Privacy Policy

1 Who is responsible for your data

Nerrbase is the controller responsible for personal data processed through Prep on iOS, Android and the web. Nerrbase is a Dutch sole proprietorship at Spoordijkstraat 1, 7205 BK Zutphen, The Netherlands, KvK 82244901. For privacy questions or requests, email [email protected].

2 Information we process

Account and preferences. Your email address, profile name, user identifier, password hash, verification status, authentication records, language, currency, billing-period start day and access level. If Google sign-in is offered and you choose it, we receive account identifiers and profile details such as your name and email address from Google. We do not receive your Google password.

Budget information. The income, expense and savings records you enter, including amounts, currencies, names, dates, recurrence settings, categories, account and payment-mode labels, historical versions, flexible-budget spending entries and notes, and savings goals and progress.

Sharing information. Space names, memberships, roles, invitation email addresses, inviter details, invitation tokens, expiry and acceptance status. An inviter may provide your email address before you create an account. We use it to send and manage that invitation, not to sign you up for marketing.

Service and support information. Messages you send to support and the information needed to investigate them; email message content and delivery status; authentication, security, rate-limit and operational records. Our hosting and delivery providers may process IP addresses, request times and technical browser or device information needed to provide and protect their services.

Local information. Prep stores sign-in information, remembered accounts and preferences on your device or browser. Authentication secrets use platform secure storage on native devices and browser storage on the web. Remembered account details can include your name and email. Your device’s password manager operates under its own settings and privacy terms.

Prep does not require access to contacts, precise location, health records or your bank login. Avoid putting sensitive details about yourself or others into free-text names and notes.

3 Why we use information and our legal bases

Providing Prep and managing your account: to create and authenticate accounts, synchronise budgets, save settings, calculate results, deliver requested features and send essential account emails. The basis is performance of our contract with you under GDPR Article 6(1)(b). The same basis covers handling a support request needed to provide that service.

Sharing and invitations: to operate a shared space you request, we rely on performance of our contract with you. To send an invitation to someone who is not yet a user, we rely on our legitimate interest in facilitating a requested private invitation, balanced against the recipient’s interests. Recipients may object or ask us to stop further invitations.

Security and administration: to prevent abuse, limit automated requests, investigate faults and handle general enquiries or legal claims, we rely on legitimate interests under Article 6(1)(f): maintaining a reliable service, protecting users and resolving disputes. Where a law requires processing or disclosure, we rely on Article 6(1)(c). If we introduce processing that requires consent, we will ask separately; you may withdraw it without affecting earlier lawful processing.

Your email address and authentication details are needed to create and secure an account. Without them, we cannot provide an account. Other information is needed only for the feature you choose. You decide which budget records to enter and whether to join or invite people to a shared space.

4 Money Coach and automated insights

Money Coach currently uses built-in rules on the Prep backend. External AI providers are not enabled, and we do not send your budget information to an external AI provider for this feature.

If we introduce an external AI feature, we will update this policy before enabling it and explain the provider, the data sent, the legal basis, retention and available controls. Coaching tips are informational; they do not make decisions with legal or similarly significant effects on you.

5 Who receives information

Convex, Inc. supplies the backend, database and authentication infrastructure. Resend (Plus Five Five, Inc.) delivers essential emails such as verification codes, password resets, welcome messages and space notifications. Resend receives recipient addresses, sender details, email content and delivery status. Emails may contain codes, invitation links and member or space names, but not budget balances or transaction histories. Prep does not use email open-tracking pixels or click tracking.

Hetzner Online GmbH provides the server infrastructure for our public website and web app. Web requests can include your IP address, requested URL, request time, response status and technical browser information. We use technical request information to deliver pages, diagnose problems and protect the service.

Members of a shared space can see its information according to their permissions. Apple, Google and any sign-in provider you choose process information under their own policies when you use their stores, operating systems or sign-in services.

We may disclose information where legally required, to protect rights or safety, or in a lawful business transfer with appropriate safeguards and notice. We do not sell your personal data or use it for third-party advertising.

6 Where information is processed

Nerrbase is established in the Netherlands. Our production Convex deployment is configured in the EU West region. Our web infrastructure is supplied by Hetzner Online GmbH, a German company. A provider’s registered office or a selected database region does not mean all support, subprocessors, email delivery or backup processing stays in that location.

Convex and Resend are US providers; their services and subprocessors may process personal data outside the European Economic Area, including in the United States. Transfers must be covered by a valid GDPR transfer mechanism, such as applicable adequacy decisions or the European Commission’s Standard Contractual Clauses with appropriate safeguards. Resend’s Data Processing Addendum includes these clauses. Convex’s processing agreement and subprocessor information describe its contractual framework.

For information about the safeguards applicable to your data, or a copy subject to necessary redactions, contact [email protected]. Provider information is available at https://www.convex.dev/legal/dpa, https://www.convex.dev/legal/subprocessors, https://resend.com/legal/dpa and https://www.hetzner.com/legal/privacy-policy/.

7 How long we retain information

Account and budget information is retained while it is needed to provide your account and the history you choose to keep. To request account closure and deletion, contact [email protected]. We handle deletion requests manually after verifying identity. We explain the scope of deletion, how shared spaces are affected, and any information we must retain for a specific legal obligation or claim. Uninstalling Prep, signing out or removing a remembered account does not delete server data.

Verification and password-reset codes expire after 15 minutes. Invitations expire after seven days. These expiry times prevent use of the code or invitation; they do not automatically delete every related authentication or invitation record. Such records are retained as needed to secure accounts, manage membership and investigate abuse.

Prep schedules cleanup of its transactional email outbox records after 30 days. Separate email-provider records are subject to the provider’s processing terms and configuration.

Support correspondence is retained for resolving the request and related follow-up or legal obligations. Technical and security records are retained according to the need to diagnose faults, investigate abuse, protect accounts and handle legal claims. These criteria also determine any justified retention after account closure. Backup copies may remain until their normal replacement cycle; they are not a separate basis for continuing active use of deleted information.

Locally stored sign-in details, remembered accounts and preferences remain until you remove them through account controls, browser or device settings. Contact support for the retention and deletion information applicable to a particular request.

8 Security and local storage

We use measures such as authenticated access, role-based space permissions, hashed passwords and verification codes, protected server credentials, rate limits and encrypted network connections. No service can guarantee absolute security. We do not describe Prep as end-to-end encrypted: the backend processes readable budget information to provide the service.

Prep uses local storage for functionality such as sign-in, remembered accounts, language and appearance. Blocking or clearing it may sign you out or reset preferences. Prep does not include advertising trackers. Any optional analytics or non-essential tracking introduced later will be explained and, where required, offered only with consent.

The public landing and legal website does not use analytics, advertising trackers, embedded third-party media or external font services. Visiting the website still involves technical requests to our hosting infrastructure. The separate web app uses functional browser storage for authentication and preferences.

9 Your choices and privacy rights

You can edit many account and budget details in the app. To request access, correction, erasure, restriction, or a portable copy of eligible data, email [email protected] from your account address. You can object to processing based on legitimate interests, including invitation processing. Where we rely on consent, you may withdraw it at any time. These rights apply subject to the conditions in data protection law.

To request deletion of your Prep account and associated personal data, email [email protected] with the subject “Delete my Prep account”. We may ask for proportionate information to verify your identity; do not send your password. Signing out, removing an account from a device or uninstalling Prep does not delete the server account. We will explain how deletion affects shared spaces and any information that must be retained.

We normally respond within one month. For a complex or numerous request, the law permits an extension of up to two additional months; we will tell you within the first month and explain why. Requests are normally free. You may complain to the Dutch Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl or to the supervisory authority where you live or work in the EEA.

10 Children and changes to this policy

Prep is intended for adults aged 18 and over. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action. We will update this policy when processing changes, display the revised effective date and explain material changes through appropriate channels. We will obtain consent where a change legally requires it.