Welcome to Talvo. We place the highest value on protecting your privacy and securing your personal and financial data. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the Talvo application and our associated website (collectively referred to as the "Service").
Our processing of personal data is fully in accordance with the European General Data Protection Regulation (GDPR).
1. Who is the Data Controller?
Talvo is the data controller for the processing of your personal data. If you have any questions about this Privacy Policy or wish to exercise your rights, you can contact us at:
2. What Personal Data Do We Collect?
To provide our Service, we process several categories of personal data:
A. Account and Profile Data
- Email address (required for account registration).
- Name (optional, for personalization).
- Login credentials (encrypted password hashes or tokens from third-party login providers).
B. Financial Data (Bank Connection via Open Banking)
When you choose to link your bank account(s) to Talvo through our authorized Open Banking partner(s), we collect and process:
- Account information (such as your IBAN account number, account holder name, and current balance).
- Transaction history (such as transaction amounts, dates, descriptions, and counterparty names).
Our primary Open Banking partner is Enable Banking, though we reserve the right to work with other licensed Account Information Service Providers (AISPs) in the future to ensure the best coverage and service.
C. Technical and Usage Data
- IP address, browser type, operating system, and device identifier.
- Anonymous interaction data (such as which screens you visit and how you navigate the app) to improve app performance and stability.
3. Why and On What Legal Basis Do We Process Your Data?
We only process your personal data when we have a valid legal basis under the GDPR. We rely on the following bases:
| Purpose of Processing | Processed Data | Legal Basis (GDPR) |
|---|
| Creating and managing your Talvo account. | Account and Profile Data. | Performance of a contract. |
| Retrieving and synchronizing your bank transactions and balances. | Financial Data (IBAN, transaction history). | Explicit Consent (GDPR & PSD2). |
| Automatically categorizing and analyzing your spending patterns. | Financial Data (transaction details). | Explicit Consent / Legitimate interest. |
| Sending transactional emails (e.g., password resets, service updates). | Email address. | Performance of a contract. |
| Optimizing and technically securing the application. | Technical and Usage Data. | Legitimate interest. |
4. How Long Do We Retain Your Data?
We retain your personal data no longer than strictly necessary to fulfill the purposes for which it was collected:
- Account and Financial Data: Retained as long as you maintain an active account with us. If you delete your account, all associated personal and financial transaction data will be immediately and permanently deleted from our production databases.
- Backups: Data in backups may persist for up to 30 days after deletion before being permanently overwritten.
- Anonymized Data: Data that has been completely and irreversibly anonymized (e.g., for general spending benchmarks) is no longer considered personal data and may be retained indefinitely.
5. Sharing Data with Third Parties (Subprocessors)
Talvo never sells or rents your personal or financial data to third parties. We share your data exclusively with trusted service providers (processors) necessary to run our Service:
- Hosting and Database Providers: To securely store your data (exclusively on servers located within the European Economic Area / EEA).
- Open Banking API Partners: Licensed third parties (such as Enable Banking) that facilitate the secure connection with your bank. They process your data solely to pass transaction info to Talvo based on your explicit consent.
- Email Service Providers: To send necessary system, transactional, or account-related messages.
- Error Tracking & Stability (Sentry): To monitor application crashes and technical errors in real-time. Sentry is configured to automatically mask and scrub any sensitive financial or personal data before logs are transmitted.
- Product Analytics (PostHog): To analyze application usage and improve our user interface. This is only activated with your explicit consent, and any session recordings are heavily masked to ensure your financial transactions and personal details remain completely private and invisible to us.
We maintain strict Data Processing Agreements (DPAs) with all our processors to guarantee the security and confidentiality of your data.
6. Security of Your Data
The security of your financial data is our absolute priority. We have implemented appropriate technical and organizational measures:
- Encryption: All data exchanged between your device, our servers, and your bank is encrypted in transit using HTTPS / TLS. In addition, all stored data in our databases is encrypted at rest.
- Access Control: We enforce strict authentication methods for access to our systems. Database access is restricted to the absolute minimum of authorized technical staff.
- No Storage of Bank Credentials: Talvo never has access to, nor stores, your bank login credentials (such as PINs, passwords, or authentication codes). The connection to your bank always occurs directly within the secure, native environment of your own bank.
7. Your GDPR Rights
Under European GDPR legislation, you have strong rights regarding your personal data. You can exercise these at any time through the app settings or by contacting us at info@gettalvo.com:
- Right of Access and Rectification: You have the right to request a copy of the data we process about you and to have any inaccuracies corrected.
- Right to Data Portability: You can request an export of your transaction history and account details in a structured, commonly used format (e.g., JSON or CSV) at any time.
- Right to Restrict or Object: You can object to certain processing activities or ask us to temporarily restrict how we process your data.
- Right to Withdraw Consent: You can disconnect your bank account and withdraw your consent at any time. We will immediately stop retrieving new transactions and delete any existing linked bank data.
- Right to Erasure (Right to be Forgotten): You can request the complete deletion of your account and all associated personal data.
If you believe Talvo is not processing your data correctly, you have the right to lodge a complaint with your local supervisory authority. In Belgium, this is the Belgian Data Protection Authority (GBA / APD).
8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect new app features or changes in legislation. We will notify you of any material changes directly through the app or via email.