This privacy policy is applicable to the Let's Save app for mobile devices and web browsers, together with any related services operated by Axceera (Private) Limited (collectively, the "Application"). Axceera (Private) Limited is hereinafter referred to as the "Service Provider".

Let's Save is a personal finance application. The records it holds about you are, by their nature, sensitive, and this policy is written to say plainly what is collected, where it goes, and how long it stays.

Data Controller Information

Axceera (Private) Limited acts as the Data Controller responsible for the processing of your personal data.

Name: Axceera (Private) Limited
Address: 157/3 Kadawatha Road Nadimala Dehiwala, 10350 LK
Email: hello@letssave.app

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application collect?

Everything below is either given to you by you, produced by your own use of the service, or generated by the Application from your records. The Application buys no data about you from anyone.

Account and profile data

Your email address, your first and last name, and the display name derived from them.
Your chosen base currency and display language.
Optional answers given during onboarding: a primary savings goal and an income band. Both steps are skippable, and skipping them is stored as an answer never given rather than as a default.
Your subscription tier, and identifiers issued by the payment provider or app store so that a purchase can be matched to your account.

Financial records

The financial accounts you create: name, type, currency and balance.
Transactions: amount, currency, date, description, merchant or payee, category, and the account involved, together with the base-currency value computed at the exchange rate for that transaction's own date.
Categories and subcategories, budgets and spending limits, savings and debt goals and the contributions you log against them, forecast scenarios, and any savings or affordability plan you generate or accept.
Statements you choose to import, and the rows extracted from them.
If you enable SMS capture on Android, the last four digits of an account number, so that a bank alert can be matched to the right account. See the appendix at the end of this policy.

Technical data

The IP address and the browser or device user agent recorded against each sign-in session, kept so that a session can be recognised and secured.
A device registration token, if you enable push notifications on a mobile device.
Ordinary request logs generated by the hosting infrastructure in the course of serving requests.

What the Application does not collect

It does not collect your device's location. The mobile application requests no location permission. When you first sign up, the country your request arrives from (as reported by the hosting network, from your IP address) is read once to pre-select a likely currency. That country is used for the suggestion and is not stored.
It contains no advertising, no advertising identifiers, and no attribution or social-network SDK. Nothing you do inside the Application is ever reported to an advertiser. It does include two kinds of measurement, both named in the processor list below. Crash reporting (Firebase Crashlytics in the mobile applications, Sentry on the web and desktop) records what failed and where, never what you were doing, and runs by default because it is what allows a broken screen to be fixed at all. Usage analytics (Firebase Analytics and Firebase Performance) records which screens are opened and how quickly they load. It runs by default, it is described in full in the processor list below, and you can switch it off at any time under Settings → Privacy & data, which stops it on that device immediately. Neither ever receives your balances, your transactions, the names of your accounts or categories, or anything you type.
It has no connection to your bank and cannot read your accounts. It knows only what you type in, import from a file you hold, or confirm from an alert on your own device. Connecting a bank account through Salt Edge is a planned optional feature that is not available yet. When it is offered, nothing is read from any bank unless you choose to link an account, and the Salt Edge entry in the processor list below describes what happens then.
The Service Provider never receives your card number or bank account number. Payment details are entered directly with the payment provider or app store; only a summary such as the card brand and its last four digits is reported back and displayed to you.

Registration is required to use the service, because the records are stored against an account. The Service Provider uses your email address to send messages necessary to operate that account: sign-in codes, email verification, the confirmation link for account deletion, and a copy of your data when you request one. Two further kinds of email can each be switched off at any time, under Settings → Notifications or from the link at the foot of every one: a month-end summary of your own figures, included with paid plans, and occasional tips, product news and offers about the Application. The second is direct marketing to an existing customer about the Application itself, sent on the basis of legitimate interests; you are told about it when you sign up and can object to it there, in Settings, or in any such email.

The launch waitlist

If you leave your email address in the "notify me" form on the website before the Application is generally available, the Service Provider stores that address, the language the site was shown in, and which button opened the form. Nothing else is kept with it: no name and no browsing history. Your IP address is used for up to an hour to stop automated sign-ups and is not stored with the address. On the basis of your consent, the address is used for two things: one email sent straight away to confirm the sign-up, and telling you when the Application launches. It is held by Brevo, which sends the launch email for the Service Provider, while the confirmation goes out through Cloudflare; it is not shared with anyone else or added to any other mailing list. It is deleted automatically 12 months after you gave it. To be removed sooner, write to hello@letssave.app.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data:

Contract performance: processing necessary to provide the Application to you (storing and displaying your records, running the features you use, and administering your subscription).
Consent: where you have given explicit consent to an optional feature, such as SMS capture or push notifications. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Legitimate interests: where processing is necessary for specific legitimate interests of the Service Provider, such as maintaining network and information security, preventing fraud and abuse, diagnosing faults, measuring which screens are used and how quickly they load so that the Application can be improved, and telling existing customers about the Application's features and offers by email, provided those interests are not overridden by your data protection rights or fundamental freedoms. You can object to processing on this basis, and you can do so directly: for usage measurement by switching it off under Settings → Privacy & data, and for tips, news and offers under Settings → Notifications.
Legal obligation: to comply with laws, tax and accounting requirements, or lawful government requests.

Cookies and similar technologies

The web application sets one strictly necessary cookie: the session cookie that keeps you signed in. No consent is required for a cookie of that kind. The usage analytics described above set their own measurement cookies as well, from the first time you open the Application; switching usage analytics off under Settings → Privacy & data stops the collection on that device immediately, and no further measurement cookies are set.

The Application sets no advertising cookies and embeds no third-party pixels or beacons. The only measurement cookies it can set are those of the usage analytics described above, which you can switch off at any time. The mobile applications use no cookies at all; they hold a session token in the device's own secure preference storage, and record your analytics preference in the same place.

Automated decision-making and profiling

The Application does not make automated decisions that produce legal effects concerning you or that similarly significantly affect you. Its AI features extract data and propose plans for you to review, edit, accept or reject; nothing is written to your account, and no decision about you is acted on, without your confirmation. Where the law nonetheless gives you rights in relation to automated processing, you may exercise them by writing to hello@letssave.app.

Does the Application use Artificial Intelligence (AI) technologies?

Yes, in the places listed below and only those. All of them use Google's Gemini model, accessed as a service from Google. What is sent is limited to what the feature needs.

Statement import

CSV, spreadsheet and OFX files are read inside your own browser and the files themselves are never uploaded, not to the Service Provider and not to Google. The rows read from them are sent to the Service Provider to be imported, and are held for at most seven days while an import is being prepared, then deleted whether or not it was completed.
On the Pro plan, PDFs, photographs of statements and statement text you paste are sent to the model so that their rows can be read. When a PDF contains text, that text is read in your browser and only the text is sent; a scanned PDF or a photograph is sent as it is, and includes whatever the statement itself contains. Runs of digits long enough to be an account or card number are shortened to their last four digits before text is sent.
Also on the Pro plan: the column headings and a few example rows of a file you are importing, to work out how its columns should be read; and the names of the categories in the import and of your own categories, to work out which match.
On the Pro plan, when an import finishes, the names of the spending categories in it and each one's rounded share of the total are sent so that a short summary can be written and kept with the import. No amounts and no currency are sent.
On the Pro plan these happen automatically, without asking each time. The screen where Pro is bought says that it uses AI on your imports and sends what it needs to a third-party AI service, so choosing Pro is agreeing to it. You can turn all of it off under Settings → Privacy & data, after which nothing from your imports is sent to an AI provider.
The uploaded file is not stored. It is held only for the duration of the request and then discarded; the Service Provider keeps the extracted rows you confirm, and not the document they came from.

Savings plans, questions and monthly reports

Three features share one path: proposing which spending limits a new savings plan should start from, answering a question you ask about a plan, and writing the short commentary at the top of a plan's monthly report.
A summary of your finances is sent to the model: totals and averages by category over recent months, income and expenditure, your goals, and the figures relevant to the question you asked. Your name, your email address and your account identifiers are not sent.
The arithmetic is not done by the model. It proposes which category to adjust and by what proportion, or names one of a fixed set of actions; every monetary figure shown to you is calculated by the Service Provider's own systems from your own ledger.
Unlike statement import, the results of these three are kept. A question you ask and the answer you were given are stored against the plan so that you can read the conversation again later, and a monthly report's commentary is stored with that report. Both are deleted when you delete the plan they belong to, and when you delete your account.

Google processes this content as a service provider, under its own terms and privacy notice, which are linked below. The Service Provider does not train any model on your data and does not use your records for any purpose other than delivering the feature you asked for.

All of them are optional. If you are not on Pro or turn off AI on imports, and never create a savings plan, nothing about your own finances is ever sent to an AI provider. Records shared with you by another person are excluded from these features unless the person who shared them has explicitly allowed it, which is off by default.

Do third parties see or have access to your information?

The Service Provider does not sell your personal data, does not rent it, and does not share it for advertising or for any form of cross-context behavioural targeting. Apart from people you have personally invited to share your records (described in the sharing section below), your data is disclosed only to the service providers listed here, each of which processes it on the Service Provider's instructions for one stated purpose.

Cloudflare: hosting, the database in which your account and financial records are stored, caching, and delivery of the Application itself. Cloudflare holds all of the data described in this policy in the course of storing it. It also sends the emails needed to operate your account (sign-in codes, invitations, exports and similar), so it receives your email address and the contents of those messages.
Google (Gemini): reading statements you upload, suggesting how an import should be read and summarising it, and generating the savings and affordability guidance described above. Receives only what that section describes.
Google (Firebase Cloud Messaging): delivering push notifications to Android and iOS devices. Receives your device registration token and the text of the notification, which is generated from your own records.
Google (Firebase Crashlytics): diagnosing crashes and errors in the mobile applications, so a fault that stops the app working can be found and fixed. Receives the technical description of the failure (the error, the place in the program's code it came from, the device model and its operating system version) together with your account identifier, so that one person hitting a fault repeatedly can be told apart from many people hitting it once. It receives none of your financial records and is not used to observe what you do in the Application.
Google (Firebase Analytics and Firebase Performance): measuring which screens are used and how quickly they load, so that the slow and the unused parts of the Application can be found. It runs by default and can be switched off at any time under Settings → Privacy & data, which stops it on that device immediately. Receives the name of the screen you opened, the name of an action you took (that a transaction was created, never the transaction), the speed of the Application and of its network requests, your account identifier, your plan, your language and the platform you are using. It never receives amounts, balances, merchant names, the names of your accounts or categories, or anything you type.
Functional Software, Inc. (Sentry): diagnosing crashes and errors in the web and desktop applications, which Firebase Crashlytics does not cover. Receives the technical description of the failure (the error, the place in the program's code it came from, and the browser or application version) together with your account identifier and the screen you were on. The contents of the failed request are never included, and the query string is removed from any web address before it is sent.
Google and Apple: sign-in, where you choose to sign in with a Google or Apple account, and the App Store and Google Play subscription systems where you buy a subscription on a mobile device.
Brevo: sending the month-end summary and tips, news and offers, and the account emails described above when Cloudflare cannot deliver them. Receives your email address and the contents of those messages. It also keeps a contact record used to decide which tips and offers are relevant: your first name, language, plan, subscription status, sign-up and last-active dates, and yes/no facts such as whether you have recorded a transaction or set a goal. That record never contains amounts, balances, categories or transactions, and it is deleted when you delete your account.
Paddle: the merchant of record for subscriptions bought on the web. Paddle, not the Service Provider, is the seller of record: it sells you the subscription, calculates and remits the tax due in your country, and is what appears on your card statement. It receives your email address, your billing address and the payment details you enter with it directly; the Service Provider stores only a customer identifier and the summary Paddle reports back, and never sees your card number.
RevenueCat: validating and managing subscriptions bought through the App Store or Google Play. Receives an application user identifier and the purchase record, not your financial records.
Open Exchange Rates: supplying daily exchange rates. It receives no personal data at all; rates are requested for currencies, never for users.
Salt Edge: the optional bank connection feature, which is not available yet; until it is, Salt Edge receives no data about you. Once it is available, and only where you choose to link a bank account, Salt Edge connects to your bank and retrieves the transactions and balances of the accounts you authorise. It receives the authorisation you give at your bank and returns those records to the Application; the Service Provider stores the connection and the resulting transactions, never your bank credentials, which are entered at your bank or at Salt Edge and never reach the Application.

The Service Provider may also disclose your information:

as required by law, such as to comply with a subpoena or similar legal process;
when it believes in good faith that disclosure is necessary to protect its rights, protect your safety or the safety of others, investigate fraud, or respond to a lawful government request;
to a successor entity in the event of a merger, acquisition or sale of assets, in which case you will be notified before your data becomes subject to a different privacy policy.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose data protection obligations equivalent to those described in this Privacy Policy.

Each of these providers has its own privacy policy governing what it does with what it receives. Links are below.

International Data Transfers

Your account data and financial records are held on Cloudflare's distributed infrastructure and may be stored or processed in data centres outside your own country, including outside the European Economic Area. The other service providers listed above operate globally and may likewise process data outside the EEA.

Where such transfers occur, the Service Provider relies on an appropriate transfer mechanism required by GDPR Chapter V:

Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs) approved by the European Commission
Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

What are your choices and opt-out rights?

The following are available to you directly inside the Application, without asking anyone:

Download your data. Settings → Privacy & data will give you your entire account as a single JSON document, your transactions as a CSV file, or a zipped copy emailed to your registered address. Password hashes, sign-in tokens and third-party access tokens are excluded from every export.
Delete your account. Settings → Privacy & data begins deletion. A confirmation link is emailed to you, and nothing is erased until you open that link in the same browser, so neither a stolen session nor an intercepted link is enough on its own.
Notification preferences. Choose which push notifications you receive, or switch them off entirely.
SMS capture. Turn it off at any time in the Application or in your device's own settings. See the appendix at the end of this policy.
Tips, news and offers, and the month-end summary. Switch either off under Settings → Notifications, use the unsubscribe link in any of those emails, or write to hello@letssave.app. This does not stop the transactional messages needed to operate your account, such as sign-in codes.

Uninstalling the mobile application stops it from collecting anything further from your device, but does not by itself delete your account or the data already stored. Use the deletion described above for that.

You may also exercise any of these rights, or ask anything about them, by writing to the Service Provider at hello@letssave.app.

How long is your data kept?

While your account exists and remains on a paid tier, your records are kept, because the records are the service: a transaction from three years ago is still part of your dashboard and your reports. On the free tier a retention schedule applies: the most recent months stay visible, older records are hidden, and records older still are eventually marked for deletion and then permanently erased. You are notified by email before anything is deleted, the schedule and the dates are shown in the application, subscribing restores everything that has not yet been erased, and the export is available at any time on any tier.

The deletion stages of that schedule take effect no earlier than 2026-09-14. Nothing is erased under it before that date.

When the account goes, everything goes with it:

On deletion, every record belonging to the account (profile, financial accounts, transactions, categories, budgets, goals, contributions, forecasts, plans, notifications, device tokens, import history and sign-in credentials) is erased immediately and permanently in a single operation. There is no grace period and no retained archive copy.
Any sign-in codes and account-deletion links outstanding for your email address are invalidated at the same moment, so none of them outlives the account.
Cached analytical results are keyed so that nothing can address them again after deletion, and they expire on their own within minutes.
Sign-in sessions, and the IP address and user agent recorded against them, are removed when the session expires or when you sign out.
Backups taken by the hosting provider for disaster recovery may retain a copy for up to 30 days before being overwritten in the ordinary course.
Billing and tax records held by the payment providers are retained for the period their own legal obligations require. These identify a payment and a customer, not your financial records.
Data that has been aggregated or anonymised so that it no longer identifies you may be retained indefinitely.
Launch-waitlist addresses are deleted automatically 12 months after they were given, or sooner if you ask.

You have the right to request deletion of your personal data at any time, except where retention is required by law. The in-app path above is the fastest; you may also write to hello@letssave.app.

Data Deletion

To delete your account and all data associated with it, open Settings → Privacy & data inside the Application and choose to delete your account. You will receive a confirmation email; opening the link in it completes the deletion immediately and irreversibly.

If you cannot reach the Application (for example, if you have lost access to the account), write to the Service Provider at hello@letssave.app. Upon verification of your identity, the Service Provider will delete your personal data from its systems within the timeframes required by applicable law, except where retention is required for legal compliance.

How does the Application address children's privacy?

The Application is not intended for children under 16 years of age, or under a higher age of digital consent where applicable law establishes one. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, it will delete this from its servers immediately. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (hello@letssave.app) so that the necessary action can be taken.

How is your information kept secure?

Traffic between your device and the Application is encrypted in transit using TLS, and data is stored on infrastructure that encrypts it at rest. Where an account has a password, the password itself is never stored, only a scrypt hash of it. Sign-in tokens and third-party access tokens are held only as long as they are valid, and are excluded from every data export.

Access is limited to the people who need it to operate, develop or support the Application. The Service Provider implements physical, electronic and procedural safeguards to protect the information it processes and maintains. However, no security system can prevent every possible breach, and no such assurance is given here.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. You will be notified of material changes by the posting of an updated policy carrying a new effective date, and, where the change materially affects how your data is used, by a notice in the Application or by email before it takes effect. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at hello@letssave.app.

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

Right of Access: You can request access to your personal data. The Application's own export gives you this immediately.
Right to Rectification: You can request correction of inaccurate data, and can edit most of it directly in the Application.
Right to Erasure: You can request deletion of your personal data (the "right to be forgotten"), or delete your account yourself as described above.
Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format. The JSON and CSV exports in Settings → Privacy & data are provided for exactly this purpose.
Right to Object: You can object to processing based on legitimate interests, including the usage measurement described above, which you can switch off yourself, at any time, under Settings → Privacy & data. You have an absolute right to object to processing for direct marketing purposes at any time.
Right to Withdraw Consent: Where processing is based on your consent (SMS capture, push notifications), you can withdraw it at any time by toggling the relevant setting in the Application or by contacting the Data Controller.
Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you, as described above.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country's Data Protection Authority can be found at:

https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner's Office at:

https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

The Service Provider does not sell personal information, and does not share it for cross-context behavioural advertising.

It has not done so in the preceding twelve months, and it has no advertising or analytics partners to sell or share it to. The right to opt out is therefore stated here for completeness rather than because there is anything to opt out of.

To exercise any of these rights, please contact the Service Provider at hello@letssave.app. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature: enabling SMS capture or allowing push notifications. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or about the practices described here, please contact the Service Provider by email at hello@letssave.app.

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.

Additional disclosures for the mobile app

Reading bank SMS (Android only)

If you turn on SMS capture, Let's Save reads incoming SMS to detect bank transaction alerts. This is optional and off by default.

Messages are matched against known bank alert formats entirely on your device. A message that does not match is discarded immediately and nothing about it is recorded or transmitted.
For messages that do match, only the amount, date, merchant name and the last four digits of the account are sent to your account, and only after you review and confirm them.
The text of your messages is never uploaded, never shared, and never used for advertising or any purpose other than creating the transactions you confirm.
Matched messages are kept on your device so you can review them, and are deleted as soon as you confirm or dismiss them. Anything unreviewed is deleted after 30 days.
Only messages received after you turn the feature on are read; your existing inbox is never accessed. You can turn it off at any time in the app or in your device settings.

Push notifications

If you enable notifications, Let's Save sends alerts about budgets, goals, large transactions and periodic summaries.

A device registration token is stored so notifications can reach your device. It is deleted when you sign out or disable notifications.
Notification content is generated from your own financial data and delivered through Firebase Cloud Messaging.
You can choose which notifications you receive, or turn them off entirely, in the app's notification settings.