Privacy Policy

1. Information We Collect

We collect only the information reasonably necessary to provide the service.

• Account and Profile Information: Telegram user ID, username (if visible), language preference, timezone, home currency, reminder time, and other settings you configure.
• Expense and Transaction Data: Content you send via text, voice messages, bulk entries, or natural language queries (e.g., amounts, dates, descriptions, categories, currencies, personal/business splits, notes, or trip tags).
• Receipt and Media Content: Photos, PDFs, or documents of receipts you upload or that we import from your connected Gmail account. When enabled, Gmail access is limited to scanning emails and attachments relevant to receipts or transaction imports based on labels, filters, or user-triggered actions. These are processed temporarily using AI to extract transaction details.
• Connected Account Data: Information we access only with your explicit authorization, including Google Sheets (for writing expenses), Google Drive/Dropbox (for saving receipts), and Gmail (for receipt import). We do not store copies of your full Sheets or Drive contents on our systems.
• Communications and Marketing Data: Emails, support messages, waitlist signups, or newsletter subscriptions (via MailerLite), including your name, email address, and message content.
• Usage and Technical Data: Interaction logs, timestamps, error reports, Telegram metadata, and limited technical information needed for security, debugging, and service improvement.
• Payment Information: Subscription status and billing information (handled entirely by Telegram Stars or other payment processors; we do not receive or store full credit card or bank details).

We do not collect sensitive financial data beyond what you explicitly provide for expense logging, nor do we track your location except as inferred from currency settings or multi-currency features.

2. How We Use Information

We use the information to:

• Provide core features: natural language expense logging, receipt scanning, duplicate detection, budgets, streaks, summaries, nudges, and exports.
• Write expenses and save receipt links to the Google Sheet and storage service you control.
• Process text and images temporarily with Anthropic Claude (Haiku for text, Sonnet for vision) to extract structured expense data.
• We do not permit AI providers to use your receipt or expense data for model training where such controls are available.
• Send reminders, daily/weekly/monthly summaries, and motivational messages via Telegram.
• WealthyBestie provides organizational tools only and does not provide financial, investment, accounting, tax, or legal advice.
• Manage your account settings, categories, budgets, and memories stored in Supabase.
• Respond to support requests and improve product reliability and user experience.
• Prevent abuse, fraud, and unauthorized access.
• Comply with legal obligations (e.g., tax, accounting, or regulatory requirements).
• Send marketing emails only if you have opted in (you can unsubscribe at any time).

We do not sell personal information.

3. Legal Basis for Processing (PIPEDA and, where applicable, GDPR)

We process personal information based on:

• Contract: To deliver the services you requested (e.g., logging expenses and saving them to your Sheet).
• Consent: For optional features, integrations, marketing emails, or AI processing of receipts.
• Legitimate Interests: Security, fraud prevention, product improvement, and understanding usage patterns.
• Legal Obligation: Where required by applicable law.

4. How We Share Information and Subprocessors

We share information only with trusted service providers (subprocessors) that help us operate the service. These providers are contractually required to process data solely on our instructions, maintain confidentiality, implement appropriate security, and delete or return data when no longer needed.

We may also disclose information if required by law, to protect our rights, or in the event of a business transfer (e.g., merger or acquisition), with appropriate safeguards.

5. Data Retention

We retain personal information only as long as necessary for the purposes outlined or as required by law.

When you delete your account or revoke access to connected services, we will delete or anonymize the data we control within the periods above. Data you have already saved to your own Google Sheet or Dropbox/Google Drive remains under your sole control and is not deleted by us.

6. Data Ownership and User Control

Your primary expense records and receipts live in the Google Sheet and storage accounts you own and control. We do not claim ownership of your financial data. In many cases, WealthyBestie acts as a service provider or processor on your behalf, while you remain the controller of the financial records stored in your connected Google Sheets or storage accounts.

You may:

• Revoke our access to Google, Dropbox, Gmail, or other connected accounts at any time through their settings or bot commands (some features may stop working).
• Export your data directly from your Google Sheet.
• Request deletion of the data we hold about you (subject to legal retention obligations).
• Revoking access through your Google or Dropbox account settings immediately prevents future syncing or imports.

7. Your Rights and Choices

Depending on your location, you may have rights to:

• Access, correct, or delete your personal information (where we are the controller).
• Withdraw consent for optional processing.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Lodge a complaint with your local privacy regulator (in Canada: Office of the Privacy Commissioner of Canada at priv.gc.ca).

To exercise these rights, contact us at hello@wealthybff.com. We will respond within the timeframe required by applicable law.

8. International Transfers

WealthyBestie is based in Canada. Your information may be processed and stored in Canada, the United States, and other countries where our subprocessors operate. These jurisdictions may have different privacy laws than where you live. We use appropriate safeguards (such as contractual clauses and security measures) to protect your data during transfers.

9. Security

We implement reasonable administrative, technical, and organizational safeguards, including access controls, encryption in transit, least-privilege principles, secret management, and monitoring for threats. No system is completely secure, however, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you as required by law.

10. Children's Privacy

WealthyBestie is not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we learn that we have collected such information, we will delete it promptly. Please contact us if you believe a child has provided us with personal information.

11. Website and Cookies

Our landing page and blog use standard technical cookies and logs for basic functionality, security, and analytics (limited to essential operations). We do not use tracking cookies for advertising. Newsletter signups are handled by MailerLite.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, legal requirements, or business practices. If we make material changes, we will notify active users via Telegram message, email, or another reasonable method, and update the "Last Updated" date. Continued use after changes constitutes acceptance of the revised policy.