Privacy Policy

Controller: ADAM MISIAK, Brzozowa 5, Brzoza, Poland · Tax ID (NIP): 5542979661 · Email: support@qesto.app

§ 1. General provisions

This Privacy Policy sets out how personal data of users of the Qesto app is processed and fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
The controller of personal data is ADAM MISIAK, Brzozowa 5, Brzoza, Poland, tax ID (NIP): 5542979661 (the "Controller"). Contact on personal data matters: support@qesto.app or in writing to the Controller's address.
The Controller has not appointed a data protection officer.
Capitalised terms have the meaning given to them in the Terms of Service.
The version number and effective date of this Privacy Policy are shown with its text. Previous versions remain available.

§ 2. Purposes, legal bases and scope of processing

The Controller processes personal data for the following purposes and on the following bases:
1. concluding and performing the Contract, including maintaining the Account - email address, first and last name, password hash, settings; basis: Article 6(1)(b) GDPR;
2. providing the Service in respect of User Content - financial accounts, transactions, amounts, dates, categories, labels, payees, budgets, recurring payments, import history; basis: Article 6(1)(b) GDPR;
3. two-factor authentication - the encrypted TOTP secret; basis: Article 6(1)(b) GDPR (a feature turned on by the User as part of the Service);
4. handling a Paid Plan - customer and transaction identifiers at the Payment Operator, plan status, payment events, payment amount, currency and date, the record of the request to start performance before the withdrawal period expires (with document version, language and time), records of withdrawal statements; basis: Article 6(1)(b) GDPR;
5. compliance with legal obligations, in particular under tax and consumer law (confirmations on a Durable medium, handling complaints); basis: Article 6(1)(c) GDPR;
6. ensuring the security and continuity of the Service - IP address, device type, technical logs, error reports, login attempt counters; basis: Article 6(1)(f) GDPR, the Controller's legitimate interest being the protection of the Service and Users against abuse and the resolution of failures;
7. establishing, exercising and defending legal claims - data needed to demonstrate the conclusion and performance of the Contract, statements made and acceptance of documents; basis: Article 6(1)(f) GDPR;
8. sending transactional messages and summaries - confirmations, one-time links, notices of document changes, periodic summaries turned on by the User; basis: Article 6(1)(b) GDPR;
9. AI Features - the data specified in § 6; basis: Article 6(1)(a) GDPR (consent);
10. analytics of App usage - the data specified in § 7; basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 399 of the Polish Electronic Communications Law of 12 July 2024.
Providing an email address, password and first and last name is a condition of concluding the Contract. Providing billing data is a condition of purchasing a Paid Plan. Entering User Content and using two-factor authentication, import, AI Features and analytics is voluntary; not providing the data only means the feature concerned is unavailable.
The Controller does not intentionally collect special categories of data referred to in Article 9 GDPR and does not access the User's bank accounts. The User should avoid entering such data in descriptions and notes.
The Controller receives some billing data from the Payment Operator: transaction identifiers, payment status, amount, currency and the date the payment session was created. On that basis the App may create a transaction record corresponding to the purchase in User Content, provided the User has at least one financial account in the App and the currency can be converted.
User Content may contain personal data of third parties (in particular names of payees and of persons with whom the User settles amounts). The Controller processes such data solely to provide the Service to the User, who enters it in the course of purely personal or household activity.

§ 3. Encryption of User Content

The following are encrypted with a key protected by the User's password and by the Recovery Key: transaction descriptions and notes, transaction location, financial account names, payee names, label names, budget names, the corresponding fields in recurring payment rules, and the two-factor authentication secret.
The following are not encrypted: amounts, dates, currencies, transaction type, categories, budget limits and periods, and balances. This data is necessary for calculations, budgeting and charts.
The encryption is not end-to-end encryption. Content is decrypted in server memory to the extent necessary to carry out the User's request. The encryption protects data in the event of unauthorised access to the database or a backup.
Searching encrypted fields uses a deterministic index, which makes it possible to determine that two records have the same content and how often that content occurs, without revealing the content itself.

§ 4. The Recovery Key and the effects of a password reset

The Controller does not keep a copy of the encryption key or of the Recovery Key and has no technical means of reconstructing them. The Controller does not operate key escrow.
Changing the password does not invalidate the Recovery Key.
A password reset using a link opened in a browser in which the User remains fully signed in (with two-factor authentication completed, if enabled) does not delete data: the key is protected with the new password, and a User who had no Recovery Key is issued a new one. After the reset, all of the User's active sessions are ended.
In any other case, a password reset without the Recovery Key permanently and irreversibly deletes: transactions, transfers, financial accounts, budgets, templates, recurring payment rules together with dismissed suggestions of such rules, payees, labels, categories and import history; the default set of categories and labels is restored; two-factor authentication is turned off. Unencrypted data is deleted as well, because without the key it could not be presented consistently.
The reset referred to in paragraph 4 does not affect:
1. the Account with its password and settings;
2. Paid Plan data: the link with the Payment Operator, purchase confirmations, records of requests to start performance and of withdrawal statements, acceptance of documents - as data kept under § 2(1)(4), (5) and (7);
3. AI Feature settings and usage counter, summary preferences and delivery history, dashboard layout, import profiles (containing the name given by the User and the file's column headers, which may indicate the institution the import came from) and manually set exchange rates;
4. technical data concerning closed billing relationships.
After the reset referred to in paragraph 4, all active sessions and unused one-time links become invalid, the previous Recovery Key is invalidated and the User receives a new one.

§ 5. Recipients of data

Personal data is entrusted to the following processors under agreements referred to in Article 28 GDPR, solely to the extent necessary for the stated purpose:
1. Hetzner Online GmbH (Germany) - hosting of the App's servers;
2. Google Cloud Storage (European region) - storage of backups, encrypted before upload;
3. Resend (United States) - email delivery; processes the recipient's address, the subject and the content of every message the Controller sends;
4. Sentry (infrastructure in the European Union) - error and performance monitoring, within the scope of § 8;
5. PostHog (infrastructure in the European Union) - analytics, only with consent, within the scope of § 7;
6. the language model provider named to the User when turning on AI Features - only with consent, within the scope of § 6.
The Payment Operator (Stripe, through the Link service) processes data provided at payment as a separate controller, under its own privacy policy (stripe.com/privacy). The Controller does not receive payment card details.
As part of the Service, data is also passed:
1. to Have I Been Pwned - to check whether a password appears in known breaches, only the first five characters of the SHA-1 hash of the password are sent (k-anonymity model); neither the password nor the email address is sent;
2. to BudgetBakers Wallet - only on the instruction of the User who starts an import, using the token the User provides.
Exchange rates are fetched from the Frankfurter service without passing any personal data.
Data may be disclosed to public authorities only where required by law.
Within the Controller, only the Controller has access to data, to the extent necessary to provide the Service, handle requests and ensure security. Administrative actions taken on an Account are logged, without recording the values of the data.

§ 6. AI Features

AI Features are inactive until the User gives consent. Consent relates to a specific model provider; a change of provider requires consent to be given again.
Only aggregated data is passed to the provider: summed amounts and category names, including names chosen by the User. Individual transactions, their descriptions and payee names are not passed. This restriction is enforced on the server.
Periodic summaries are generated without a language model.
The Controller records metadata of AI Feature calls, without the content of prompts, model responses or amounts.
The Controller has not concluded a zero data retention agreement with the model provider. Data passed to the provider is retained by it for the period and on the terms set out in its terms, indicated to the User when turning on AI Features.
AI Features involve profiling within the meaning of Article 4(4) GDPR: the App sums expenses by category, compares them with the User's history and points out deviations. This profiling does not lead to decisions producing legal effects concerning the User or similarly significantly affecting the User (Article 22 GDPR).
Consent may be withdrawn at any time by turning off AI Features in the App.

§ 7. Analytics

With the User's consent, given in the App, the Controller uses PostHog to analyse how the App is used and to improve it. Without consent, the tool is not loaded.
The following are processed: events relating to use of the App (including views opened), the User identifier and general characteristics: month of registration, plan type, ranges of the number of records and financial accounts, device type and how the App is launched, whether a Recovery Key exists and whether the default currency is used. The approximate location of the device is also processed (country, region, city, postal code, approximate coordinates and time zone), determined by PostHog from the IP address when an event is received; the IP address itself is not stored. Text displayed on screen is masked; sessions are not recorded and User Content is not passed.
Analytics data is stored in the browser's local storage, without cookies.
Consent may be withdrawn at any time in the App's Settings, in the "Usage analytics" section. After withdrawal, the tool stops collecting data and the device identifier is deleted.

§ 8. Error monitoring

An error report sent to Sentry includes the request path and the exception message. The exception message may contain a fragment of the data the error concerned. The Controller does not intentionally pass User Content.
Reports do not contain the User identifier, IP address, cookies, email address, request bodies or local variables.
Performance monitoring also covers successful requests - the path and response time, without their content.
Monitoring covers the server and the App in the browser. A report from the browser also contains the screen name and the type and version of the browser and operating system. Addresses are sent without query parameters; clicks, entered values and text displayed on screen are not recorded.

§ 9. Transfers outside the European Economic Area

The App's servers and backups are located in the European Economic Area.
Data may be transferred outside the European Economic Area, in particular to the United States, by the Payment Operator, Resend, Sentry, PostHog (only with consent to analytics) and the language model provider (only once AI Features are turned on).
Transfers are based on the European Commission's adequacy decision (EU-US Data Privacy Framework, Article 45 GDPR) for certified recipients, and otherwise on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).
The Controller provides a copy of the standard contractual clauses on request sent to support@qesto.app.

§ 10. Security

The Controller applies technical and organisational measures referred to in Article 32 GDPR, in particular:
1. encryption of selected User Content (§ 3) and of backups;
2. session expiry after a period of inactivity and after a maximum time from sign-in; invalidation of sessions on all devices on sign-out and password change;
3. one-time links with limited validity;
4. limiting login attempts, recording a SHA-256 hash of the email address instead of the address itself;
5. two-factor authentication (TOTP).

§ 11. Retention periods

Account data and User Content - until the Account is deleted, subject to § 4 and paragraph 2.
Backups - no longer than 12 months from their creation. The Controller does not remove a single Account's data from backups; if a backup is restored, data of previously deleted Accounts is deleted again.
Paid Plan data, records of requests, withdrawal statements and acceptance of documents - for the term of the Contract and, after it ends, until the limitation period for claims expires (Article 118 of the Polish Civil Code), no longer than 6 years from the end of the calendar year in which the Contract ended; data required by tax law - for 5 years from the end of the calendar year in which the tax payment deadline fell.
Processed payment events received from the Payment Operator - 30 days.
The technical record of a deleted Account in the billing module - 7 days from deletion, to prevent a delayed event from the Payment Operator from recreating the Account.
The log of administrative actions taken on an Account - no longer than 6 years from the date of the action.
Technical logs, error reports and login attempt counters - no longer than 90 days.
Analytics data - no longer than 12 months from collection or until consent is withdrawn.
Data processed on the basis of consent - until consent is withdrawn and thereafter for the period necessary to demonstrate that it was given.

§ 12. Deletion of the Account

Deleting the Account deletes the Account, User Content and encryption keys, except for the data specified in § 11(2), (3), (5) and (6), which is kept for the periods stated there.
The Controller does not issue invoices or tax documents for sales of Paid Plans; the Payment Operator does.

§ 13. Rights of the data subject

The User has the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).
The User may also exercise the right to data portability independently, on every plan, by exporting User Content to a CSV file.
Where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests should be sent to support@qesto.app. The Controller handles them without undue delay and in any event within one month of receipt, which may be extended under Article 12(3) GDPR.
The User has the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

Right to object. Where data is processed on the basis of Article 6(1)(f) GDPR (§ 2(1)(6) and (7)), the User has the right to object at any time, on grounds relating to their particular situation, to that processing (Article 21 GDPR). The Controller will stop processing the data for those purposes unless it demonstrates compelling legitimate grounds that override the User's interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

§ 14. Cookies and browser storage

The App uses only the following cookies, which are necessary to provide the Service:
1. __Host-qesto_refresh - maintains the session; not accessible to page scripts;
2. __Host-qesto_pending - kept only between entering the password and the two-factor authentication code; not accessible to page scripts;
3. sidebar_state - remembers the state of the sidebar (value true or false).
The browser's local storage also holds:
1. a session marker (qesto:signed-in), which is neither a token nor a key;
2. interface settings (theme, navigation layout, table preferences, last opened financial account);
3. the record of the analytics choice (qesto:analytics-consent) with its date and version;
4. analytics tool data - only with consent (§ 7);
5. a draft of an interrupted CSV import: file reading settings, column mappings, matches of account, category, label and payee names, the default account, the import step and manually entered balances;
6. the latest AI Feature results (category names, amounts and percentage changes) - only once AI Features are turned on, until the browser tab is closed.
The access token is not stored in browser storage. The import draft and AI Feature results contain the User's financial data and are deleted on sign-out. On a shared device, the User should sign out after using the App.
The cookies and data referred to in paragraph 1 and paragraph 2(1)-(3), (5) and (6) are necessary to provide the Service requested by the User and do not require consent (Article 399 of the Polish Electronic Communications Law).

§ 15. Changes to this Privacy Policy

Each change is published as a new, numbered version with its effective date. Previous versions remain available.
The Controller notifies Users of a material change by email to the address associated with the Account and in the App, at least 14 days before it takes effect.