Privacy
Saldo reads the statements from your bank to show you where your money goes. That's sensitive data, so this page says exactly what I keep, why, who else can see it and how you delete it. In short: I use it only so that Saldo works for you, I don't sell it, I don't show ads and I don't give it to anyone not listed here.
Who is responsible for your data
The data controller is Milica Tešić PR, registration number (matični broj) 68065615, tax number (PIB) 115064324.
For anything about your data, write to info@saldofinansije.com. I reply within 30 days at the latest.
What data I keep
- Account: the name and email address you enter when you create your account.
- Waiting list: if you sign up while Saldo is open by invitation only, I keep your name, email and the date, so I can let you know when I open. I delete them when you create an account or when you ask me to.
- The statements you upload: the original files, and the transactions read from them: date, amount, currency, the name of the payee or payer, the description and the account balance. Statements also contain data about other people, for example the name of the person money was sent to or who paid you. I keep it only as part of your statement and use it for nothing else.
- What you enter yourself: categories, cash expenses, your wallet balance, split bills.
- Subscription: the date you signed up, the date your account is paid until, your payment code, and for every payment the amount, date and the payer's name as my bank shows it.
- Signing in: for sign-in links and signed-in devices I keep only an encrypted fingerprint, never the link or the cookie itself. There are no passwords.
I don't ask for and don't keep e-banking passwords, PINs, card numbers or access to your bank account.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| So that Saldo can read your statements, sort the transactions and show them to you | The contract with you, that is the service you use (Article 12(1)(2) of the Personal Data Protection Act, ZZPL) |
| Signing in, sign-in emails, subscription reminders | The contract with you (as above) |
| Records of payments and invoices | A legal obligation (Article 12(1)(3) ZZPL) |
| Other people's names in your statements (who paid you or who money was sent to) | A legitimate interest in showing you your statement in full, with no other use at all (Article 12(1)(6) ZZPL). I can't contact these people individually, so this information is published here (Article 24(5) ZZPL). |
You need a name and email to create an account, and statements so that Saldo has something to show. Nobody obliges you to provide them, but without them Saldo can't work. No data protection officer has been appointed, because the law doesn't require one for this kind of processing.
I don't build advertising profiles, I don't sell data and I don't use your transactions for anything other than showing them to you. Saldo doesn't give financial advice and doesn't make automated decisions about you.
Who else can see the data
Only the service providers Saldo can't work without, and only as much as they need:
| Who | For what | Where |
|---|---|---|
| Hostinger International Limited, Cyprus | The server Saldo runs on and stores data on, including your statements | USA (Boston) |
| Resend, Inc. | Sending emails: your address and the text of the email (sign-in link, reminder) | Emails go through servers in Ireland, but Resend keeps the records of sent emails in the USA |
| Zoho Corporation | Receiving the emails you send to info@saldofinansije.com | EU |
| Google Ireland Limited | Google Analytics on the saldofinansije.com website, only with your consent (see Cookies): pages visited, device, approximate location. Never data from the app. | EU and USA |
| Microsoft Ireland Operations Limited | Microsoft Clarity on the saldofinansije.com website, only with your consent (see Cookies): how the page is used (scrolling, clicks), device, approximate location. Never data from the app. | EU and USA |
The data processing terms each of them has published apply. In its data processing agreement Resend commits to the EU standard contractual clauses and states that it is certified under the EU-US Data Privacy Framework. I give data to public authorities only when the law requires it.
How long
- For as long as your account is active, or paused until you pay.
- If your account stays unpaid, it is frozen. After 12 months frozen the data is deleted, and before that you get two warning emails.
- When you delete your account yourself, statements, transactions, answers and categories are deleted straight away.
- Payment records (amount, date, code, payer) are kept for five years from the end of the year the payment arrived in, because the law requires them for the books (Article 48 of the Personal Income Tax Act).
- The server's backups delete themselves after 30 days, so deleted data disappears from them by then at the latest.
How it is protected
Saldo only works over an encrypted connection (HTTPS). Only the Saldo program can read statements on the server, and they are kept separate for each user, so nobody can see anyone else's data. You sign in with a link that is valid for 15 minutes and works once.
Your rights
You have the right to ask for access to your data, correction, deletion, restriction of processing and data portability, and to object (Articles 26, 29, 30, 31, 36 and 37 ZZPL). Two of these rights are built straight into Saldo, with no emails to write:
- Download your data: on the Statements page, a button gives you everything in one file, and it works even when your account isn't paid.
- Delete your account: on the same page, deletes everything at once.
For everything else, write to info@saldofinansije.com. If you think I am processing your data against the law, you can file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, poverenik.rs.
Cookies
In the app (app.saldofinansije.com, where your statements are) there is only one cookie, the one that keeps you signed in. Without it signing in doesn't work, so it doesn't need separate consent (Article 160(5) of the Electronic Communications Act). The app has no Google Analytics, advertising or other tracking, and everything it loads, fonts included, comes from Saldo's own server.
On this website (saldofinansije.com, the pages that describe Saldo) I use Google Analytics and Microsoft Clarity, but only if you choose "Accept" on the bar at the bottom of the page. They then set their own cookies (Google's start with _ga, Microsoft's are _clck and _clsk). Google Analytics records which pages you visit, where you came from (for example a Google search), the type of device and your approximate location. Clarity records how you use the page: how far you scroll, where you click and how the mouse or your finger moves, and from that it makes a recording of the visit and a click map; it doesn't record the text you type into fields. I use this only to see how many people come, what interests them and what isn't clear on the page. The legal basis is your consent (Article 160(4) of the Electronic Communications Act and Article 12(1)(1) ZZPL). If you choose "Decline marketing" or choose nothing, neither of them loads.
You can change your choice at any time through the "Cookies" link at the bottom of every page on the website. If you withdraw consent, their cookies on this website are deleted. Neither Google Analytics nor Clarity ever sees your statements, transactions or account.
Changes
If anything here changes, the new version is published on this page with a new date, and for important changes you get an email before they take effect.