Integritetspolicy

ShahLUX is a personal-finance service operated by [legal entity name], [registered address], Luxembourg ("ShahLUX", "we"). We are the data controller for the personal data described in this policy. You can reach us at support@shahluxfinance.com.

We collect only what the service needs to work, and we collect it from you.

• Account data: email address and/or mobile number, name, preferred language and currency, country, and the identifiers of the sign-in methods you choose (Supabase authentication, Sign in with Apple, Google, Telegram).
• Financial records you enter: expenses, income, accounts and cards (never full card numbers), budgets, recurring payments, debts, trips, vehicles, family groups, tax-return drafts.
• Documents you upload: photographs or PDFs of receipts and invoices, and a profile photo if you add one. Receipt images are downscaled and stored so that you can see and re-read them.
• Voice notes you send for transcription; the audio is processed and not kept after the text is produced.
• Security data: the second-factor methods you enrol (we store authenticator seeds and passkey public keys; one-time codes and recovery codes are stored only as hashes), remembered devices (as hashes), and a log of administrative actions.
• Technical data: IP address and browser or device type, used for rate limiting and abuse prevention and kept in short-lived logs.
• Subscription data: your plan and billing status. Card details are collected and held by Stripe or by Apple, never by us.

Performance of our contract with you (Art. 6(1)(b) GDPR): operating your account, storing and displaying your records, producing your reports and insights, syncing between the website, the Telegram bot and the apps, processing your subscription.

Legitimate interests (Art. 6(1)(f)): keeping the service secure (second factor, rate limiting, fraud and abuse prevention), fixing errors, and understanding aggregate usage. We do not profile you for advertising and we do not sell data.

Consent (Art. 6(1)(a)): optional notifications such as email reports and Telegram briefings, which you can switch off at any time in Settings.

Legal obligations (Art. 6(1)(c)): tax and accounting records relating to your payments to us.

Receipt reading, voice transcription, the assistant, insights and the tax helper use third-party AI models. The content you submit for these features (a receipt image, a voice note, a question, the figures needed to answer it) is sent to the provider to produce the result and is not used by us to train models. The AI's output is an estimate and can be wrong; you review a receipt before it is saved, and the tax module is a helper, not a filing and not advice.

We use the following processors, each bound by a data-processing agreement. Data is stored in the European Union (AWS eu-west-1, Ireland) unless stated.

• Supabase (database, authentication, storage) — EU.
• Railway (application hosting) — EU region.
• Vercel (website hosting and delivery) — global edge network.
• Stripe (payments and invoicing) — card data is held by Stripe.
• Apple (App Store purchases and Sign in with Apple) and Google (Sign in with Google), when you use them.
• Anthropic (Claude models) and OpenAI (Whisper transcription) — AI processing of the content you submit.
• Resend (transactional email), Twilio (SMS codes), Telegram (the bot channel).

For as long as your account exists. When you delete your account, it is frozen immediately and permanently erased after a 30-day grace period during which you can restore it. Erasure removes your records, documents, security data and your login. Invoices and payment records are kept for the period required by Luxembourg accounting law. Backups are rotated within [30] days.

You can exercise every right under the GDPR directly in the app or by writing to us: access and portability (Settings → Download my data), rectification (edit your profile and records), erasure (Settings → Delete my account), restriction and objection (write to us), and withdrawal of consent (switch off the notification). You can also lodge a complaint with the Commission nationale pour la protection des données (CNPD), Luxembourg.

All traffic is encrypted in transit (TLS). Data is encrypted at rest by our hosting providers. Access to the database is restricted to the service itself; every request is tied to your authenticated identity. You can protect your account with a second factor (passkey, authenticator app, email or SMS code) and recovery codes. No system is perfectly secure; if we learn of a breach affecting you we will notify you and the supervisory authority as the law requires.

We use only what is strictly necessary: a cookie remembering your language, and browser storage for your sign-in session and your second-factor session. We do not use advertising or cross-site tracking cookies, and we do not load third-party analytics scripts.

ShahLUX is not directed at children and we do not knowingly collect data from anyone under 16.

When this policy changes materially we will tell you in the app or by email before the change takes effect. The date at the top is the date of the current version.