Privacy Policy

1 Who is responsible for your data

Nerrbase is the controller responsible for personal data processed through Prep on iOS, Android and the web. Nerrbase is a Dutch sole proprietorship at Spoordijkstraat 1, 7205 BK Zutphen, The Netherlands, KvK 82244901. For privacy questions or requests, email [email protected].

2 Information we process

Account and preferences. Your email address, profile name, user identifier, password hash, verification status, authentication records, language, currency, billing-period start day and access level. If Google sign-in is offered and you choose it, we receive account identifiers and profile details such as your name and email address from Google. We do not receive your Google password.

Budget information. The income, expense and savings records you enter, including amounts, currencies, names, dates, recurrence settings, categories, account and payment-mode labels, historical versions, flexible-budget spending entries and notes, and savings goals and progress.

Sharing information. Space names, memberships, roles, invitation email addresses, inviter details, invitation tokens, expiry and acceptance status. An inviter may provide your email address before you create an account. We use it to send and manage that invitation, not to sign you up for marketing.

Subscription information. Where Prep Plus purchases are enabled, we process your Prep user identifier, subscription product and store, access status, expiry, purchase verification results and a subscription-management link. RevenueCat and the relevant store or web checkout process purchase receipts, transaction identifiers and technical information needed to operate and verify purchases. Billing details entered at checkout are processed by the payment provider. Prep does not store full payment-card details.

Service and support information. Messages you send to support and the information needed to investigate them; email message content and delivery status; authentication, security, rate-limit and operational records. Our hosting and delivery providers may process IP addresses, request times and technical browser or device information needed to provide and protect their services.

Local information. Prep stores sign-in information, remembered accounts and preferences on your device or browser. Authentication secrets use platform secure storage on native devices and browser storage on the web. Remembered account details can include your name and email. Your device’s password manager operates under its own settings and privacy terms.

Prep does not require access to contacts, precise location, health records or your bank login. Avoid putting sensitive details about yourself or others into free-text names and notes.

3 Why we use information and our legal bases

Providing Prep and managing your account: to create and authenticate accounts, synchronise budgets, save settings, calculate results, deliver requested features and send essential account emails. The basis is performance of our contract with you under GDPR Article 6(1)(b). The same basis covers handling a support request needed to provide that service.

Sharing and invitations: to operate a shared space you request, we rely on performance of our contract with you. To send an invitation to someone who is not yet a user, we rely on our legitimate interest in facilitating a requested private invitation, balanced against the recipient’s interests. Recipients may object or ask us to stop further invitations.

Security and administration: to prevent abuse, limit automated requests, investigate faults and handle general enquiries or legal claims, we rely on legitimate interests under Article 6(1)(f): maintaining a reliable service, protecting users and resolving disputes. Where a law requires processing or disclosure, we rely on Article 6(1)(c). If we introduce processing that requires consent, we will ask separately; you may withdraw it without affecting earlier lawful processing.

Your email address and authentication details are needed to create and secure an account. Without them, we cannot provide an account. Other information is needed only for the feature you choose. You decide which budget records to enter and whether to join or invite people to a shared space.

Where you choose a paid subscription, we use subscription identifiers and status to provide paid access, restore purchases and handle subscription support under performance of our contract. Accounting records required by law are processed to comply with legal obligations.

4 Money Coach and automated insights

Money Coach currently uses built-in rules on the Prep backend. External AI providers are not enabled, and we do not send your budget information to an external AI provider for this feature.

If we introduce an external AI feature, we will update this policy before enabling it and explain the provider, the data sent, the legal basis, retention and available controls. Coaching tips are informational; they do not make decisions with legal or similarly significant effects on you.

5 Who receives information

Convex, Inc. supplies the backend, database and authentication infrastructure. Resend (Plus Five Five, Inc.) delivers essential emails such as verification codes, password resets, welcome messages and space notifications. Resend receives recipient addresses, sender details, email content and delivery status. Emails may contain codes, invitation links and member or space names, but not budget balances or transaction histories. Prep does not use email open-tracking pixels or click tracking.

Hetzner Online GmbH provides the server infrastructure for our public website and web app. Web requests can include your IP address, requested URL, request time, response status and technical browser information. We use technical request information to deliver pages, diagnose problems and protect the service.

Where subscriptions are enabled, RevenueCat, Inc. manages purchase verification and subscription access. It receives the Prep user identifier and purchase or technical information supplied by its SDKs and the purchase providers. Apple and Google process native store purchases; Stripe processes web checkout, payments and billing through the RevenueCat Stripe integration. Our integration does not send your budget records, balances or financial notes to these billing providers.

Members of a shared space can see its information according to their permissions. Apple, Google and any sign-in provider you choose process information under their own policies when you use their stores, operating systems or sign-in services.

We may disclose information where legally required, to protect rights or safety, or in a lawful business transfer with appropriate safeguards and notice. We do not sell your personal data or use it for third-party advertising.

6 Where information is processed

Nerrbase is established in the Netherlands. Our production Convex deployment is configured in the EU West region. Our web infrastructure is supplied by Hetzner Online GmbH, a German company. A provider’s registered office or a selected database region does not mean all support, subprocessors, email delivery or backup processing stays in that location.

Convex and Resend are US providers; their services and subprocessors may process personal data outside the European Economic Area, including in the United States. Transfers must be covered by a valid GDPR transfer mechanism, such as applicable adequacy decisions or the European Commission’s Standard Contractual Clauses with appropriate safeguards. Resend’s Data Processing Addendum includes these clauses. Convex’s processing agreement and subprocessor information describe its contractual framework.

For information about the safeguards applicable to your data, or a copy subject to necessary redactions, contact [email protected]. Provider information is available at https://www.convex.dev/legal/dpa, https://www.convex.dev/legal/subprocessors, https://resend.com/legal/dpa and https://www.hetzner.com/legal/privacy-policy/.

7 How long we retain information

Account and budget information is retained while needed to provide your account and the history you choose to keep. You can initiate deletion in Settings, then Delete account, or through https://getprep.app/delete-account. We ask you to confirm your account email and, for password accounts, your current password. Normal account access stops immediately. We keep your data for a 30-day recovery period, during which you can sign in and explicitly choose Restore account. Signing in alone does not cancel deletion. At the displayed deadline, restoration ends and automated permanent deletion begins. Cleanup runs in batches and may take additional processing time; it does not extend the recovery period.

Permanent deletion removes your user profile, authentication credentials, sessions and refresh tokens, budgets with no remaining members, associated financial history, spending entries, savings goals, cached insights, invitations and related application records. Budgets with remaining members stay available to those members. Your membership is removed, ownership is transferred where needed, and shared records are attributed to a remaining account. Shared record names and notes may still contain information you entered. Contact [email protected] about erasure of particular personal information in shared records or a privacy request without the recovery period. We assess such requests alongside other members’ rights and any applicable legal obligations.

Verification and password-reset codes expire after 15 minutes. Invitations expire after seven days. These expiry times prevent use of the code or invitation; they do not automatically delete every related authentication or invitation record. Such records are retained as needed to secure accounts, manage membership and investigate abuse.

Prep schedules cleanup of its transactional email outbox records after 30 days. Separate email-provider records are subject to the provider’s processing terms and configuration.

Support correspondence is retained for resolving the request and related follow-up or legal obligations. Technical and security records are retained according to the need to diagnose faults, investigate abuse, protect accounts and handle legal claims. These criteria also determine any justified retention after account closure. Backup copies may remain until their normal replacement cycle; they are not a separate basis for continuing active use of deleted information.

Locally stored sign-in details, remembered accounts and preferences remain until you remove them through account controls, browser or device settings. Contact support for the retention and deletion information applicable to a particular request.

Prep removes its local subscription-access records with account deletion. Deletion does not cancel an ongoing store or Stripe subscription. Payment providers have separate retention requirements for transaction, accounting, fraud-prevention and dispute records. Completed webhook identifiers are retained by Prep for 30 days to prevent duplicate processing; we do not retain the full webhook body in that log. Contact [email protected] for help with subscription data or provider records.

8 Security and local storage

We use measures such as authenticated access, role-based space permissions, hashed passwords and verification codes, protected server credentials, rate limits and encrypted network connections. Convex encrypts its underlying storage at rest. Prep also encrypts financial record names, amounts, percentages and notes, account names and descriptions, payment-mode names, savings-goal names and amounts, and cached coaching content before committing them to the database. This additional layer uses authenticated AES-256-GCM encryption, with separate backend keys for development and production. Keys are kept in private server configuration, outside the budget records and app bundles.

This is server-side encryption, not end-to-end encryption. Authorised backend functions decrypt these fields to provide Prep, and members of a shared space can still read the information their role permits. Account identity details, space names, currencies, schedules, dates, ownership and record relationships remain readable to the backend. This protection is intended to reduce what a database export alone reveals; it does not protect against access to both the backend and its encryption keys. Copies exported or backed up before this encryption was introduced may still contain readable information. No service can guarantee absolute security.

Prep uses local storage for functionality such as sign-in, remembered accounts, language and appearance. Blocking or clearing it may sign you out or reset preferences. Prep does not include advertising trackers. Any optional analytics or non-essential tracking introduced later will be explained and, where required, offered only with consent.

The public landing and legal website does not use analytics, advertising trackers, embedded third-party media or external font services. Visiting the website still involves technical requests to our hosting infrastructure. The public website can remember your chosen language in local storage. Language links still work if this storage is blocked. The separate web app uses functional browser storage for authentication and preferences.

9 Your choices and privacy rights

You can edit many account and budget details in the app. To request access, correction, erasure, restriction, or a portable copy of eligible data, email [email protected] from your account address. You can object to processing based on legitimate interests, including invitation processing. Where we rely on consent, you may withdraw it at any time. These rights apply subject to the conditions in data protection law.

For account deletion, use Settings, then Delete account, or visit https://getprep.app/delete-account. The standard flow includes the 30-day recovery period described above. If you cannot access your account, want to exercise an erasure right without that recovery period, or need help with retained shared information, email [email protected] with the subject “Delete my Prep account”. We may request proportionate identity verification; do not send a password or verification code. Your statutory privacy rights are not conditional on using the in-app flow.

We normally respond within one month. For a complex or numerous request, the law permits an extension of up to two additional months; we will tell you within the first month and explain why. Requests are normally free. You may complain to the Dutch Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl or to the supervisory authority where you live or work in the EEA.

10 Children and changes to this policy

Prep is intended for adults aged 18 and over. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action. We will update this policy when processing changes, display the revised effective date and explain material changes through appropriate channels. We will obtain consent where a change legally requires it.