Privacy policy

What we collect

Account data: e-mail address, display name and sign-in details (passwords are stored only as secure hashes by our authentication provider).

Household plan data you enter: income, housing, loans, expenses, savings and member names within your household.

Subscription data: plan, status and billing period. Card details are handled by our payment provider Paddle and never reach us.

BoMove on the public page runs in your browser only and is not stored.

Why we process it

To provide the service and share the plan within your household (performance of contract, GDPR art. 6.1 b).

To handle subscriptions and bookkeeping (legal obligation, art. 6.1 c).

To keep the service secure and fix errors (legitimate interest, art. 6.1 f).

Storage and security

Data is stored with our hosting provider within the EU/EEA where possible, encrypted in transit (HTTPS/TLS) and at rest. Access rules in the database ensure only members of your household can read your plan.

AI cost estimates send only the expense name you type to an AI provider; no personal identifiers are included.

Sharing

We do not sell your data. We share it only with these service providers, each bound by a data processing agreement and used only to run BoWise.:

• Lovable (Lovable Labs Incorporated, Sweden) — app hosting, database, sign-in and sign-in e-mails (via Lovable Cloud, built on Supabase). Stores your account and household plan. [CONFIRM DATA REGION]

• Cloudflare, Inc. (USA) — delivers the website and runs server functions; processes IP addresses and requests in transit.

• Lovable AI Gateway and OpenAI (USA) — only when you use AI cost estimates; receives the expense name you type, no personal identifiers.

• Paddle.com Market Ltd (UK) — Merchant of Record for payments: checkout, card details, invoices, VAT and refunds. Receives your e-mail address and payment details.

• Google LLC (USA) — Google Fonts; your browser loads typefaces directly from Google's servers, so Google sees your IP address and the fact that you visit BoWise. This happens every time you open the app.

International transfers: where providers process data outside the EU/EEA (USA, UK), transfers rely on EU adequacy decisions (UK; the EU–US Data Privacy Framework for certified US companies) or the EU Standard Contractual Clauses. We may also share data with professional advisers or authorities when required by law.

Retention

Account and plan data are kept until you delete your account. Subscription and payment records are kept as long as Swedish bookkeeping law requires (7 years).

Your rights

You may access, correct, export, restrict or delete your data and object to processing. Export and deletion are available under Settings → Privacy & legal. You may complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Cookies

We use only strictly necessary storage (sign-in session, language choice). No tracking or advertising cookies are used, so no consent banner is required. If that changes, we will ask for consent first.