Privacy Policy
1. Who is responsible for your data
The controller of your personal data is Maxim Shevchenko, Rackog 54, 21103 Novi Sad, Serbia ("we"). Contact for anything about your data: privacy@max-budget.com.
This policy explains what data we process when you use MaxBossWim (max-budget.com and app.max-budget.com), why, who else is involved, and what rights you have.
2. What data we process
| Data | What it includes |
|---|---|
| Account | E-mail address, display name, language and main currency. Your password is stored only as a salted hash (bcrypt); we cannot read it. If you sign in with Google we receive your name and verified e-mail address from Google, never your Google password. |
| Financial data you add | Accounts, transactions, categories and rules, budgets, goals, imported statement files (CSV, Excel, PDF), receipt photos, documents you upload and the text extracted from them, and your conversations with the assistant. |
| Usage and security | A log of AI requests (time, type, amount of text processed, estimated cost, status) used for plan limits, cost control and abuse protection; sign-in attempts; technical error logs with an error reference. |
| Payments | Handled by Paddle. We receive your e-mail address, plan and subscription status. We never see your card details. |
| Website | The public website sets no cookies and has no analytics or advertising. We do not keep access logs of visits to it. |
3. Why we use it, and on what legal basis
- To provide the Service you asked for (importing, reading receipts, budgets, forecasts, assistant): performance of a contract (GDPR Art. 6(1)(b)).
- To secure the Service, prevent abuse, enforce plan limits and control costs: our legitimate interests (Art. 6(1)(f)).
- To send service e-mails (confirmation links, password resets, receipts): performance of a contract. We send no marketing e-mail.
- To keep records we are legally required to keep (for example tax records of payments, held by Paddle): legal obligation (Art. 6(1)(c)).
We do not sell your data, do not use it for advertising and do not use it to train AI models.
4. How AI is used with your data
We use the API of OpenAI to read receipts and scanned pages, to categorize unfamiliar merchants, to write advice and to power the assistant.
- Images (receipt photos and scanned pages) are sent to OpenAI as they are.
- Text sent for categorization, advice and the assistant is masked first: account numbers, card numbers, IBANs, e-mail addresses and the names of account holders are removed. The assistant can only read your data through read-only tools, and the numbers in its answers are checked against calculations made by our own code.
- According to OpenAI's API terms at the date of this policy, data sent through the API is not used to train OpenAI's models, and OpenAI may keep requests and responses for a limited time (currently up to 30 days) for abuse monitoring. Our requests ask OpenAI to store the response for this period so that multi-step answers work. See OpenAI's own terms for the current rules.
Do not upload anything you do not want processed this way.
5. Who receives your data
| Recipient | Purpose | Location |
|---|---|---|
| Hosting provider | Runs our servers and database | France (EU) |
| OpenAI | AI processing described above | United States |
| Paddle | Payments, taxes, invoices, refunds. Paddle is the Merchant of Record and acts as a controller for payment data | United Kingdom / EU |
| Twilio SendGrid | Delivers our service e-mails (confirmation links, password resets) | United States |
| Only if you choose "Continue with Google" | United States / EU | |
| Cloudflare | DNS for our domain (it sees domain-name lookups, not your data) | Global |
These providers act on our instructions (or, for Paddle and Google, under their own terms for the data they handle). Authorities may receive data when the law requires.
6. Transfers outside the EU/EEA
Some providers above are in the United States or the United Kingdom. We rely on the safeguards recognised by EU law: adequacy decisions (for example the UK and the EU-US Data Privacy Framework for certified providers) or standard contractual clauses. You can ask us for details at privacy@max-budget.com.
7. How long we keep it
- While your account exists: your account and financial data.
- When you delete your account (Settings, Delete account): your account, transactions, receipts, documents, conversations, uploaded files and AI request log are removed from our live system straight away. Backup copies are overwritten within 14 days.
- OpenAI: up to 30 days, as described above.
- Payment records: held by Paddle for as long as tax and accounting law requires.
- Technical logs: rotate automatically and are kept for a short time only.
8. Your rights
Under the GDPR, and the Serbian Law on Personal Data Protection, you have the right to: access your data; correct it; have it erased; restrict or object to processing based on legitimate interests; receive your data in a portable format; and withdraw any consent you gave. You can see, change and delete most of your data yourself in the app. For a copy of your data or anything else, write to privacy@max-budget.com; we answer within one month.
You also have the right to complain to a data protection authority: in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or the authority of the country where you live or work.
9. Cookies
The app uses two strictly necessary cookies and nothing else: WIMSESSION keeps you signed in (up to 30 days) and XSRF-TOKEN protects your requests against forgery. We use no analytics, advertising or tracking cookies, and the public website uses no cookies at all. Fonts are served from our own site, not from a third party.
10. Security
Connections are encrypted with HTTPS. Passwords are hashed. Each account's data is separated from every other account's, the AI assistant can only read, sign-in and sign-up attempts are rate-limited, and the server is protected by a firewall and has nightly backups. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the authorities as the law requires.
11. Children
The Service is not meant for anyone under 16. If you believe a child has an account, write to us and we will delete it.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by e-mail before the change applies. The date at the top shows the latest version.
13. Contact
Maxim Shevchenko, Rackog 54, 21103 Novi Sad, Serbia
Privacy: privacy@max-budget.com · General: support@max-budget.com