Skip to main content

Privacy Policy

Last Updated: October 16, 2026

1. Introduction

ActualFinance ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our services.

2. Information We Collect and Why

We collect different categories of data depending on how you interact with ActualFinance:

  • Waitlist email address — collected when you sign up for early access. Legal basis: consent (Article 6(1)(a) GDPR). Used solely to notify you when early access is available and to send relevant product updates. You can withdraw consent at any time by emailing us or clicking the unsubscribe link in any email we send.
  • Account information — email address, hashed password, and profile settings when you register. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • Financial data — bank account details, transaction history, and balances fetched via GoCardless Open Banking. Legal basis: performance of a contract (Article 6(1)(b) GDPR). We use read-only access only — we cannot initiate payments or transfers.
  • Usage data — login history and interaction logs used to maintain security and improve the service. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Shared categorization of businesses — when several users independently file the same business under the same category, that pairing of business name and category may be used to categorize that business for other users. Payments to or from private individuals are never used for this. No user identifier is stored with the shared result, only aggregate counts. Legal basis: legitimate interests (Article 6(1)(f) GDPR). You can object to this processing at any time (see Section 6).

3. Third Parties Who Receive Your Data

These services run ActualFinance for us. Each receives only what its purpose needs. All of them except GoCardless are processors: they handle your data on our instructions, not for their own purposes.

  • Oracle Cloud — runs our servers: the app's back end, bank syncs in the background, caching, and backups. It holds everything the app processes, including your account, bank and transaction data and the IP addresses in server logs. Location: Amsterdam, the Netherlands.
  • Neon — our database. It stores your account and financial data. Location: Frankfurt, Germany.
  • Vercel — hosts the website. It receives your requests to the website, with your IP address, and your requests to our servers pass through it. Its server-side code runs in Frankfurt, Germany; its network may route a request through the location nearest to you.
  • GoCardless — connects to your bank with your consent (open banking) and retrieves your account information. GoCardless SAS (France) is a licensed payment institution supervised by the French ACPR, and acts as an independent data controller for that connection, under its own privacy notice. Location: the EU and the UK.
  • Sentry — error monitoring. It receives technical error reports, tagged with a pseudonymous account ID and never with your name or email address. Error data is stored in Frankfurt, Germany.
  • Resend — sends our emails, such as account verification and password resets. It receives your email address and the content of those emails. Location: the United States.
  • Triqai — recognises the merchant behind a transaction description. It receives transaction descriptions, with account holders' own names removed first. Triqai is based in the Netherlands; some of its sub-processors are in the United States.
  • Expo — delivers updates to the mobile app. It receives technical data from your device when the app checks for an update: the operating system, a random update token and your IP address. Location: the United States.

We do not sell your data to third parties and do not use it for advertising purposes.

4. International Data Transfers

Your account and financial data is stored in the European Union: our servers run in Amsterdam, the Netherlands, and our database in Frankfurt, Germany. Some of the services in Section 3 are based outside the EU/EEA, or process some data there:

  • Resend and Expo process data in the United States. Vercel and Sentry may too, for the parts of their service not tied to a region.
  • Oracle, Neon, Vercel and Sentry are, or belong to, US companies, which may access data from outside the EU where that is needed to provide their service.
  • Triqai uses some sub-processors in the United States.
  • GoCardless processes data in the EU and the UK.

These transfers are protected by the EU–U.S. Data Privacy Framework, for the companies certified under it (Vercel, Sentry, Resend, Expo, and Neon's parent company Databricks), and by the European Commission's Standard Contractual Clauses. Oracle also relies on its Binding Corporate Rules for Processors. Transfers to the UK rely on the European Commission's adequacy decision for the United Kingdom.

5. Data Retention

  • Waitlist entries — retained until you unsubscribe or request deletion, and no longer than 24 months after collection if early access has not been granted.

6. Your Rights Under GDPR

As a resident of the EU/EEA you have the following rights, exercisable by contacting us at the address in Section 7:

  • Right to access — request a copy of the personal data we hold about you.
  • Right to rectification — correct inaccurate or incomplete data.
  • Right to erasure — request deletion of your data ("right to be forgotten").
  • Right to restriction — ask us to limit how we process your data in certain circumstances.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl.

7. Contact Us

For any privacy-related questions or to exercise your rights, please contact us through the app.

8. Cookies

We use strictly necessary cookies to maintain your session. We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under the Dutch Telecommunications Act (Telecommunicatiewet).