-payment information with us so we can suggest subscriptions you may have forgotten. We store the suggestion, not your statement.
• Mailbox scan. With your authorisation, we read renewal and receipt emails to draft contracts for you. We store the resulting suggestion and a short excerpt for context, not your mailbox.
• Document scanning and Ask. Text extracted from documents you upload, and questions you ask about your own ledger, are sent to an AI provider to produce the answer. Do not paste anything into these features that you would not want processed by a third party.
• Cloud folder sync. If you connect Google Drive or OneDrive, we access only the folder you nominate, to copy your archived documents into it.

Nothing found by these features is ever added to your ledger automatically. Every suggestion waits for you to approve it, and the database refuses to record one that has not been approved.

We use a small number of processors, each under a data-processing agreement, and each only for the purpose named:

• Supabase / Lovable Cloud — database, authentication and document storage.
• Stripe — subscription payments.
• An AI provider — document extraction and the Ask feature.
• An open-banking provider — only if you connect a bank account.
• An email provider — verification, password resets and deadline reminders.

Where these involve transferring data outside the EEA or UK, the transfer relies on [TRANSFER MECHANISM — usually Standard Contractual Clauses]. The regions data is processed in are [LIST YOUR PROJECT REGIONS].

Your ledger stays until you delete it or close your account. Deleting a contract deletes it; deleting your account removes your profile, contracts, documents, budgets and household membership.

Two things outlive that on purpose. Audit records are retained for [RETENTION PERIOD] so that a security question can still be answered after the fact, and billing records are kept for as long as tax law requires — commonly six to ten years depending on where the operating entity is established.

Detected-subscription suggestions you never acted on are pruned automatically, and short-term AI usage records are dropped after seven days.

If the GDPR or UK GDPR applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another service in a portable format. You can withdraw consent for anything you consented to, without affecting what was lawful before you withdrew it. Where we rely on legitimate interests, you can object and we will stop unless we can show compelling grounds not to.

Two of these you can exercise yourself, immediately: your ledger and audit log can be exported from the app at any time, and you can disconnect any bank, mailbox or cloud connection from Settings. For anything else, write to [PRIVACY CONTACT EMAIL] and we will respond within one month.

If you think we have got this wrong, you can complain to your local data-protection authority — for us that is [SUPERVISORY AUTHORITY]. We would rather you told us first, but it is your right either way.

Data is encrypted in transit and at rest. Every table is protected by row-level security policies so that one account cannot read another’s rows, uploaded documents live in a private bucket reachable only through short-lived signed links, and administrative actions are recorded in the audit log. No system is perfect; if a breach ever affects your rights we will notify you and the relevant authority as the law requires.

Contract Keeper is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.

What we store on your device, and how to change your mind about it, is covered separately in the Cookie Policy.

If we change how we handle your data in a way that matters, we will update the date at the top of this page and tell you in the app before the change takes effect.