Privacy Policy

1. Summary

• Finansealy is a record-keeping app. We don't hold or move money and don't connect to any bank account.
• Notifications are filtered on your phone. Anything not about money is dropped without being stored, and OTP codes are never sent anywhere.
• To read amounts and merchants, masked payment text goes to our AI provider in the United States, only with your consent. Images are never sent.
• Your data is stored on our servers in Indonesia and encrypted on your phone, on our servers, in backups and in transit.
• We don't sell your data, don't show ads, and don't use your data to train AI.
• You can access, correct, export (CSV) and delete your data, and withdraw consent at any time, wherever you live.

2. Who we are

Controller: PT Kasankaf Digital Solution, a company established in Jakarta, Indonesia. Privacy contact: hello@kasankaf.com.

3. Data we process

Account data

Email address, name, username, language, time zone, how you sign in (Google, Apple or an email code) with the account identifier from Google or Apple, plan and trial status, and the consents you give.

Financial records

What you log or confirm in Finansealy: transactions (amount, currency, date, merchant, category, notes, tags), accounts and wallets with the balances you enter, budgets, savings goals, debts and loans, and recurring bills. This is specific personal data under the PDP Law.

Captured payment text

Text from payment notifications (Android), screenshots and receipts (read by OCR on your phone), voice transcripts, e-receipts you forward, and bank e-statement PDFs you import (read on our server and then discarded: neither the file, its text nor its password is kept). See "Notifications, screenshots, receipts and voice" for details.

Device and technical data

A device identifier the app creates, platform, model, operating system and app version, push notification token, IP address and security logs, the days you open the app (for active-user counts), a count of AI feature use (counts, not content) for plan limits, and crash and error reports from the apps and our server (the error and the device and app version, without your financial records, email or IP address). If you use "Invite friends", we keep your code, who joined with it and whether the reward conditions were met, to give both of you the reward.

Product analytics

Only with your consent: app usage events (such as finishing onboarding or opening a recap), without amounts and without merchant names. Analytics run on our own servers.

Support and feedback

The messages you send, their topic, and your email if you include it.

Payments

Purchases are processed by Google Play or the App Store. We don't receive your card number or payment details; we only receive subscription status (product, validity, renewal) through our subscription service provider.

What you must provide

To create an account you need an email address, or sign-in with Google or Apple; without it we can't provide Finansealy. Everything else is up to you: features that need a permission or consent simply stay off without it.

4. Where data comes from

• From you, when you sign up, log entries or contact us.
• From your phone, with the permissions you grant (notification access, photos, microphone, camera).
• From Google or Apple when you sign in with them (email, name, account identifier).
• From Google Play and the App Store, through our subscription service provider, for subscription status.
• From other members of a shared workspace, for the records they create in a workspace you belong to.

5. Purposes and legal bases

We only process data for the purposes below. Where a purpose needs consent, we ask for separate consent for each purpose, and you can use Finansealy without giving the optional ones.

Where we rely on legitimate interest, our interests are keeping Finansealy and its users secure, preventing fraud and abuse, and keeping the service working. We don't rely on it where your interests and rights outweigh ours, and you can object to it (see "Your rights").

6. Consent and how to withdraw it

You can see and change every consent at any time in Settings > Privacy & data in the app. Withdrawing consent doesn't affect processing that was lawful before you withdrew it.

Some features need a particular consent. For example, without AI processing consent, automatic logging still detects payments and reads the amount on your phone, and you fill in the merchant and category yourself.

7. Notifications, screenshots, receipts and voice

• Notifications (Android). With your permission, Finansealy sees notifications arriving on your phone. A filter on the phone scores each one by its amounts, finance words and app. Notifications below the threshold are dropped without being stored and never leave the phone.
• OTP codes and promos are blocked. OTP and verification codes, promos and ads are blocked on the phone even when they contain amounts, and are never sent. Notifications Android hides because they contain an OTP aren't read; Finansealy only counts them.
• Masking. Before candidate payment text leaves your phone, long runs of digits (such as account numbers) and email addresses are replaced with symbols. Our server then masks names before the text goes to our AI provider.
• Screenshots and receipts. Text is read (OCR) on your phone. Only the text is sent for extraction; images never leave your phone.
• Voice. Speech is turned into text on your phone where the device supports it, or by the operating system's speech service. We only receive the transcript.
• Forwarded email (Premium). E-receipts you forward to your Finansealy address are processed to extract the transaction. Do not forward emails that contain OTP codes or passwords.
• You can mute any app or turn notification access off at any time.

8. AI processing

We use an AI service provider in the United States as our processor to extract transactions from payment text, suggest categories, and answer questions in Ask Sealy.

• The AI is only called from our servers; the service key never ships in the app.
• Only the text needed is sent, after masking. Images and OTP codes are never sent.
• The provider is bound by a data processing agreement with standard data protection clauses. We request zero data retention, and the data we send isn't used to train models.
• Ask Sealy answers from your workspace data through query functions we define. The AI doesn't write its own database queries, and it gives no investment advice and recommends no financial products.
• AI results can be wrong. Unsure captures go to your Review inbox for you to confirm, and you can always edit or delete the result. AI results aren't used to make decisions with legal or similarly significant effects on you.

9. Who we share data with

We don't sell your personal data and don't share it for advertising. We only share what's needed with:

• Service providers (processors) that help us run Finansealy, listed below by type. They act on our instructions under written agreements and may only use the data for the services they provide to us. You can ask us for their names at hello@kasankaf.com.
• Google and Apple, when you sign in with them, and Google Play and the App Store, when you buy a subscription. They process your data as independent controllers under their own privacy policies.
• Members of a shared workspace see the records in that workspace, including who logged what. Transactions in your personal workspace are visible to no one unless you move them.
• Authorities, when required by law and through a lawful request.
• A successor business, in a merger, acquisition or transfer of business. We will tell you in advance, and this policy will keep protecting your data.

10. International transfers

Kasankaf is based in Indonesia and our servers are in Indonesia. If you use Finansealy from another country, your data is sent to Indonesia so that we can provide the service you asked for. Some of our service providers process data in other countries: the United States and Singapore (see the table above).

We protect these transfers as follows:

• From Indonesia (PDP Law): we only transfer data to countries with an equal or higher level of protection, or with adequate and binding safeguards such as data processing agreements with standard data protection clauses. For the continuous flow of data to our AI provider we don't rely on consent alone; we rely on binding agreements, data minimisation and masking, and zero retention.
• From the European Economic Area, the United Kingdom and Switzerland: Indonesia doesn't have an adequacy decision. We process the data you give us in Indonesia to perform our contract with you. Where we pass it on to providers in other countries, we rely on the EU–US Data Privacy Framework (and its UK and Swiss counterparts) where the provider is certified, and otherwise on the European Commission's standard contractual clauses (with the UK Addendum) in the provider's data processing terms.
• From Brazil: transfers are necessary to perform our contract with you (article 33 of the LGPD), and our providers are bound by contractual data protection safeguards.
• From Japan: our providers abroad are bound by contract to take measures equivalent to those the APPI requires (see "Japan" under "Your rights where you live").
• From other countries: we rely on the grounds and safeguards their laws provide, such as necessity for our contract with you and binding contractual safeguards with our providers.

Before transferring, we assess the impact on the protection of your data. You can ask for information about the safeguards we use, or a copy of them, at hello@kasankaf.com. We will adjust the basis for transfers if data protection authorities issue new rules or adequacy decisions.

11. Security

• Every connection uses TLS.
• The database on your phone is encrypted, with keys kept in Android Keystore or the iOS Keychain.
• Our server database and its backups are encrypted at rest; backups are stored away from the main server.
• Staff access is limited to what is needed, uses two-step authentication, and is logged.
• App lock with fingerprint, Face ID or PIN; passwordless sign-in.
• We review security before launch and regularly after, and we test restoring from backups.

No system is risk-free. Keep your phone and email secure, and never give your OTP code or PIN to anyone, including people claiming to be from Finansealy.

12. How long we keep data

When your account is deleted (in the app or on the account deletion page): every device is signed out at once and there is a 7-day grace period. Signing in again within that period cancels the deletion. After it, your account and personal data are deleted from our systems, and from backups within 30 days of the request. Shared workspaces you own pass to another member; transactions you added to someone else's workspace remain part of that workspace.

13. Your rights

Wherever you live, you can:

• be informed about the processing of your data;
• access your data and get a copy of it;
• complete, update and correct inaccurate data;
• receive your data in a commonly used format (CSV export is available on every plan);
• end processing and have your data deleted;
• withdraw the consent you have given;
• object to processing, including decisions based solely on automated processing;
• suspend or restrict processing;
• sue for and receive compensation for violations in the processing of your personal data;
• complain to the data protection authority.

In Indonesia these are your rights under the PDP Law. The law where you live may give you more; see "Your rights where you live".

You can exercise most of these rights directly in the app (Settings > Privacy & data). For anything else, email hello@kasankaf.com. We may ask you to verify your identity, and we respond within the time limits of the law that applies to you. Using your rights is free, and we won't treat you differently for using them.

14. Your rights where you live

The laws below add to the rest of this policy for people who live in these places.

Indonesia

The PDP Law and its implementing regulations, including PP 33/2026, apply. Your rights are listed in "Your rights", and you can complain to the personal data protection authority. For users in Indonesia, the Indonesian version of this policy prevails.

European Economic Area (EU, Iceland, Liechtenstein, Norway)

• The General Data Protection Regulation (GDPR) applies. Our legal bases are: performance of a contract (Art. 6(1)(b)), consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)), for the purposes in "Purposes and legal bases".
• You have the right of access, rectification, erasure, restriction of processing and data portability; the right to object to processing based on legitimate interests; the right to withdraw consent at any time; and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (we make no such decisions).
• We answer within one month; for complex or many requests we can extend this by two more months and will tell you why.
• You can complain to the data protection authority of the country where you live or work, or where you think an infringement happened (list of authorities).

United Kingdom

The UK GDPR and the Data Protection Act 2018 apply, with the same legal bases and rights as in the EEA. You can complain to us first, and we acknowledge complaints within 30 days. You can also complain to the Information Commissioner's Office.

Brazil

• The General Data Protection Law (LGPD, Law No. 13,709/2018) applies. Our legal bases are performance of a contract (art. 7, V), consent (art. 7, I), legitimate interest (art. 7, IX) and legal obligation (art. 7, II).
• You have the right to confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about whom we share your data with; information about the option of not consenting and its consequences; withdrawal of consent; and review of decisions made solely by automated processing.
• Our channel for data protection requests is hello@kasankaf.com. You can also petition the National Data Protection Authority (ANPD) and consumer protection bodies.

Mexico

• The Federal Law on the Protection of Personal Data Held by Private Parties (2025) applies. You can access, rectify and cancel your data and object to its processing (ARCO rights), revoke your consent, and limit the use or disclosure of your data, for example by turning off promotional email.
• The purposes needed for the service you asked for don't require consent. The others (automatic logging, AI processing, product analytics, promotional email) do, and you can refuse them and keep using Finansealy. We ask for your express consent to process your financial data when you create your account after reading this policy, and separately in the app for automatic logging and AI processing.
• Our service providers act on our behalf, so sending them data doesn't need your consent.
• To use your rights, email hello@kasankaf.com with your name, your account email and what you are asking for; we answer within the time limits of the law. You can complain to the Secretaría Anticorrupción y Buen Gobierno.

Japan

• We handle your personal information under the Act on the Protection of Personal Information (APPI).
• Your data is stored in Indonesia, and providers in the United States and Singapore process some of it (see "Who we share data with"). Indonesia has a comprehensive data protection law (the PDP Law). The United States has no comprehensive federal data protection law; data is protected by sector-specific federal laws and by state laws. Singapore has the Personal Data Protection Act 2012. We require our providers by contract to take measures equivalent to those the APPI requires, and we check that they do.
• You can ask us to disclose the personal data we hold about you and the records of its provision to third parties, to correct, add to or delete it, and to stop using or providing it. You can also ask for more information about the measures above. Our security measures are in "Security".
• You can also contact the Personal Information Protection Commission.

Vietnam

• The Law on Personal Data Protection (2025) and its implementing decree apply. We process your data with your consent or on another basis the law allows, and we never treat silence or a pre-ticked box as consent.
• You have the right to be informed; to give and withdraw consent; to access, correct and get a copy of your data; to have it deleted; to restrict processing and to object to it; to complain, denounce or sue; and to claim compensation.
• Your data is processed outside Vietnam (in Indonesia, the United States and Singapore). We prepare the impact assessments Vietnamese law requires for processing and for transfers abroad, and keep them available to the Ministry of Public Security.

Thailand

The Personal Data Protection Act B.E. 2562 (2019) applies. You have the right to withdraw consent; to access and get a copy of your data and know how we obtained data you did not consent to; to receive or transfer your data; to object; to have your data deleted, destroyed or anonymised; to restrict its use; to have it corrected; and to complain to the Office of the Personal Data Protection Committee. Transfers abroad are necessary to perform our contract with you, and our providers are bound by appropriate safeguards.

Philippines

The Data Privacy Act of 2012 applies. You have the right to be informed, to object, to access, to rectification, to erasure or blocking, to damages and to data portability, and you can file a complaint with the National Privacy Commission.

United States

We don't sell your personal information, don't share it for cross-context behavioural advertising, don't use it for targeted advertising, and don't use it for profiling that produces legal or similarly significant effects. Wherever you live in the United States, you can ask to know, access, correct, delete and get a portable copy of your personal information, and we won't discriminate against you for asking. If we decline a request, you can appeal by replying to our answer; if you're still not satisfied, you can contact your state's attorney general.

Other countries

Wherever you live, you have the rights in "Your rights", and any further rights your local law gives you. Write to hello@kasankaf.com.

15. If a data breach happens

If a personal data protection failure happens, we will notify you and the competent authorities as the law requires: in Indonesia in writing within 3×24 hours of becoming aware of it, and elsewhere within the time limits of local law (for example, 72 hours to the supervisory authority under the GDPR). The notice covers the data affected, when and how it happened, and the steps we are taking to handle and recover from it.

16. Children

Finansealy is meant for users aged 18 and over and isn't directed at children. Users under 18 may only use Finansealy with the consent and supervision of a parent or guardian, for example as a member of a family workspace. If we learn we are processing a child's data without that consent, we will delete it.

17. Website and cookies

This website uses no ads, third-party trackers or analytics cookies. It only sets the cookies below, each for a feature you use, so they need no consent:

If Google sign-in is offered, the sign-in page loads Google's sign-in button from Google, which then receives your IP address and browser details under Google's privacy policy. Forms on this website (sign-in, feedback and account deletion) are sent to our servers, and server logs (IP address, browser type) are kept for security. Our domain's DNS is run by a DNS provider; your traffic to this website doesn't pass through it.

18. Changes to this policy

We may update this policy. For important changes we will tell you in the app or by email at least 14 days before they take effect, and ask for new consent where needed. The date at the top shows the latest version.

19. Language versions

This policy is published in Indonesian, English, Spanish, Portuguese, French, German, Japanese, Vietnamese and Thai. If the versions differ, the Indonesian version prevails for users in Indonesia and the English version prevails for everyone else, unless the law of the country where you live requires the version in your language to prevail.

20. Contact us

• PT Kasankaf Digital Solution, Jakarta, Indonesia
• Email: hello@kasankaf.com