Saldoh! Saldoh!

Privacy Notice

Last updated: June 11, 2026 What changed: Privacy Policy renamed to Privacy Notice and expanded with full GDPR structure.

1. Introduction

Welcome to Saldoh! Saldoh helps you view bank account balances on a home screen widget without signing in to your bank on that device. Your privacy is critically important to us. This Privacy Notice explains how we collect, use, disclose, and safeguard your personal information when you visit our website saldoh.eu (the “Website”), create an account, connect bank accounts, and use our widget service (the “Services”).

Please read this notice carefully to understand our practices regarding your information and how we will treat it.

  • Data Controller: [Legal entity name], [Address], Chamber of Commerce number: [Registration number]. Email: privacy@saldoh.eu (data controller under the General Data Protection Regulation (GDPR))
  • Data Protection Officer (DPO): You can contact our Data Protection Officer regarding any data protection queries or to exercise your rights by emailing: privacy@saldoh.eu
  • Scope of this Privacy Notice: This Privacy Notice describes how Saldoh processes personal data for which we act as Data Controller under the GDPR (for example, data relating to users who create an account, connect bank accounts, and use the widget). When you connect a bank account through Saldoh, we process balance and account data solely to provide the service you requested. Our open banking partner Enable Banking processes data in that context as a processor on our behalf.

2. Information We Collect (When We Act as Data Controller under the GDPR)

Information You Provide to Us: When you create a Saldoh account, connect bank accounts, set up the widget, or communicate with us, we collect information you provide directly. This may include:

  • Your email address
  • Bank connection data you authorise through open banking, such as bank name and country, and the expiry date of your consent
  • Account labels you assign and account names as received via the bank API
  • Cached balance data (amount, currency, and time of last update)
  • Widget pairing codes (6-digit codes, valid for 60 seconds) and permanent widget tokens used to link the mobile widget to a linked account
  • The content of communications with us, such as support inquiries by email

Automatically Collected Information: When you use our Website and Services, we may automatically collect certain information, including:

  • Your IP address (temporarily held in memory for rate limiting and abuse prevention; not stored in our database)
  • Device and browser information (such as operating system, browser type, and version) via standard server logs
  • Information about how you use our Website (for example, pages visited and features used)

Data on Your Android Device: The Saldoh widget app stores locally on your device, in encrypted form, what is needed to function, including the widget token, a cached balance, account name, and display preferences. This data leaves your device only when the widget fetches balance updates via our API.

Data We Do Not Collect: We do not store bank passwords, IBANs, or transaction history. We provide read-only access to balances for only those accounts for which you have given consent.

3. How We Use Your Information and Our Lawful Bases for Processing

We use your personal information for the following purposes, based on the specified lawful grounds under the General Data Protection Regulation (GDPR):

To Provide, Maintain, and Improve Our Services:

  • Purpose: To create and manage your account, authenticate you via magic links, connect bank accounts through open banking, display balances in the dashboard and widget, manage widget pairings, and ensure the technical functionality of the platform.
  • Lawful Basis: Performance of our contract with you (Article 6(1)(b) GDPR); our legitimate interests in maintaining and improving our Services (Article 6(1)(f) GDPR).

To Communicate With You:

  • Purpose: To send you important notices about your account (for example, login links, email change confirmations, and service notifications), respond to your inquiries, and provide customer support.
  • Lawful Basis: Performance of our contract with you (Article 6(1)(b) GDPR); our legitimate interests in providing good customer service and keeping you informed (Article 6(1)(f) GDPR).

For Service Integrity, Security, and Abuse Prevention:

  • Purpose: To monitor trends, usage, and activities to detect, investigate, and prevent fraudulent use, unauthorised access, and abuse of our API. This includes automated rate limiting on certain API endpoints (see Section 10: “Automated Decision-Making”).
  • Lawful Basis: Our legitimate interests in protecting our Services, users, and business (Article 6(1)(f) GDPR).

To Keep Balances Up to Date:

  • Purpose: To update linked account balances periodically (approximately every hour) and on request via the widget through our open banking partner.
  • Lawful Basis: Performance of our contract with you (Article 6(1)(b) GDPR).

4. Sharing and Disclosure of Your Information

We do not sell or rent your personal information. We may share your personal information in the following limited circumstances with third parties who act as our processors, or where legally required:

With Service Providers (Our Processors): We engage third parties to perform functions and provide services to us. Where the GDPR requires it, we have data processing agreements in place with these parties. These include:

  • Open banking: Enable Banking OÜ (Estonia) to establish European bank connections and retrieve balances on your behalf, based on your consent via your bank.
  • Email delivery: AhaSend B.V. (Netherlands) to send transactional emails, such as magic links and confirmation emails.
  • Hosting and infrastructure: [Hosting provider] to host our Services and associated data.

With Your Consent: We may share your information with other third parties when we have your explicit consent to do so.

Legal Obligations: We may disclose information when required by law or necessary to protect our rights, your safety, or that of others.

5. Cookies and Tracking Technologies

Saldoh uses cookies and similar technologies to enable certain functionality of our Services. We do not use third-party analytics or advertising cookies.

We use cookies for:

  • Providing Essential Functionality (Strictly Necessary Cookies): Some cookies are required for the basic functionality of our Services, including user authentication for the dashboard and maintaining session information (_saldoh_key). These are used based on our legitimate interest in providing you with a functioning service.
  • Language Preference (Functional Cookies): To remember your language preference (_saldoh_locale, valid for up to 1 year, SameSite=Lax).
  • Stay Signed In (Functional Cookies): When you choose this option, a cookie to keep you logged in (_saldoh_web_user_remember_me, valid for 14 days).

We also use localStorage in your browser to store your UI theme preference (phx:theme). This is not tracking; it only affects how the Website is displayed.

Your Choices Regarding Cookies

You can adjust your Internet browser settings to reject some or all cookies and to alert you when a cookie is placed on your device. Please note that if you delete or refuse essential cookies, you might not be able to use all features of our Services.

6. Data Security

We take reasonable technical and organisational measures to help protect your personal information from loss, theft, misuse, unauthorised access, disclosure, alteration, and destruction, in accordance with Article 32 GDPR. This includes:

  • Encrypted connections (HTTPS) for all traffic to our Website and API in production
  • Hashed storage of magic-link and session tokens in our database
  • Randomly generated widget tokens for API authentication
  • CSRF protection on web forms

However, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. We are committed to continuously improving our security measures.

7. International Data Transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country.

Our primary processors Enable Banking OÜ (Estonia) and AhaSend B.V. (Netherlands) are located within the European Economic Area (EEA).

If our hosting infrastructure or other processors process data outside the EEA, we ensure that appropriate safeguards are in place in accordance with the GDPR, such as:

  • an adequacy decision by the European Commission, or
  • Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented with additional measures where appropriate.

By using our Services, you acknowledge that your information may be transferred to our facilities and to those third parties with whom we share it as described in this Privacy Notice.

8. Data Retention

We will retain your personal information only for as long as is necessary for the purposes for which it was collected, as set out in this Privacy Notice, and to comply with our legal obligations.

  • Account information: We retain your account information (such as email address and linked accounts) for as long as your account is active with us. If you request account deletion, your personal data will generally be erased within 14 days, unless we are legally required to retain specific data for a longer period.
  • Session tokens: Login sessions are valid for 14 days.
  • Magic links: Login links expire after 15 minutes.
  • Widget pairing codes: 6-digit pairing codes expire after 60 seconds.
  • Widget tokens: Remain valid until you unlink an account or delete your account.
  • IP addresses for rate limiting: Are held only temporarily in memory for abuse prevention and are not persistently stored in our database.
  • Communications: Emails and support communications with you may be retained for up to 3 years after our last interaction to address follow-up queries or for record-keeping purposes.

9. Your Rights

If you are within the European Economic Area (EEA), UK, or another jurisdiction with similar data protection laws, you have the following rights regarding your personal data:

  • The right to access: You can request copies of your personal data that we process.
  • The right to rectification: You can request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
  • The right to erasure (‘right to be forgotten’): You can request that we erase your personal data, under certain conditions (for example, upon account deletion; see Section 8: “Data Retention”).
  • The right to restrict processing: You can request that we restrict the processing of your personal data in certain circumstances.
  • The right to object to processing: You can object to our processing of your personal data (for example, where we rely on legitimate interests), under certain conditions.
  • The right to data portability: You can request that we transfer the data we have collected from you to another organisation, or directly to you, in a structured, commonly used, and machine-readable format, under certain conditions.
  • The right to withdraw consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing prior to your withdrawal.
  • Rights related to automated decision-making: You have rights concerning automated decision-making that has legal or similarly significant effects (see Section 10: “Automated Decision-Making”).

To exercise any of these rights, please contact us at privacy@saldoh.eu. We will respond to your request within one month, as required by the GDPR. We may need to request specific information from you to help us confirm your identity before processing your request.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your personal data infringes the GDPR or other applicable data protection laws. For users in the Netherlands, the relevant supervisory authority is the Autoriteit Persoonsgegevens, Hoge Nieuwstraat 8, 2514 EL The Hague. Website: https://www.autoriteitpersoonsgegevens.nl. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.

10. Automated Decision-Making

To maintain the integrity and security of our Services and to prevent abuse, we use automated systems for rate limiting on certain API endpoints. These systems analyse, among other things, the number of requests per IP address within a time window.

If the limit is exceeded, the system may automatically reject requests with an error message (rate_limited). This is an operational security measure and does not have legal or similarly significant effects within the meaning of Article 22 GDPR.

Your Rights: If you believe an automated measure was applied incorrectly, you can contact us at privacy@saldoh.eu to discuss your situation.

11. Information About Children

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information without parental consent, we will take steps to delete such information. If you believe that we might have any information from or about a child, please contact us at privacy@saldoh.eu.

12. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, service offerings, legal requirements, or other factors. When we make changes, we will revise the “Last updated” date at the top of this document. If we make material changes to how we treat your personal information, we will endeavour to provide you with notice through the Services or by email, where feasible.

We encourage you to review this Privacy Notice periodically to stay informed about our data protection practices. Your continued use of our Services after any changes to this Privacy Notice will mean you accept those changes.

Questions? Contact us at privacy@saldoh.eu