Privacy Policy

We know privacy policies can be a pain to read — so we've tried to write this one in plain English. No legal jargon, no waffle. Just a straightforward explanation of what we collect, why we need it, and how we keep it safe. If something isn't clear, just get in touch and we'll explain it.

1. Legal Basis for Processing

• Contract performance — processing your account information is necessary to provide the Expensio service you have signed up for.
• Legitimate interests — processing usage and technical data to maintain security, prevent abuse, and improve the platform.
• Legal obligation — disclosing data when required by applicable law or court order.
• Consent — where you have explicitly agreed to specific processing, such as receiving communications from us.

2. Information We Collect

• Account information: the only details required to use Expensio are your name, email address, and a password. Phone number, postal address, and postcode are entirely optional and can be added later in your account settings if you choose to provide them.
• Financial data: transactions, categories, budgets, and any other data you enter or import into the platform.
• Usage data: pages visited, features used, and general interaction patterns to help us improve the service.
• Technical data: IP address, browser type, device information, and cookies for session management.

3. How We Use Your Information

• Provide, operate, and maintain the Expensio service.
• Authenticate your account and keep it secure.
• Send transactional emails such as email verification and password resets.
• Analyse usage patterns to improve the platform.
• Respond to support requests or enquiries you send us.

4. Your Financial Data

5. Data Storage and Security

• Personal data — including your email address, phone number, postal address, and postcode — is encrypted at the field level before being stored in our database. This means your sensitive details are protected even in the unlikely event of unauthorised database access.
• Any files you upload (such as CSV bank statements) are stored securely and immediately renamed using a cryptographic hash to prevent identification. Once the file has been processed and is no longer required, it is permanently deleted from our servers.
• Passwords are never stored in plain text. We use strong one-way hashing with a unique salt per user, meaning your password cannot be reversed or recovered — not even by us.
• While we take reasonable steps to protect your data, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and to keep your account credentials private.

6. Hosting Infrastructure

• Hetzner — used for primary server infrastructure. Hetzner operates data centres in Germany and Finland, both within the EU, and adheres to strict data protection standards.
• DigitalOcean — used for additional compute and storage services. DigitalOcean maintains SOC 2 Type II certification and complies with GDPR requirements.
• Amazon Web Services (AWS) — used for cloud storage, delivery, and transactional email (via Amazon SES). AWS is certified under ISO 27001, SOC 1/2/3, and GDPR-compliant frameworks. As AWS operates globally, some data may be processed outside the UK/EU; this is covered by Standard Contractual Clauses (SCCs).
• Stripe — used as our payment processor for any paid plans. Stripe is PCI DSS Level 1 certified, the highest level of payment security certification. We do not store your card details on our servers — all payment information is handled directly and securely by Stripe.

6a. International Data Transfers

• We only use providers that meet an equivalent level of data protection to the UK/EU.
• We ensure Standard Contractual Clauses (SCCs) are in place to legally protect your data.
• If we ever need to move your data to a new hosting provider, we will notify you by email in advance. You can always delete your account before any transfer if you prefer.

7. Data Breach Notification

• Notify the relevant supervisory authority within 72 hours of becoming aware — as required by law.
• Contact you directly if your personal data is at risk, without undue delay.
• Tell you what happened, what data was affected, the likely consequences, and the steps we are taking to fix it.

8. Cookies

• Essential cookies — used for session management and authentication. These are required for the platform to work. Without them, you will not be able to log in.
• Analytics cookies — we use Google Analytics to understand how people use Expensio (e.g. which pages are visited, how long sessions last). This helps us improve the platform. Google Analytics may process data outside the UK/EU; Google is certified under standard data protection frameworks.

9. Sharing of Information

• With the infrastructure and service providers named in Section 6, who are contractually bound to process your data only on our behalf.
• With users you invite to your account — if you invite someone, they will have access to the financial data within your account (including transactions, budgets, and reports) based on the role you assign them. You are responsible for managing who has access and can remove invited users at any time.
• If required by law, court order, or to protect the rights and safety of Expensio or its users.
• In connection with a merger, acquisition, or sale of assets — you will be notified in advance.

10. Data Retention

• Account data is retained for as long as your account is active. When you delete your account, it enters a 30-day grace period before being permanently erased — see Section 10a for full details.
• New accounts have a 7-day activation window. If email verification is not completed within 7 days, the account and all associated data is automatically and permanently deleted.
• Server logs — including IP addresses and request data — are retained for up to 90 days for security and debugging, then automatically deleted.

10a. User Deletion

• Your user becomes inaccessible — you will not be able to log in or use the service.
• Your data is retained internally and is not yet permanently deleted.
• You can restore your user at any time within those 30 days by contacting us at [email protected]. We will reactivate your login with all your data intact.

11. Your Rights

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix any inaccurate data.
• Deletion — permanently delete your account and all associated data at any time, with no questions asked. You can do this from your account settings or by contacting us directly.
• Portability — the account owner can request a full data export directly from their account settings. Invited members and other users on the account cannot make this request.
• What's included — the export is a CSV file containing your payments, recurring payments, and account information. Data belonging to other users on your account is not included.
• How it's delivered — once generated, you'll receive an email with a secure download link. The CSV is not attached directly for security. The link is valid for 24 hours, after that, the file is permanently deleted from our servers, regardless of whether it was downloaded.
• Restriction — object to or request that we limit how we process your data.
• Withdraw consent — if we rely on your consent to process data, you can withdraw it at any time. This does not affect anything that was processed before the withdrawal.

12. Automated Decision-Making

13. Marketing Communications

• Transactional emails — email verification, password resets, and important account or security notifications. These are required and cannot be opted out of.
• Newsletter — occasional emails covering platform updates, new features, and offers. This is entirely optional.

14. Children's Privacy

15. Governing Law

16. Changes to This Policy

17. Contact Us