Kasandro privacy policy.
The full text follows, in plain language, without annexes. Every chapter starts with what it means for you. The binding text is the Polish one.
1. Who the controller is
Tomasz Żyłka Veinito.com, Bierzycka 8, 51-179 Wrocław, Poland, VAT ID PL6452337008, REGON 521704806. Contact for data matters: support@kasandro.com. We have not appointed a data protection officer; the founder is responsible.
2. What data we read and why
From the bank, with your PSD2 consent and through Enable Banking: transactions (date, amount, counterparty, title, place and time when the bank provides them), the balance and the account name, for the accounts you select. Why: to draw the river, count shops, places, hours and habits, leave out transfers between your own accounts, and write the letter from 2056. Legal basis: the contract (Art. 6(1)(b) GDPR).
3. What we do not do
We do not see your bank login or password. We do not initiate transfers. We do not sell data or pass it to advertisers. We do not score creditworthiness or profile you for offers. We do not train AI models on your data and we require the same from our vendors. Security.
4. Where the data is stored
In the European Union: the Neon database and Netlify hosting in Frankfurt. AI processed in the EU. The full list of vendors, regions and retention: Subprocessors. Subprocessors.
5. For how long
Chapter in preparation; until it is published, the sentence at the top of the page applies.
6. Subprocessors
Chapter in preparation; until it is published, the sentence at the top of the page applies.
7. Household: what your partner sees
Chapter in preparation; until it is published, the sentence at the top of the page applies.
8. Your rights (access, rectification, portability, objection, complaint to the UODO)
You have the right to access your data and get a copy, to rectification, erasure, restriction of processing and data portability, to object, and to lodge a complaint with the President of the UODO (the Polish data protection authority). Send your request to support@kasandro.com from the address you use in Kasandro. Before we hand over, change or erase any data, you confirm the request with a code we send to your account address. We answer without undue delay and within one month at the latest (Art. 12(3) GDPR). We answer only the person the data is about: we never hand over another household member's data. Do not send statements, screenshots from your bank, your bank login or your card number: no request needs them.
9. Deleting everything in one tap
In the app: Settings, "Delete everything", one confirmation. Without access to the app, write to support@kasandro.com from your account address; once you confirm with a code we send to that address, we delete everything the same way. The key that encrypts your transactions is erased at once, so backups become unreadable and disappear within the declared period. You can also revoke your consent at your bank.
10. Changes to this policy and contact
We announce changes to this policy in "What's new" 14 days in advance. Contact for anything about your data: support@kasandro.com. It is our only address and the only one we write from. Messages in this mailbox are deleted 12 months after the last message in the thread; a request to erase data or withdraw consent is kept as long as we may need to show we carried it out. Bank data sent to us despite our request (statements, screenshots, card numbers) is deleted on receipt.
Kasandro is an insight tool for your finances, not investment or financial advice.