Privacy Policy | Wealth Tracker

Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This Privacy Policy ("Policy") describes the privacy practices of Digital Front LLP ("we," "us," "our," "Company"), a company registered at 3rd Floor East, 21 Foley Street, London W1W 6DR, United Kingdom (Registration No: OC457050), in connection with Wealth Tracker (https://getwealthtracker.com), including all associated websites, applications, and services (collectively, the "Service"). As the data controller, we are responsible for determining the purposes and means of processing your personal data.

By accessing or using the Service, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with this Policy, please do not access or use the Service.

1. Information We Collect

We collect information in several ways: directly from you, automatically through your use of the Service, and from third-party sources.

1.1 Information You Provide Directly

Account Information:

Name, email address, and username
Password and security credentials
Profile picture and biographical information
Phone number (if provided)
Organization name and role (for team accounts)

Billing and Payment Information:

Billing name and address
Payment method details (credit card number, expiration date, CVV)
Tax identification numbers (VAT, GST, etc.)
Transaction history and invoices

Note: Payment information is processed by our third-party payment processor(s) and is not stored on our servers except as necessary for record-keeping.

Communications:

Messages you send through the Service
Support inquiries and correspondence
Survey responses and feedback
Testimonials and reviews (with your consent)

User Content:

Files, documents, and data you upload
Content you create, share, or store on the Service
Comments, notes, and annotations

1.2 Information Collected Automatically

Device and Browser Information:

Device type, model, and manufacturer
Operating system and version
Browser type and version
Screen resolution and display settings
Device identifiers (including advertising identifiers)

Usage Information:

Pages and features accessed
Time spent on pages and features
Clicks, scrolls, and interactions
Search queries within the Service
Date and time of access
Referring and exit pages

Network and Location Information:

IP address
Internet service provider
General geographic location (city, region, country)
Time zone settings

Cookies and Similar Technologies:

Session cookies and persistent cookies
Pixel tags (web beacons)
Local storage and session storage
Mobile advertising identifiers

For more information about our use of cookies, please see our Cookie Policy.

1.3 Information from Third Parties

OAuth and Social Login Providers: When you choose to log in using a third-party service (such as Google, GitHub, or Microsoft), we receive basic profile information as authorized by you through that service.

Payment Processors:

Transaction status and confirmation
Fraud prevention and verification data
Chargeback and dispute information

Analytics and Advertising Partners:

Aggregated usage statistics
Attribution and conversion data
Ad performance metrics

1.4 Bank Account Data (Open Banking)

If you choose to connect a bank account, we receive the following from your bank through Enable Banking Oy, a payment institution licensed as an account information service provider by the Finnish Financial Supervisory Authority:

Account details: the bank's name, account name and type, currency, and account number (IBAN), which we store masked
Balances
Transactions: date, amount, currency, direction, the name of the other party, their account number where the bank provides it (stored masked), the description or reference, and the bank's transaction type

You authorise this access yourself, at your bank, for a period your bank sets (usually up to 180 days). We only read data; we cannot move money or make payments. You can end access at any time in Settings, at your bank, or at enablebanking.com/data-sharing-consents.

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data under the following legal bases:

Contractual Necessity:

To create and manage your account
To provide the Service you have requested
To process payments and fulfill subscriptions
To provide customer support

Legitimate Interests:

To improve and develop our Service
To analyze usage patterns and optimize performance
To prevent fraud and ensure security
To send service-related communications
To protect our legal rights

Consent:

To send marketing communications
To use cookies for analytics and advertising
To process special categories of data (if applicable)
To transfer data internationally (where consent is required)

Legal Obligation:

To comply with applicable laws and regulations
To respond to lawful requests from authorities
To maintain records as required by law

You may withdraw your consent at any time where we rely on consent as the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

3. How We Use Your Information

3.1 Providing and Maintaining the Service

Creating, managing, and authenticating your account
Processing transactions and managing subscriptions
Delivering the features and functionality you request
Storing and managing your User Content
Providing technical support and responding to inquiries

3.2 Improving and Developing the Service

Analyzing usage patterns to improve features
Conducting research and analysis
Developing new products, features, and services
Testing and debugging
Training machine learning models (using aggregated or anonymized data)

3.3 Communications

Sending transactional emails (account confirmations, password resets, receipts)
Providing service updates and administrative notifications
Sending marketing communications (with your consent or as permitted by law)
Responding to your inquiries and support requests
Sending surveys and requesting feedback

3.4 Security and Fraud Prevention

Detecting, investigating, and preventing fraudulent transactions and abuse
Monitoring for security threats and vulnerabilities
Enforcing our Terms of Service
Verifying user identity
Protecting against unauthorized access

3.5 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from government authorities
Establishing, exercising, or defending legal claims
Enforcing our agreements and policies

3.6 Bank Account Data

We use bank account data only to provide the features you connected it for: keeping your balances and net worth up to date, showing your spending by category, merchant and period, finding recurring payments, and answering your questions through the assistant and the AI tools you connect. To name categories, merchant names (never person-to-person payment details) may be sent to our AI model provider. We do not sell bank data, use it for advertising, or use it to train AI models.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party vendors, consultants, and service providers who perform services on our behalf, including:

Cloud hosting and infrastructure providers
Payment processors and billing services
Email delivery services
Customer support platforms
Analytics providers
Security and fraud prevention services

These service providers are bound by contractual obligations to protect your information and may only use it for the purposes for which it was disclosed.

Sub-Processor Changes: We maintain a list of sub-processors who process personal data on our behalf. We will provide you with reasonable advance notice of any intended changes to our sub-processors, either through email notification or by updating the list on our website. If you have objections to a new sub-processor, you may contact us to discuss your concerns. A current list of our sub-processors is available upon request.

4.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, including:

Court orders and subpoenas
Requests from law enforcement or government agencies
Legal proceedings and litigation
National security requests

4.4 Protection of Rights

We may disclose information when we believe disclosure is necessary to:

Protect our rights, property, or safety
Protect the rights, property, or safety of our users or the public
Investigate potential violations of our Terms of Service
Detect, prevent, or address fraud, security, or technical issues

4.5 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so.

4.6 Aggregated or Anonymized Data

We may share aggregated or anonymized information that cannot reasonably be used to identify you.

4.7 Bank Connection Provider

Enable Banking Oy receives the data needed to connect to your bank and passes your account data to us. It acts under its own licence and its own terms, which you accept when you connect a bank.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

5.1 Transfer Safeguards

When we transfer personal data internationally, we implement appropriate safeguards:

Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses with our service providers to ensure adequate protection for data transferred outside the EEA.

Adequacy Decisions: We may transfer data to countries that have been recognized by relevant authorities as providing an adequate level of data protection.

Data Processing Agreements: We maintain data processing agreements with all third parties who process personal data on our behalf.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected:

Account Information: Retained for the duration of your account plus a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements.

Billing and Transaction Data: Retained for a minimum of seven (7) years to comply with tax and accounting requirements.

Usage Data and Analytics: Typically retained for up to two (2) years for analysis and service improvement.

Communication Records: Support correspondence retained for up to three (3) years after resolution.

User Content: Retained until you delete it or for a reasonable period after account termination.

Bank Account Data: Retained while the bank stays connected and afterwards until you delete it (Settings lets you disconnect a bank and delete its transactions) or delete your account, which erases it.

You may request deletion of your personal information at any time, subject to our legal obligations and legitimate business interests.

7. Data Security

We implement appropriate technical and organizational security measures:

7.1 Technical Measures

Encryption of data in transit using TLS/SSL
Encryption of data at rest using industry-standard algorithms
Secure password hashing
Multi-factor authentication options
Regular security testing and vulnerability assessments
Firewalls and intrusion detection systems
Access controls and role-based permissions

7.2 Organizational Measures

Employee training on data protection and security
Background checks for employees with access to personal data
Confidentiality agreements with employees and contractors
Incident response procedures
Regular security audits and reviews

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure.

7.3 Security Incidents

In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

Right to Access: Request a copy of the personal information we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete personal information.

Right to Erasure: Request deletion of your personal information, subject to certain exceptions.

Right to Restriction: Request that we restrict the processing of your personal information.

Right to Data Portability: Receive your personal information in a structured, commonly used format.

Right to Object: Object to processing of your personal information for direct marketing or based on legitimate interests.

Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 days).

Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If we use automated decision-making, we will inform you and provide meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing. You may request human intervention, express your point of view, or contest any automated decision.

9. Rights for Specific Jurisdictions

9.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the rights described above, plus:

Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

9.2 United States Residents

California (CCPA/CPRA): If you are a California resident, you have the following rights:

Right to Know: Request information about personal information collected, sources, purposes, and third parties with whom it is shared
Right to Delete: Request deletion of personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (Note: We do not sell personal information)
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to provide the Service

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Other US State Laws: If you are a resident of a US state with comprehensive privacy legislation, you may have similar rights including:

Right to access, correct, and delete your personal data
Right to data portability
Right to opt out of targeted advertising, sale of personal data, and profiling
Right to appeal our decisions regarding your privacy requests

To exercise any of these rights, contact us at [email protected]. We will verify your identity before processing your request.

9.3 Brazilian Residents (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, portability, and the right to revoke consent.

9.4 Canadian Residents (PIPEDA)

If you are located in Canada, you have rights under PIPEDA, including access, correction, and withdrawal of consent.

10. Children's Privacy

The Service is not intended for children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately.

11. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services.

We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the content, privacy practices, or data handling of third-party services.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. There is no uniform standard for responding to DNT signals.

Currently, our Service does not respond to DNT signals. However, you can manage your privacy preferences through our cookie settings and the options described in this Policy.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

Notification of Changes:

We will post the updated Policy on the Service with a new "Last Updated" date
For material changes, we will provide additional notice via email or a prominent notice on the Service
We will obtain your consent where required by law

Your continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

14. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Digital Front LLP (Data Controller)
3rd Floor East, 21 Foley Street, London W1W 6DR, United Kingdom
Registration No: OC457050

Data Protection Inquiries: [email protected]

Website: https://getwealthtracker.com

Supervisory Authority: If you are located in the EEA, UK, or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

By using the Service, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy.