Privacy Policy

Data Controller:

Contact for Privacy Inquiries:

Email: [email protected]

Subject line: "Privacy Inquiry"

We are committed to complying with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and all applicable data protection laws.

We collect data from three sources:

We process your personal data for specific purposes, each with a legal basis under GDPR:

5.1 How We Use AI

baguette uses artificial intelligence to:

1. Parse your input: When you type "coffee at starbucks 4.50," AI extracts the amount (€4.50), description, and suggests a category
2. Suggest categories: Based on your input and history of confirmed transactions
3. Learn your preferences: When you confirm or change a suggestion, the system learns to make better suggestions

5.2 Your Control Over AI Decisions

AI suggestions are never final without your confirmation. You always have the ability to accept, change, edit, or delete any transaction. We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

6.1 Service Providers (Data Processors)

We use carefully selected third-party service providers. These providers only process data on our instructions and are bound by data processing agreements.

All providers handling data outside the EU operate under appropriate transfer mechanisms (see Section 8).

We retain your data only as long as necessary:

Before automatic deletion: We will send you a reminder email 30 days before deletion and give you the option to export your data.

Your personal data is stored on servers located in the European Union (via Neon for database and Railway for application hosting).

Some of our service providers (such as Resend for email and Microsoft Clarity for analytics) may process data outside the EEA. When this occurs, we ensure appropriate safeguards:

• EU Adequacy Decisions: For countries deemed adequate by the EU
• Standard Contractual Clauses (SCCs): EU-approved contracts for US transfers
• Additional Safeguards: Encryption and pseudonymization where required

You can request a copy of the safeguards we use by contacting [email protected].

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Correct any inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format (JSON or CSV)
• Right to Object (Art. 21): Object to processing based on legitimate interest

Technical Measures

• Encryption at rest: All data is encrypted in the database
• Encryption in transit: All connections use TLS 1.3
• Password security: Hashed using industry-standard algorithms (never stored in plain text)
• Access controls: Role-based access limits who can view what data

Your Responsibilities

• Use a strong, unique password
• Don't share your login credentials
• Log out on shared devices
• Contact us immediately if you suspect unauthorized access

We use minimal cookies necessary for the Service:

Microsoft Clarity may set analytics cookies to help us understand how the Service is used. You can manage cookie preferences through your browser settings.

baguette is intended for users who are at least 16 years old.

We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected]. We will delete the data promptly.

For material changes (processing purposes, data categories, your rights, data sharing): We will notify you by email at least 30 days before the changes take effect.

For minor changes (clarifications, formatting): We will update the "Last Updated" date.

If you have questions about this Privacy Policy or how we handle your data: