Privacy Policy

Controller

Marc Hoffmann
Danziger Str.
38239 Salzgitter
Deutschland

privacy@kesumi.app

Scope

This policy covers the Kesumi iOS app, website, waitlist and API operated by Marc Hoffmann in Germany.

Local Activity Data

Activities, categories, lists, habits and saved receipt attachments are stored on your device. Apple Pay automations can add activity and card metadata locally. These records are not uploaded as a complete activity database to our server. Device backups are governed by your Apple settings.

Optional AI Processing with OpenAI

Kesumi Pro includes receipt scanning, categorization and monthly reviews that use OpenAI as a data processor on our behalf. The paywall describes the data sent for these features. Selecting Agree and subscribe accepts the Terms of Use and explicitly authorizes that processing when the purchase succeeds. Existing subscribers, restored purchases and beta users without recorded permission are asked before their first AI request. Canceling renewal ends Pro AI access when your entitlement expires, not immediately. For consent withdrawal requests, contact privacy@kesumi.app. Manual tracking remains available. Withdrawal stops future AI requests but does not undo processing already performed.

Receipt and statement scanning: the selected images and everything visible in them, including merchant names, purchases, amounts, dates and any visible personal, bank or payment details. Images are not automatically anonymized. Remove unnecessary sensitive information before submitting a scan.

Categorization: the activity description and available category labels, linked to temporary category identifiers. This applies to manual entry, scanned activities and eligible Apple Pay automations. Common identifiers such as email addresses, phone numbers and IBANs are filtered, but this cannot guarantee anonymity. No separate card details, receipt image or user identifier are included in the categorization payload.

Monthly reviews: aggregated spending and consistency figures, category budgets, savings goals and tracked habit progress. Income is included only when income tracking is enabled. Categories use temporary identifiers; activity descriptions, card details and subscription identifiers are excluded from the model input. Results are restored to your categories on your device.

AI results may be incorrect. Check extracted activities and categories before saving, and review budget and habit suggestions before applying them. Suggestions are not financial, investment, tax or legal advice.

OpenAI Data Use and Retention

According to OpenAI, API inputs and outputs are not used for model training by default unless the API customer opts in. Kesumi requests that responses are not stored as response history. This does not mean zero retention: OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, or longer for legal or safety reasons. Model caching and image safety review may involve additional retention under its data controls.

OpenAI API data controls

Subscriptions and Service Providers

Apple handles App Store purchases and payments. RevenueCat processes purchase information, an app-generated subscription identifier and entitlement status to manage and restore access. Our API uses that identifier to verify access; it is not sent to OpenAI. Subscription processing is separate from AI-sharing consent.

DigitalOcean hosts our website and backend API. The backend processes AI request contents in memory and forwards the data needed for each feature to OpenAI; it does not persist activity descriptions, scans or AI inputs and outputs in a user database. We do not maintain personal user profiles on the backend. This is distinct from the technical logs, temporary subscription cache and voluntary waitlist described below, and from retention by OpenAI and purchase providers.

Server Logs and Temporary Processing

Server and hosting logs may contain IP addresses, request times, requested paths, response status and other connection metadata. IP addresses can constitute personal data. We use these logs to operate and secure the service, investigate errors and prevent abuse, not to build advertising profiles. Our application logs exclude AI request contents and authorization credentials. When configured, Sentry receives limited technical error reports without request bodies.

Subscription verification uses a pseudonymous RevenueCat identifier. The backend can cache the verification response in memory for up to five minutes under a hashed cache key. This cache is not a persistent user database. Technical logs are retained only as long as necessary for security and troubleshooting, or to meet legal obligations; contact us for the applicable retention details.

Waitlist and Website

Joining the waitlist stores your email address and submission time so we can send launch and product updates. You can unsubscribe or request deletion at privacy@kesumi.app. The current website does not include advertising pixels.

Support, Security and Local Data

If you contact us by email, we process your email address and the information you provide to answer your request. Please avoid sending unnecessary financial records or payment details. Correspondence is retained as needed to resolve the request and meet applicable legal obligations.

Production API requests use HTTPS. Access to server operations and credentials is restricted. No transmission or storage system is completely risk-free. We cannot retrieve or restore records that exist only on your device. Local deletion does not erase existing device backups, server logs, support correspondence or provider records; their respective retention rules apply.

Legal Bases Under GDPR

AI data sharing and waitlist communications rely on consent (Article 6(1)(a) GDPR). Providing requested services and verifying subscriptions rely on contract performance (Article 6(1)(b)). Security and abuse prevention rely on our legitimate interest in a reliable service (Article 6(1)(f)). Required records may be processed to meet legal obligations (Article 6(1)(c)).

International Transfers

Service providers may process data outside the European Economic Area, including in the United States. Applicable transfer safeguards may include adequacy decisions or standard contractual clauses. Contact privacy@kesumi.app for information about the safeguards applicable to your data and how to obtain a copy.

Retention and Your Rights

Local records and cached monthly reviews remain on your device until deleted. Reset activity data in Settings removes activity data locally; it does not cancel subscriptions or erase provider records. Waitlist data is retained until you unsubscribe, request deletion or the purpose ends, subject to legal obligations. Technical records are kept only as needed for operation, security and legal requirements. Provider retention also applies to previously processed requests and purchases.

Where GDPR applies, you can request access, correction, erasure, restriction and portability, withdraw consent, and object to processing based on legitimate interests. Withdrawal does not affect the lawfulness of earlier processing. Contact privacy@kesumi.app. You can also complain to a data protection supervisory authority. We update this policy when processing changes.