Privacy Policy

What We Collect

When you create a Nett account, we collect your email address, name, and organization name. To deliver the service, we also process the financial data you choose to enter:

• Bank balance — entered manually by you. We never connect to your bank or request banking credentials.
• Recurring costs and commitments — entered manually by you.

Nett does not connect to Stripe, your bank, or any other third-party financial account. There is no OAuth authorization step and we never receive access to your revenue, transactions, or payment methods. All financial figures shown in Nett come from what you type in.

Why We Process Your Data

We process your data under the following legal bases (per GDPR Articles 6 and 9):

• Contract — your account and the financial data you enter are processed to deliver the Nett service you signed up for.
• Consent — analytics cookies (Google Analytics) are only set after you accept cookie consent. Email communications beyond transactional are based on your email preferences.

How We Store It

Your data is stored in Supabase (PostgreSQL on AWS us-east-1, USA), encrypted at rest and in transit. We use row-level security (RLS) so your data is only accessible to your account. Our application is hosted on Vercel (USA, with edge functions on global CDN).

Service Providers (Sub-Processors)

We use the following third-party services to operate Nett. Each has a Data Processing Agreement (DPA) in place:

We do not sell, rent, or share your data with anyone outside this list.

Data Retention

• Account and financial data — retained for the lifetime of your account plus 30 days after deletion, in case you reactivate.
• Email address (abuse prevention) — after account deletion, we retain a hashed record of your email address to prevent signup abuse. This contains no financial data and cannot be used to contact you.
• Analytics data — automatically deleted after 90 days.

Cookies

We use two categories of cookies:

• Essential — Supabase authentication session. Always active. Required for the service to function. No consent needed.
• Analytics — Google Analytics. Default: off. Only activated after you accept via the cookie banner. You can withdraw consent at any time by clearing cookies or declining when re-prompted.

Your Rights

Under GDPR (and similar laws), you have the following rights regarding your personal data:

• Access — request a copy of all data we hold about you.
• Rectification — correct any inaccurate data (you can do this directly in-app).
• Erasure — request deletion of your account and all associated data.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we pause processing of your data.
• Objection — opt out of non-essential communications via email preferences in your account settings.

To exercise any of these rights, email hello@nett.fyi. We will respond within 30 days.

International Data Transfers

Nett stores and processes data in the United States. For users in the European Economic Area (EEA), United Kingdom, or Switzerland, data transfers are protected by Standard Contractual Clauses (SCCs) included in our agreements with each sub-processor listed above.

Do Not Sell or Share My Personal Information

Nett does not sell or share your personal information for cross-context behavioral advertising. We do not participate in data broker activities. If you are a California resident (or resident of any US state with similar consumer privacy laws), you have the right to request deletion of your data and to know what data we collect. To exercise these rights, email hello@nett.fyi.

Contact

For privacy questions, data requests, or concerns, email hello@nett.fyi.

If you believe your data rights have not been adequately addressed, you have the right to lodge a complaint with your local data protection supervisory authority.

Changes

If we update this policy, we'll update this page and the date at the top. For material changes, we will notify you by email.