Privacy Policy
Last updated: 17 March 2026
Your privacy matters. This policy explains what personal data Irish Finance collects, why we collect it, how we process it, and your rights under the General Data Protection Regulation (GDPR).
1. Data Controller
Irish Finance is operated by a sole trader based in Ireland. For the purposes of the GDPR, the data controller is:
2. What Data We Collect
We collect and process the following categories of personal data:
2.1 Account and Profile Data
- Name and email address
- Authentication credentials (hashed password, or Google/Apple sign-in token)
- Profile preferences (employment status, housing type, tax-relevant details you choose to provide during onboarding)
2.2 Receipt Data (Including Health-Related Data)
- Uploaded receipt images (which may include medical and health-related receipts)
- Data extracted from receipts by AI (provider name, amounts, dates, line items, category)
- Tax relief calculations derived from receipt data
Special Category Data Notice
Medical receipts may constitute health-related data, which is a special category of personal data under Article 9 of the GDPR. We process this data only with your explicit consent, which you provide before your first receipt scan. You can withdraw this consent at any time in your account settings.
2.3 Financial Data
- Bill and contract details (provider, amount, renewal dates, category)
- Loan and mortgage information (lender, balance, interest rate, terms)
- Tax calculator inputs (income, credits, reliefs)
2.4 AI Chat Data
- Questions you ask Fionn, our AI finance assistant
- AI-generated responses and conversation history
2.5 Technical and Analytics Data
- Device type, browser type, and operating system
- Pages visited, features used, and interaction patterns (via PostHog)
- IP address (anonymised for analytics)
- Error and crash reports (via Sentry)
3. Legal Basis for Processing
We process your personal data under the following legal bases:
| Data | Legal Basis | GDPR Article |
|---|---|---|
| Account and profile data | Performance of contract | Art. 6(1)(b) |
| Financial data (contracts, loans, bills) | Performance of contract | Art. 6(1)(b) |
| Receipt images (non-medical) | Performance of contract | Art. 6(1)(b) |
| Medical receipt images | Explicit consent | Art. 9(2)(a) |
| AI chat conversations | Performance of contract | Art. 6(1)(b) |
| Analytics and usage data | Legitimate interest | Art. 6(1)(f) |
| Error and crash reports | Legitimate interest | Art. 6(1)(f) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure your rights and freedoms are not overridden. You can request details of our legitimate interest assessments by contacting us.
4. How We Process Your Data
4.1 AI-Powered Receipt Scanning
When you upload a receipt, the image is sent to our AI provider (Anthropic, or Google as a fallback) for text extraction. The AI extracts structured data such as the provider name, date, amounts, and line items. The extracted data is stored in our database; the original image is stored in our self-hosted file storage (MinIO).
4.2 AI Chat (Fionn)
When you ask Fionn a question, your query is sent to our AI provider to generate a response. Fionn provides general financial information only and does not provide personalised financial advice. Your conversation history is stored to enable follow-up questions within a session.
4.3 Rate Comparison and Alerts
Our background data collection agents scrape publicly available market data (energy rates, mortgage rates, broadband plans) into a shared database. This data is not personal data. Your contract and loan details are compared against this market data to generate alerts and comparisons.
5. AI Provider Data Processing
We use the following AI providers as data processors:
- Anthropic (primary provider) — Used for receipt extraction and AI chat responses
- Google (fallback provider) — Used when the primary provider is unavailable
Important Safeguards
- All AI providers operate under Data Processing Agreements (DPAs).
- Your data is not used to train AI models.
- Data sent to AI providers is processed in real time and not retained by them beyond the processing request, in accordance with their DPAs. Anthropic deletes API inputs within 30 days; Google Gemini API has zero-retention by default.
- Because AI providers do not retain your data beyond transient processing, no separate deletion request is required when you delete your account — there is no data to delete.
- Receipt images are sent only for the purpose of extracting structured text data.
6. Data Storage and Transfers
6.1 EU Data Residency
All user data is stored within the European Union. Our infrastructure is self-hosted on servers located in Frankfurt, Germany, provided by Netcup GmbH. This includes:
- PostgreSQL database (all structured data)
- MinIO object storage (receipt images and files)
- Redis cache (temporary session data)
6.2 Third-Party Sub-Processors
| Provider | Purpose | Data Location |
|---|---|---|
| Anthropic | AI extraction and chat | US (under DPA, no data retention) |
| AI fallback, authentication | EU/US (under DPA and SCCs) | |
| Apple | Authentication (Sign in with Apple) | EU/US (under DPA) |
| Stripe | Payment processing (future) | EU/US (under DPA and SCCs) |
| PostHog | Product analytics | EU (PostHog Cloud EU, Frankfurt) |
| Sentry | Error monitoring | EU/US (under DPA and SCCs) |
| Resend | Transactional email | US (under DPA and SCCs) |
Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or the provider's adequacy decision, to ensure an adequate level of protection.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Retained for the lifetime of your account. Upon deletion, data is permanently erased within 30 days. |
| Receipt images | Kept by default for up to 6 years (aligned with Revenue record-keeping requirements). You can enable automatic deletion after extraction in Settings. |
| Extracted receipt data | Until account deletion (needed for tax relief tracking) |
| Financial data (contracts, loans) | Until account deletion |
| AI chat history | Retained for up to 36 months or until you delete individual conversations or your account. |
| Analytics data | Retained for 24 months. Data is aggregated and anonymised after 12 months. |
| Error logs | 90 days |
Receipt images are kept by default because users typically need them for Revenue claims (Revenue requires records to be kept for 6 years). You can enable automatic deletion of receipt images in your account settings.
8. Data Breach Notification
In the event of a personal data breach that affects your information, we will:
- Notify the Data Protection Commission within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms
- Notify you directly without undue delay if there is a high risk to your rights and freedoms
- Provide details of the nature of the breach, the likely consequences, and the measures being taken to address it
You can report suspected data breaches to us at privacy@cecurlabs.dev or to the DPC directly at info@dataprotection.ie.
9. Automated Decision-Making
We use automated technologies in the following areas:
- AI-powered receipt extraction: Automatically extracts amounts, dates, and categories from uploaded receipt images. You can review and correct all extracted data before it is used for tax calculations.
- Compliance filtering: Our system automatically reviews AI chat responses to ensure they contain general information only and do not constitute financial advice. Filtered responses are replaced with a system notice.
- Rate matching: We algorithmically compare your existing contracts against current market rates to identify potential savings opportunities.
None of these automated processes make legally or financially binding decisions on your behalf. You retain full control over all actions taken based on this information.
You have the right to:
- Receive an explanation of any automated processing affecting you
- Request manual review of any automated output
- Object to automated processing where it is not essential to the service
To exercise these rights, contact privacy@cecurlabs.dev.
10. Biometric Authentication
Where you choose to enable biometric authentication (fingerprint or Face ID):
- Biometric data is processed and stored locally on your device only
- Biometric data is never transmitted to or stored on our servers
- Only an authentication token (not biometric data) is communicated to our systems
- You can disable biometric authentication at any time in your device settings or the app settings
11. Legitimate Interest Assessment — Analytics
Where we process analytics data via PostHog (EU-hosted), we rely on legitimate interest under Article 6(1)(f) of the GDPR.
Our interest: Understanding how users interact with the app to identify and fix bugs, improve user experience, detect potential fraud patterns, and measure feature adoption.
Safeguards for your rights: You can opt out of analytics entirely in Settings without affecting core functionality. We use aggregated data only. IP addresses are masked and not stored in full. PostHog is hosted in the EU (Frankfurt, Germany). We do not use analytics data to make decisions about individual users.
We have determined that this processing does not override your rights and freedoms given these safeguards. You may request the full Legitimate Interest Assessment by contacting privacy@cecurlabs.dev.
12. Data Protection Impact Assessment
We have conducted a Data Protection Impact Assessment (DPIA) covering our processing of health-adjacent data, international data transfers, and automated decision-making. A summary of this assessment is available on request by contacting privacy@cecurlabs.dev.
13. Your Rights Under the GDPR
As a data subject, you have the following rights under the GDPR:
Right of Access (Art. 15)
You can request a copy of all personal data we hold about you. Use the data export feature in your account settings, or contact us by email.
Right to Rectification (Art. 16)
You can update or correct your personal data at any time through your account settings, or by contacting us.
Right to Erasure (Art. 17)
You can delete your account and all associated data using the account deletion feature in your settings. This permanently removes all your data from our systems.
Right to Data Portability (Art. 20)
You can export your data in a structured, machine-readable format (JSON) using the data export feature in your account settings.
Right to Restriction of Processing (Art. 18)
You can request that we restrict the processing of your personal data in certain circumstances. Contact us by email to make this request.
Right to Object (Art. 21)
You can object to processing based on legitimate interest (such as analytics). Contact us by email, and we will cease processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent
Where processing is based on consent (such as medical receipt scanning), you can withdraw consent at any time in your account settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
14. How to Exercise Your Rights
You can exercise most of your rights directly through the app:
- Data export: Settings → Data & Privacy → Export My Data
- Account deletion: Settings → Data & Privacy → Delete Account
- Receipt image deletion: Settings → Data & Privacy → Receipt Retention
- Consent management: Settings → Data & Privacy → Consent Preferences
For any rights request that cannot be completed in-app, or if you have questions, email us at privacy@cecurlabs.dev. We will respond within 30 days.
15. Cookies
We use a limited number of cookies to operate the service and understand how it is used. We do not use advertising or tracking cookies. For full details, see our Cookie Policy.
16. Security
We take appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit (TLS) and at rest
- Password hashing using industry-standard algorithms
- Application-level access control (all queries scoped by user ID)
- PostgreSQL row-level security as defence in depth
- Image upload validation (size check, MIME validation, magic bytes verification, EXIF stripping, re-encoding)
- Certificate pinning on mobile
- Optional biometric MFA
17. Children's Privacy and Age Requirements
Users must be at least 16 years old to create an account (in accordance with Ireland's digital age of consent under the Data Protection Act 2018, Section 31). Receipt scanning and other features involving health-related data are restricted to users aged 18 and over. If you are under 16, please do not use this service.
We do not knowingly collect personal data from anyone under 16 years of age. If you believe we have inadvertently collected data from someone under 16, please contact us immediately at privacy@cecurlabs.dev and we will delete it promptly.
18. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Notify you by email or in-app notification
- Where required, seek your renewed consent
19. Complaints and the Data Protection Commission
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Phone: +353 (0)1 765 0100 / 1800 437 737
Email: info@dataprotection.ie
Website: www.dataprotection.ie
20. Contact Us
If you have any questions about this privacy policy or our data practices, please contact us:
Irish Finance — Privacy
Email: privacy@cecurlabs.dev