Privacy policy

This policy explains what personal data Shortbread collects, why, who it is shared with and the rights you have. Shortbread is operated by [legal entity name], [registered address] ("we"). We are the controller of your account data. For the financial data you put in your workspace, we process it to provide the service to you.

What we collect

• Account details: your name, email address, password hash, two-factor secrets (encrypted) and, if you use single sign-on, the account id from that provider.
• Financial data you add or connect: accounts, balances, transactions, categories, merchants, goals, receipts, people and tax residency. Account numbers, wallet addresses, tax ids, bank connection keys and receipt files are encrypted.
• Technical data: sessions, IP address and browser details for security and rate limiting, and an audit log of changes in your workspace.
• Product analytics: which pages and features are used. Analytics events never contain amounts, balances, account numbers or merchant names.

Why we use it

• To provide the service you signed up for (contract).
• To keep accounts secure, prevent abuse and fix problems (legitimate interests).
• To send account emails such as verification and invitations (contract), and product news only if you opt in (consent).
• To meet legal obligations, for example responding to lawful requests.

We do not sell your data, and we do not use your financial data for advertising.

Who we share it with

We use these kinds of service providers, each bound by a data processing agreement. You can ask us for the current list of providers at privacy@shortbread.money.

• Hosting and database providers ([region]).
• Email and product analytics, without financial data.
• Single sign-on, if you choose to sign in with an existing account.
• Bank data provider, if you connect a bank feed, using a key you provide.
• AI provider, only if a workspace owner turns on AI features. Then the descriptions, merchant names, amounts, dates and categories needed to answer are sent per request. Account numbers, tax ids and wallet addresses are never sent. Receipt files are sent only if the owner also turns on receipt reading, so the AI can read the merchant, date and total. Our AI provider does not train models on this data.

Exchange rates, crypto prices and public blockchain balances are fetched from public sources without your personal details (for wallets, only the public address is sent).

Some providers are outside your country. Where data leaves the EEA or Australia, we rely on adequacy decisions or standard contractual clauses.

How long we keep it

We keep your data while your account is active. When you delete a workspace, its data is deleted from the live database straight away and from backups within [backup retention period]. When you delete your account, we remove your personal data except where the law requires us to keep it.

Your rights

Depending on where you live (including under the GDPR and the Australian Privacy Act), you can ask to access, correct, export or delete your data, object to or restrict some processing, and withdraw consent. You can export and delete your data yourself in Settings, or email privacy@shortbread.money. You can also complain to your data protection authority, for example the CNPD in Portugal or the OAIC in Australia.

Security

See our security page for how we protect your data.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.

Contact

privacy@shortbread.money