Privacy Policy

Who we are#

Spentalot is operated by DESIGN A LOT SRL, a company registered in Romania (CUI VAT ID RO36573882), registered address Sos. Panduri, Nr. 60, Sectorul 5, Bucuresti, Romania ("we", "us"). This policy explains what personal data we collect when you use Spentalot, why, and what rights you have over it.

What we store#

To run your account, we store:

• Your e-mail address and, if you give us one, a display name.
• The financial entries you type in or import: transactions, budgets, accounts, recurring rules, goals and investment holdings.
• Sign-in sessions (a session cookie and, for Google sign-in, the linkage to your Google account).

We never ask for card numbers, bank passwords or account credentials — Spentalot does not connect to your bank. Every figure in the app is one you entered or imported from a file you uploaded yourself.

Where your data lives#

Your data is stored on a server located in the European Union, run for us by our hosting provider. Backups are streamed to Cloudflare R2 storage held in Cloudflare's EU jurisdiction, kept for up to 72 hours to protect against data loss, then rotated out.

Before an update goes live we test it on a separate, non-public copy of the service on the same EU server. That copy may be refreshed from the latest backup; sign-in sessions, notification subscriptions and payment links are removed from it, it sends no reminders, and only our team can sign in to it.

Who else sees it#

We use a small number of processors to run the service, each bound by a data processing agreement:

• netcup GmbH — hosts the server the app and its database run on, in a data centre in Germany.
• Cloudflare — backups in R2 storage (EU jurisdiction), DNS and network protection.
• Resend — delivers sign-in codes and account e-mails.
• Google — only if you choose "Continue with Google" to sign in.
• Stripe — only if you buy a paid plan: processes the payment and is the merchant of record, so we never see your card details.
• Sentry — when error monitoring is switched on: receives technical reports of errors (what failed, where in the app, your browser, and an internal account number). No session recordings, and your e-mail address is not included.
• Umami — cookie-free visit statistics for the spentalot.com website only, not inside the app.

We do not sell your data, and we do not share it with advertisers.

How long we keep it#

We keep your data for as long as your account exists. If you delete your account from Settings, your transactions, budgets, wallets and holdings are permanently removed; residual copies in backups are cleared within 72 hours. If you have a subscription, deleting your account cancels it first.

Stripe, as merchant of record, keeps its own records of any payment you made, as the law requires. On our side we keep only an anonymous note that a Founders seat was sold, so the seat count stays right.

Your rights#

Under the GDPR, you have the right to:

• Access your data — use Export data in Settings for a full JSON copy at any time.
• Erasure — use Delete my account in Settings to remove everything permanently.
• Portability — the export is a structured file you can take elsewhere.
• Rectification of inaccurate data, and to object to or restrict certain processing.
• Lodge a complaint with Romania's data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), or your local supervisory authority.

For anything not covered by the in-app tools, write to contact@spentalot.com.

Cookies#

Spentalot sets exactly one cookie: the session cookie that keeps you signed in. It is essential to the service and is not used for tracking or advertising. We do not use analytics or marketing cookies. This site (spentalot.com) uses Umami, a privacy-friendly analytics tool that does not use cookies or store personal data.

When you arrive from one of our own campaign links, the link's labels (which post or channel it was) are kept in your browser's local storage for 30 days and saved alongside a Founder purchase, so we can tell which posts brought people here. They identify the post, not you, and nothing is shared with advertisers.

Changes to this policy#

If we make material changes, we will update the date above and, where required, notify you by e-mail before the change takes effect.