Privacy Policy

Last updated: February 2026

⚠️ Working document. Before the public launch we recommend verification by a legal counsel and completing controller details (entity name, address, registration number).

This Privacy Policy describes how the SplitFlow application ("the App", "we") processes users' personal data in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is the entity operating the SplitFlow App. Contact for privacy matters: kontakt@splitflow.link.

2. What data we process

Account data: email address, name/display name, optional profile picture.
Phone number (optional): stored in encrypted form; used only after verification to find friends. Never shared with third parties.
Event and expense data: event names, amounts, splits, settlements, optional receipt photos and locations that you add.
Technical data: device information, diagnostic and error logs (monitoring), necessary to ensure service stability.

3. Purposes and legal bases of processing

Providing the expense-splitting service (Art. 6(1)(b) GDPR — performance of contract).
Transactional notifications (reminders, invitations) — legitimate interest and performance of contract.
Security, fraud prevention and error diagnostics (Art. 6(1)(f) GDPR).
Compliance with legal obligations (Art. 6(1)(c) GDPR).

4. Recipients and processors

We use trusted providers acting as processors, including: database and authentication provider, hosting infrastructure providers (European Union), email delivery provider and error monitoring provider. Each processes data only on our documented instructions.

5. Data location and transfers

Data is stored on servers located in the European Union (Frankfurt, Germany). We do not transfer data outside the EEA without appropriate safeguards.

6. Retention period

We retain data for the duration of your account and for the period required by law. After account deletion, data is deleted or anonymised.

7. Your rights

You have the right to: access data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). The App provides data export and account deletion features. You also have the right to lodge a complaint with the supervisory authority (in Poland: President of UODO).

8. Security

We use encryption of sensitive data, access controls and continuous monitoring. We strive for data minimisation — we collect only what is necessary for the service to operate.

9. Children

The App is not intended for persons under 16 years of age.

10. Policy changes

We will notify you of material changes in the App or by email. The current version is always available at this address.

11. Contact

Privacy questions: kontakt@splitflow.link.