Draft. Not in force, and not reviewed by counsel. Rendered from the working draft in the Opulen workspace (legal/03-privacy-policy.md). Bracketed text is a placeholder for details of the company's registration that are not final yet.
This policy explains what personal data Opulen processes, why, and what rights you have. We've written it to be read, not skimmed past. The short version:
Opulen is provided by Sigmastone [OÜ], [registered address], Estonia, registry code [number] ("Sigmastone", "we", "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).
Contact for anything about your data: privacy@sigmastone.io General support: support@sigmastone.io
We have not appointed a data protection officer, because the law does not require one for our kind of processing. Questions go to the address above and are answered by the people responsible for Opulen.
app.opulen.sigmastone.io.opulen.sigmastone.io and to our sign-in pages.Opulen is for adults. You must be 18 or older to use it.
| What | Why | Legal basis |
|---|---|---|
| Email address, first and last name, a technical user ID; your password, stored only as a secure hash by our sign-in provider and never seen by Opulen | To create your account, verify your email, let you sign in, and reset your password | Performing our contract with you (Art. 6(1)(b) GDPR) |
| If you sign in with Google: your Google account's email, name, profile picture link and Google user ID | The same, and to link your Google sign-in with an email sign-in of the same person (only if both email addresses are verified) | Contract (Art. 6(1)(b)) |
| What | Why | Legal basis |
|---|---|---|
| Everything you record in Opulen: books, accounts and categories, transactions (dates, amounts, descriptions, notes, reference numbers), budgets, currencies and prices | To provide the service: keeping your books, budgets and reports | Contract (Art. 6(1)(b)) |
| Statement files you upload (CSV, OFX, QFX), and the transactions parsed from them, including details such as counterparty names, account numbers and the original file columns | To import your statements after you review them, and to recognise transactions you have already imported | Contract (Art. 6(1)(b)) |
| Saved import settings | So you don't have to set up the same bank format again | Contract (Art. 6(1)(b)) |
| Your categorisation rules, and a statistical model trained only on your own history | To suggest where a transaction belongs. A suggestion is never applied without your approval | Contract (Art. 6(1)(b)) |
Where these records contain data about other people, the legal basis for that data is explained in section 8.
Financial records can indirectly reveal sensitive things, such as a pharmacy purchase or a donation. We do not ask for such information, we do not analyse your records to infer anything about you, and we never use them for any purpose other than showing your own books to you.
If you choose to connect a bank account:
| What | Why | Legal basis |
|---|---|---|
| Connection details: Salt Edge customer and connection IDs, bank name, consent period and status | To keep the connection working and to remind you before your consent expires | Contract (Art. 6(1)(b)) |
| Account information from your bank: account names and numbers (IBAN), account holder name, currency, balances, and transactions, including counterparty names, IBANs, BICs and payment references | To import your transactions automatically. They arrive in a review area first and reach your books only after you confirm them | Contract (Art. 6(1)(b)) |
How the connection works, and Salt Edge's role, is explained in section 6.
| What | Why | Legal basis |
|---|---|---|
| Your subscription status and plan, and the IDs Stripe assigns to you as a customer and to your subscription | To know which plan you are on and what it includes | Contract (Art. 6(1)(b)) |
| Name, email, billing country, VAT details, payment method, invoices | Payment and invoicing. These are entered on and held by Stripe; card details never reach our systems | Contract (Art. 6(1)(b)); keeping invoices is a legal obligation (Art. 6(1)(c)) |
When you accept our Terms of Service or this policy, we record which version you accepted, when, your user ID, your IP address and your browser's user agent. We keep this so that we can show what you agreed to if there is ever a disagreement. Legal basis: our legitimate interest in being able to prove our contract (Art. 6(1)(f)).
| What | Why | Legal basis |
|---|---|---|
| Server logs: which address of our service was called, the time, the result and the response time. Our application logs contain no request content and no sign-in tokens | To run the service, find faults, and detect and investigate abuse | Legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Network and sign-in logs kept by our hosting infrastructure: IP address, browser user agent, time, requested address | The same | Art. 6(1)(f) |
| Records of changes to your plan and of support actions on your account | Accountability, and answering your questions later | Art. 6(1)(f) |
We send service emails only: address verification, password reset, and notices about your subscription, your bank-connection consent or changes to our terms. We do not send newsletters or marketing. If you write to support, we process your message and email address to answer you (Art. 6(1)(b), or Art. 6(1)(f) where the question isn't about your contract).
Most data comes from you. Some comes from:
We use a small number of service providers. Where they act on our instructions ("processors"), a data processing agreement binds them.
| Recipient | Role | What for |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Processor | Hosting, databases, sign-in (Amazon Cognito), sending service emails and receiving support emails (Amazon SES). Our data is stored in the AWS Europe (Stockholm) region [confirm for all components before publishing] |
| Stripe Payments Europe, Ltd. (Ireland) | Processor, and for some purposes an independent controller | Payment processing, invoicing, tax calculation, fraud prevention. See Stripe's privacy policy: https://stripe.com/privacy |
| Salt Edge ([legal entity, to confirm]) | Independent controller for its licensed account information service | Bank connections; see section 6 |
| Google Ireland Limited | Independent controller | Only if you choose "Sign in with Google": https://policies.google.com/privacy |
| Your bank | Independent controller | Authenticating you and providing your account information when you connect it |
| [Accountant / tax advisor] | Independent controller, bound by professional secrecy | Our own bookkeeping (invoices, not your financial records) |
| Authorities and courts | As required by law | Only when we are legally obliged to disclose |
Opulen does not connect to banks itself. When you connect a bank account, you are using an account information service provided by Salt Edge, which is authorised to provide this service under the EU Payment Services Directive (PSD2).
We store your data in the EU. Some of our providers belong to groups based in the United States (Amazon, Stripe, Google) and may access data from there, for example for support or security. Such transfers are protected by the EU–US Data Privacy Framework (where the provider is certified) and by the European Commission's Standard Contractual Clauses in our agreements with them. You can ask us for a copy of the relevant safeguards at privacy@sigmastone.io.
Salt Edge: [location of processing and transfer safeguard, from the partner agreement; Salt Edge group companies include entities in the United Kingdom (covered by an EU adequacy decision) and in Moldova (not covered, so SCCs would be needed)].
Opulen users record their own financial lives, so their records name other people: the person who paid them back, their landlord, a counterparty's bank account. We process this data only as part of the user's records, only to provide Opulen to that user, and never for any purpose of our own. Legal basis: the legitimate interest of the user, and ours as their service provider, in keeping complete and accurate personal finance records (Art. 6(1)(f)). The interference with the people named is small, because the data stays inside that user's private records. Informing each such person individually would be impossible or would require disproportionate effort (Art. 14(5)(b) GDPR), so this section serves as that information. If you believe your data is in a user's records and want to exercise your rights, contact privacy@sigmastone.io.
Honest note on encryption: your financial records are encrypted in transit and at rest, but not end-to-end. Our systems can read them to show them to you. Encryption that would keep your records hidden from us is a research goal of the project, not a feature of this version.
| Data | Kept for |
|---|---|
| Account and financial records (including bank connection data and categorisation) | As long as your account exists. Deleted when you close it. If your paid plan ends, your data stays and you can still read and export it. If we end your contract, deleted [30] days later, so you can export first |
| Uploaded statement files | Deleted as soon as the import is completed or cancelled, and in any case after 24 hours |
| Imported transaction details used to detect duplicates | As long as the account (in Opulen) they belong to exists |
| Saved import settings | Until you delete them or close your account |
| Backups | Up to [14/35] days after deletion from the live system, then overwritten |
| Application logs | 30 days |
| Network and sign-in logs | Up to 90 days |
| Records of your acceptance of our terms, and records of plan changes and support actions | 3 years after your account is closed |
| Invoices and accounting records | 7 years after the end of the financial year, as required by accounting law |
| Support emails | 2 years after our last exchange |
Under the GDPR you have the right to:
Your right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (sections 3.5, 3.6 and 8), you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.
Write to privacy@sigmastone.io. We answer within one month. We may ask you to confirm your identity, normally by writing from the email address of your account.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), [Tatari 39, 10134 Tallinn], info@aki.ee, www.aki.ee.
You are not legally obliged to provide personal data. Your email address and name are needed to create an account, and without them we can't provide Opulen. Payment details are needed for a paid plan. Connecting a bank is optional; you can import statement files or enter transactions by hand instead.
We only use storage that is strictly necessary for Opulen to work, so we don't ask for cookie consent:
| Name / type | Purpose | Duration |
|---|---|---|
| Sign-in tokens (browser local storage, set by Amazon Cognito / AWS Amplify) | Keeping you signed in | Until you sign out or the session expires |
Sign-in session cookie at auth.opulen.sigmastone.io (Amazon Cognito) |
The sign-in flow | Session / [duration] |
| Selected book and your settings (language, theme), in local storage | Remembering your choices | Until you clear them |
sidebar_state cookie |
Remembering whether the sidebar is open | [7 days] |
We don't use analytics or advertising cookies, and we don't load third-party trackers.
When we change this policy, we publish the new version here with a new version number and date. For material changes, we tell you by email or in the app before they take effect. Previous versions are available at [link].
Sigmastone [OÜ], [address], Estonia — privacy@sigmastone.io