In short
- We keep only what's needed for you to track your subscriptions.
- We have no access to your bank or your card.
- We don't sell data and don't show ads.
- You can delete your account anytime, in the app.
Who we are
Novilun is an independent project, developed and run by its author, a private individual (“we”), who is the controller of your data and decides how and why it is processed. This policy applies to the Novilun app and the website getnovilun.com, for all users, wherever they are.
You can write to us anytime at suport@getnovilun.com.
What data we process
| Category | What exactly | Where from |
|---|---|---|
| Account | Display name, email, password (encrypted only), your Apple or Google identifier if you sign in with them | You, Apple or Google |
| Subscriptions | Service, amount, currency, cycle, payment date, category, notes and payment method you write | You |
| Settings | Language, base currency, theme, notification preferences | You |
| Devices | Phone model and system, notification token, last activity | Your phone |
| Support | The messages you send us by email | You |
What we don’t process
- Your bank account or card details and your transactions.
- Your location, contacts or photos.
- Data for ads or marketing profiles.
- Statistics about how you use the app: the app doesn’t send such data.
Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Your account and syncing subscriptions across devices | Performance of the contract (Terms of use) |
| Reminders and the monthly summary via notifications | Your consent, given on your phone; you can withdraw it anytime in settings |
| Currency conversion, calendar and statistics | Performance of the contract |
| Security, abuse prevention, technical logs | Our legitimate interest in protecting the service |
| Answering support requests | Performance of the contract and legitimate interest |
| Requests from authorities | Legal obligation |
We don’t make automated decisions with legal effects on you and don’t profile you for ads.
We don’t sell, rent or give your data to others for advertising. Only the technical services without which Novilun can’t work have access to it, under contract. If an authority asks us for data based on the law, we check the request and give only what is mandatory.
Service providers and transfers
To run Novilun we use a few technical service providers. They process data only on our behalf and only for their service:
- Server hosting: the servers and the database that hold your account and subscriptions.
- Google Firebase Cloud Messaging and Apple Push Notification service: deliver notifications to your phone; they receive the device’s notification token and the notification text.
- Apple and Google: if you sign in with them, they send us the account identifier and the email (possibly hidden by Apple).
- Email service: sends the confirmation and password reset codes; it receives your email address and the code.
- Exchange rates: the server asks a rate provider for the day’s rates, without any data about you.
Some providers (for example Google or Apple) may also process data outside the European Economic Area. In that case, the transfer relies on the European Commission’s standard contractual clauses or other safeguards provided by law.
How long we keep data
- As long as you have an account.
- After you delete your account, we delete the data from our active systems; backups are overwritten automatically.
- We keep technical logs and support messages only as long as needed for security and to answer you.
- What the law requires us to keep, only for as long as the law requires.
Your rights
- Access: find out what data we have about you.
- Rectification: correct it in Profile or write to us.
- Erasure: delete your account in the app (the steps).
- Restriction and objection to certain processing.
- Portability: get your data as a CSV file: in the app when you delete your account, or on request by email.
- Withdrawing consent for notifications, anytime.
Write to us at suport@getnovilun.com from your account’s address and we’ll answer within the time set by law, usually within one month. You can also lodge a complaint with the data protection authority in the country where you live.
How we protect data
- Encrypted connections (TLS) between the app, the website and the servers.
- Passwords are stored only in encrypted, irreversible form.
- Internal access limited to those who need it to maintain the service.
- In case of an incident, we notify the authorities within the time required by law, and you, if the risk is high.
Children
Novilun is not meant for children. If you learn that a child has given us data, write to us and we’ll delete it.
Cookies on the website
The website doesn’t use cookies: none for ads, tracking or statistics. You choose the language from the page address, and the theme follows your device’s setting.
Changes to this policy
When we change something important, we let you know in the app or by email before it takes effect. You can ask for previous versions at suport@getnovilun.com.
Contact
For any question about your data or this document: suport@getnovilun.com.