Privacy Policy

1. What data we process

• Account data: email, name (if you provide it), password (stored as a hash, never in plain text) and, if you sign in with Google or GitHub, the identifier and email that provider shares with us.
• Financial content entered by you or your authorized agents: accounts, transactions, balances, budgets, investments, notes and receipts. This is the most sensitive category and we handle it with the greatest care.
• Subscription and payment data: which plan you have, subscription status and charge metadata. Your card details are processed by Mercado Pago or Dodo Payments; they never reach our servers.
• Technical and usage data: IP address, device and browser type, access and error logs. We use them for security and to keep the Service working.
• Support: the messages you send us when you write to us.

2. What we use it for (and on what basis)

• Providing you the Service: storing and displaying your data, calculating totals and summaries, syncing exchange rates and prices. Basis: performance of the contract.
• Charging your subscription and issuing receipts. Basis: performance of the contract and legal obligations.
• Security and abuse prevention: logs, usage limits, detection of unauthorized access. Basis: legitimate interest.
• Transactional emails (account verification, password recovery, notices of material changes). Basis: performance of the contract.
• Improving the product with aggregated usage metrics. Basis: legitimate interest.

We do not use your financial content for advertising and we do not sell it to anyone. We do not train AI models with your data.

3. AI features

Some Whallet features use AI models (for example, smart categorization or statement import). When you use them, the data strictly necessary for that operation is sent to the corresponding AI provider:

• If you configured your own keys (BYOK), the data goes directly to the provider you chose, under that provider’s terms and privacy policy.
• If you connect an AI agent via MCP (for example Claude), that agent accesses your data with the token you created, under your authorization and control: you can limit its permissions and revoke the token at any time. The agent provider handles that data under its own policy.

4. Who we share data with (subprocessors)

We do not share your data with anyone, except the providers we need to operate the Service:

• Supabase (database and authentication), hosted on AWS, region sa-east-1 (São Paulo, Brazil).
• Vercel (hosting and delivery of the application), United States.
• Mercado Pago (payments in Argentina) and Dodo Payments (payments as Merchant of Record in the rest of the world).
• Resend (transactional email delivery).
• Google AdSense (only if you use the Free plan; see the advertising section).

The public price sources (for example Yahoo Finance or CoinGecko) work in the opposite direction: we ask them for market prices; none of your data travels to them.

We may also disclose data if a law or a competent authority requires us to.

5. Advertising on the Free plan (Google AdSense)

The Free plan displays a single Google AdSense ad at the end of the content. Paid plans do not show advertising and do not load any ad scripts.

About that ad, you should know that:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this or other websites.
• The use of advertising cookies by Google and its partners enables them to show you ads based on your browsing across the internet.
• You can opt out of personalized advertising in Google’s ad settings (adssettings.google.com) or at www.aboutads.info.
• We never target advertising with your financial data: the ad knows nothing about your transactions, balances or accounts.

6. Cookies

We use essential cookies to make the Service work: your session (authentication) and your language and theme preferences. Without them the app does not work, so they are always active.

The only non-essential cookies are those of the ad provider, and they only load if you use the Free plan (see the previous section).

7. How long we keep your data

• While your account exists, we keep your data to provide you the Service.
• If you delete your account, your data is deleted from production systems within 30 days. Encrypted backups may persist for up to 90 more days before they are rotated out.
• Billing data is retained for the period required by Argentine tax and commercial regulations (up to 10 years).
• Free accounts inactive for more than 12 months may be deactivated and deleted, always with prior notice by email.

8. International transfers

Your data is hosted primarily in Brazil (AWS sa-east-1 via Supabase), a country whose data protection law (LGPD) offers an adequate level of protection. Some subprocessors (Vercel, Resend, Google) process data in the United States or other jurisdictions, with standard contractual safeguards.

9. Your rights

You can exercise your rights of access, rectification, updating, deletion and portability at any time (export your data from the app, or ask us). To exercise them, write to hola@whilehaus.net; we respond within the legal timeframes.

If you are in Argentina: access to your data is free of charge at intervals of no less than six months, unless a legitimate interest justifies more frequent access (Ley 25.326, Argentina’s Personal Data Protection Act, sections 14 and 16). The Agencia de Acceso a la Información Pública (AAIP), the government agency that enforces Ley 25.326, handles complaints and claims from anyone whose personal data protection rights have been affected.

If you are in the European Union or the United Kingdom, you also have the rights granted by the GDPR (including restriction of processing, objection, and lodging a complaint with your supervisory authority). If you are in a US state with a privacy law, you have the equivalent rights under that law.

10. Minors

Whallet is for people 18 and older. We do not knowingly collect data from minors; if we detect an account belonging to a minor, we delete it.

11. Security

We protect your data with encryption in transit (TLS), per-user isolation at the database level (row-level security), password hashing and restricted internal access. No system is infallible: if we detect an incident affecting your data, we will notify you in accordance with applicable law.

12. Changes to this policy

We may update this Policy. If a change is material, we will notify you by email or within the app before it takes effect. The date of the last update appears at the top.

13. Contact

For any privacy questions or to exercise your rights: hola@whilehaus.net.

Martin Bonafede (Whilehaus), CUIT 20-33215496-7, Av. Rivadavia 5785, floor 15, apartment 1, City of Buenos Aires (postcode 1406), Argentina.