Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

We have assessed our processing against Article 37 GDPR and concluded that we are not required to appoint a Data Protection Officer: our core activities do not consist of large-scale processing of special categories of data, nor of large-scale, regular and systematic monitoring of individuals. We keep this assessment under review as the Service grows. For any privacy-related inquiry, please contact us at the email address above.

2. Scope and Applicability

This Privacy Policy applies to the BRILIZA personal finance platform (the "Service") and describes how we collect, use, disclose, and protect your personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR")
• The Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
• Directive 2002/58/EC (ePrivacy Directive) as implemented in Belgian law

This Service is intended exclusively for users located in the European Union and European Economic Area (EU/EEA). By using the Service, you confirm that you are located within the EU/EEA.

3. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Account Data

• Email address
• Password (cryptographically hashed; we never store or have access to your plaintext password)
• Account creation date

3.2 Financial Data

• Bank account identifiers (account names, IBANs, BICs)
• Account balances
• Transaction data (dates, amounts, descriptions, counterparty names and IBANs, remittance information)
• Spending plan categories and allocations
• Investment holdings and transactions

3.3 Technical Data

• Authentication tokens (session cookies)
• Browser-stored preferences (localStorage), see Section 8.3
• Anonymized performance metrics (page load times via Web Vitals)
• Pseudonymized usage and interaction data, pages visited, clicks, scrolls, and masked session recordings (see Section 8.2)
• Approximate location (country only), derived from your IP address by our analytics providers; the IP address itself is not retained by us

Data we do NOT collect: We do not track you across other websites, build advertising or marketing profiles, or use persistent cross-site identifiers. We do not collect precise (GPS) location, and we do not collect biometric data. Our analytics providers process your IP address only momentarily (to derive your approximate country and to count visits) but we do not store your IP address or use it to identify you.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each with a specific legal basis under Article 6(1) GDPR:

Legitimate interest assessment: For performance monitoring, cookieless usage analytics (including masked session recordings), and AI-assisted categorization and insights, our legitimate interest is understanding how the Service is used and helping you make sense of your finances, so we can find and fix problems and improve the Service. We have weighed this against your privacy and minimize the impact: no cookies are set for analytics in this mode, all text inputs and sensitive content are masked, recordings are pseudonymized and not linked across visits, only aggregated and anonymized summaries (never individual transactions) are sent to our AI provider, and none of this is used to identify you or to make decisions that affect you. You can object at any time. Choosing "Reject all" in the cookie settings stops session-recording analytics for you, you can decline analytics cookies there, and you can choose not to use the AI features or contact us to object.

5. Obligation to Provide Data

Mandatory data: Providing your email address and password is necessary to create an account and use the Service. Without this data, we cannot provide the Service to you.

Optional data: Connecting bank accounts and entering financial data is voluntary. However, without this data, certain features of the Service (such as automatic transaction import and insights) will not be available.

7. International Data Transfers

Your account and financial data are stored within the European Economic Area (Supabase, EU region). Some processors, however, process data outside the EEA: Google, Vercel, Microsoft and Resend (United States), and GoCardless (United Kingdom).

For these transfers we rely on:

• Adequacy decision: the United Kingdom is covered by a European Commission adequacy decision, so transfers to GoCardless require no additional safeguards
• Standard Contractual Clauses (SCCs) adopted by the European Commission under Decision 2021/914, for transfers to the United States (Google, Vercel, Microsoft, Resend)
• Additional supplementary measures where necessary, including encryption and access controls

You may request a copy of the relevant safeguards by contacting us.

8. Cookies and Similar Technologies

We use the following cookies and storage mechanisms:

8.1 Strictly Necessary Cookies

These cookies are essential for the Service to function and cannot be disabled.

Legal basis: These cookies are exempt from consent requirements under Article 5(3) of the ePrivacy Directive as they are strictly necessary to provide the service you requested.

8.2 Analytics and Performance

We use the following analytics tools to understand how visitors use our website and to improve the user experience:

• Vercel Web Analytics: Cookie-free pageview analytics. Collects anonymous data about pages visited, referrer, and country. No personal data or IP addresses are stored.
• Vercel Speed Insights: Collects anonymized performance metrics (Core Web Vitals) to help us improve page load times. Does not identify individual users.
• Microsoft Clarity: Provides heatmaps, scroll-depth analysis, and masked session recordings so we can see how people use the site and fix usability problems. All text inputs and sensitive content are automatically masked. By default Clarity runs in a cookieless mode: it sets no cookies, treats each page view as a separate session, and does not link your activity across page views or visits. Choosing "Accept all" lets Clarity additionally set first-party cookies that link your page views into a single journey, recognize return visits, and enable funnels. Clarity records sessions in either mode; the cookies affect linking, not whether a recording is made.

Legal basis (cookieless analytics): Legitimate interest (Art. 6(1)(f) GDPR). Vercel Web Analytics, Vercel Speed Insights, and Clarity's cookieless mode set no cookies and process only pseudonymized, masked data that is not linked across visits, so they run under our legitimate interest in improving the Service. To object: choosing "Reject all" in the cookie settings stops Microsoft Clarity (including session recordings) from loading for you. Vercel's analytics are cookieless and aggregate and do not identify you individually; you can avoid them with a tracker-blocking browser or extension, and you may raise any objection under Article 21 with us at the email above.

Legal basis (cookie-based analytics): Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Clarity's first-party analytics cookies are set only after you give consent via "Accept all". You can withdraw your consent at any time; it is as easy to withdraw as it was to give.

None of these tools track you across other websites, collect your personal financial data, or share data with advertisers.

8.3 Local Storage

We use your browser's local storage to remember your preferences and choices. This information stays on your device, is never sent to advertisers, and is not used to track you. We store the following, grouped by purpose:

Items not cleared on logout remain on your device until you clear your browser data. None of this is shared with us as personal data beyond what is described elsewhere in this policy.

9. Data Retention

We retain your personal data according to the following criteria:

When you request deletion of your account (by emailing us), we revoke all bank connections and begin permanent deletion of your personal data. Complete erasure occurs within 30 days, with backups purged within 90 days.

11. Automated Decision-Making and Profiling

We use AI (Google Generative AI) to assist with transaction categorization and generate financial insights. This processing:

• Provides suggestions only, you can always manually override any AI-generated category
• Does not produce legal effects or similarly significantly affect you
• Is based on aggregated financial patterns, not individual profiling for discrimination or credit decisions

We do not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit: TLS 1.3 for all data transmission
• Encryption at rest: AES-256 encryption for stored data
• Authentication: Secure password hashing (bcrypt), httpOnly session cookies
• Access control: Row-level security policies ensuring users can only access their own data
• Security headers: Content Security Policy (CSP), XSS protection, clickjacking prevention
• No credential storage: Bank login credentials are never transmitted to or stored by us

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly addressing any security incident.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34 GDPR.

14. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last updated" date at the top of this policy
• For significant changes affecting your rights, we will notify you by email at least 30 days before the changes take effect
• Where required by law, we will obtain your consent to material changes

We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy, except where consent is required.

16. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.

For Belgium, the competent authority is:

You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.

17. Miscellaneous Provisions

17.1 Governing Law

This Privacy Policy and any disputes arising from it shall be governed by the laws of Belgium, without regard to conflict of law principles. This choice of law does not deprive you of the protection afforded by provisions that cannot be derogated from by agreement under the law of your country of habitual residence.

17.2 Severability

If any provision of this Privacy Policy is found to be invalid or unenforceable by a court of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

17.3 No Waiver

Our failure to enforce any right or provision of this Privacy Policy shall not constitute a waiver of that right or provision.

17.4 Language

This Privacy Policy is available in English, Dutch, and Spanish. In the event of any conflict between the English version and a translation, the English version prevails, without prejudice to any mandatory right you have to rely on the version in your own language under the data-protection and consumer-protection laws of your country of residence.