Last updated: September 30, 2026
Draft notice
This policy is a detailed draft prepared for GDPR transparency and awaits human and legal review before being treated as final counsel.
Controller
Money Timeline is operated by TomTech Digital SRL (CUI 52861283), registered at Jud. Sibiu, Municipiul Sibiu, Aleea Călărașilor, Nr. 5, Bl. G, Ap. 54, România. For privacy requests contact contact@tomtechdigital.com.
Categories of personal data
We process: (1) account data such as email and internal user id; (2) authentication data from email/password or Google OAuth; (3) budget inputs you enter (cash, incomes, expenses, settings, timezone); (4) optional push subscription keys; (5) subscription and payment metadata from Stripe (we do not store full card numbers); (6) support and withdrawal declarations, including the name, contact address, and contract details you provide; (7) technical logs from hosting. We do not collect bank credentials or transaction feeds.
Purposes and legal bases (GDPR Art. 6)
Provide the service and sync your plan (contract / steps prior to contract). Secure accounts and prevent abuse (legitimate interests). Optional push notices you enable (consent, which you can withdraw in browser settings). Subscriptions and tax invoicing (contract / legal obligation where applicable). Handle support and withdrawal declarations (contract and legal obligation where applicable). Improve reliability via minimal operational logs (legitimate interests). Account and billing details are needed to provide a paid subscription; optional push data is not. We do not sell personal data or use it for advertising profiles.
Authentication
Email/password accounts are managed through Supabase Auth. Google sign-in uses OAuth and returns profile identifiers needed to create your session. You can reset passwords via email links.
Budget and plan content
Cash, entries, and settings you enter are stored to render simulations. Accuracy depends on what you type; we do not verify balances against banks.
Subscriptions, payments, tax, invoices
Pro checkout runs on Stripe-hosted pages. We store subscription status and Stripe customer references. When configured, StartCo may issue Romanian fiscal invoices using billing details you provide at checkout.
Push notifications
If you enable push on a supported browser, we store the subscription endpoint and send alerts you opt into (Pro). You can revoke permission in browser settings.
Providers and privacy roles
We use Supabase (database/authentication), Google (OAuth), Vercel (hosting/CDN), Stripe (payments), StartCo (invoicing when enabled), and Resend (support and withdrawal email when enabled). Their privacy roles vary by activity. In particular, Stripe may act as our processor for some payment data and as an independent controller for other purposes such as fraud prevention and legal compliance.
International transfers
Some providers may process data outside the EEA. The applicable region and transfer safeguard depend on the provider and service configuration. Ask contact@tomtechdigital.com for information about a specific transfer and its safeguard.
Retention
We keep account and plan data while your account is active. Billing records are retained for applicable tax and accounting duties. Support and withdrawal correspondence is kept as needed to handle the request and legal claims. Operational logs follow the configured provider retention periods. Deletion requests remove or anonymize personal data unless a legal duty requires retention.
Security
We use industry-standard transport encryption and access controls. No online service is perfectly secure; report suspected issues to contact@tomtechdigital.com.
GDPR rights and complaints
You may lodge a complaint with a supervisory authority, including ANSPDCP in Romania (www.dataprotection.ro). You do not need to contact us first. You may withdraw consent for optional push at any time in your browser settings; this does not affect processing that took place before withdrawal.
Deletion
Open Account in the app header and use Delete account. You can also email contact@tomtechdigital.com from your account address. We may retain billing records where law requires.
Children
Money Timeline is not directed at children under 16. If you believe a child provided personal data, contact us so we can review and delete it where required. Other local age or contract-capacity rules may also apply.
Changes to this policy
We will post updates here with a new date. Material changes may also appear in-app or by email when appropriate.
Contact
Privacy questions: contact@tomtechdigital.com.