Privacy Policy

Spentalot is operated by DESIGN A LOT SRL, a company registered in Romania (CUI VAT ID RO36573882), registered address Sos. Panduri, Nr. 60, Sectorul 5, Bucuresti, Romania ("we", "us"). This policy explains what personal data we collect when you use Spentalot, why, and what rights you have over it.

To run your account, we store:

• Your e-mail address and, if you give us one, a display name.
• The financial entries you type in or import: transactions, budgets, accounts, recurring rules, goals and investment holdings.
• Sign-in sessions (a session cookie and, for Google sign-in, the linkage to your Google account).

We never ask for card numbers, bank passwords or account credentials — Spentalot does not connect to your bank. Every figure in the app is one you entered or imported from a file you uploaded yourself.

Your data is stored on servers located in the European Union. Backups are kept for up to 72 hours to protect against data loss, then rotated out.

We use a small number of processors to run the service, each bound by a data processing agreement:

• Resend — delivers sign-in codes and account e-mails.
• Cloudflare — backups, DNS and network protection.
• Google — only if you choose "Continue with Google" to sign in.
• Stripe — only if you buy a paid plan: processes the payment and is the merchant of record, so we never see your card details.

We do not sell your data, and we do not share it with advertisers.

We keep your data for as long as your account exists. If you delete your account from Settings, your transactions, budgets, wallets and holdings are permanently removed; residual copies in backups are cleared within 72 hours.

Under the GDPR, you have the right to:

• Access your data — use Export data in Settings for a full JSON copy at any time.
• Erasure — use Delete my account in Settings to remove everything permanently.
• Portability — the export is a structured file you can take elsewhere.
• Rectification of inaccurate data, and to object to or restrict certain processing.
• Lodge a complaint with Romania's data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), or your local supervisory authority.

For anything not covered by the in-app tools, write to contact@spentalot.com.

Spentalot sets exactly one cookie: the session cookie that keeps you signed in. It is essential to the service and is not used for tracking or advertising. We do not use analytics or marketing cookies. This site (spentalot.com) uses Umami, a privacy-friendly analytics tool that does not use cookies or store personal data.

If we make material changes, we will update the date above and, where required, notify you by e-mail before the change takes effect.