Privacy Policy

1. Introduction

Traq ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at traq.fi and our financial management services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the collection and use of your information as described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information You Provide

We collect information you voluntarily provide when using our Service, including:

• Account Information: Name, email address, phone number, password, and profile picture
• Payment Information: Billing address, payment card details (processed securely through our payment processor)
• Business Information: Company name, business type, industry, and team member details
• Communications: Messages you send to us via email, contact forms, or support requests
• User Content: Invoices, receipts, notes, and other documents you upload

2.2 Financial Data

When you connect your bank accounts or financial institutions, we collect financial data including:

• Account balances and transaction history
• Account mask (last 4 digits only — full account and routing numbers are not stored)
• Transaction details (merchant names, amounts, dates, categories)
• Investment and loan account information

This data is collected through our third-party service provider, Plaid Inc. Plaid's privacy practices are governed by their own privacy policy at plaid.com/legal.

2.3 Information Collected Automatically

When you access the Service, we automatically collect certain information:

• Device Information: Device type, operating system, unique device identifiers, browser type and version
• Log Data: IP address, access times, pages viewed, referring URL, and actions taken on the Service
• Location Data: General location based on IP address (country/region level)
• Usage Data: Features used, clicks, time spent on pages, and interaction patterns

3. Cookies and Tracking Technologies

3.1 Types of Cookies We Use

We use the following types of cookies and similar technologies:

3.2 Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC, to help us understand how users interact with our Service. Google Analytics uses cookies to collect information such as:

• How often users visit the Service
• What pages they visit and how long they spend on each page
• What other sites they used prior to coming to our Service
• Demographic information (age, gender, interests) in aggregate form

Google's use of this data is governed by the Google Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

3.3 Google Search Console

We use Google Search Console to monitor and maintain our Service's presence in Google Search results. This service helps us understand how Google views our website and optimize our content. Google Search Console data is used solely for improving our Service and does not involve personal data collection beyond aggregate search performance metrics.

3.4 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically find these settings in the "Options" or "Preferences" menu of your browser. Please note that disabling essential cookies may prevent you from using certain features of the Service.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Improving the Service

• Create and manage your account
• Process transactions and send related information
• Provide customer support and respond to inquiries
• Aggregate and display your financial data
• Generate reports, budgets, and financial insights
• Improve and optimize the Service

4.2 Communications

• Send administrative messages (account verification, security alerts, updates)
• Send promotional communications (with your consent, which you can withdraw)
• Respond to your comments and questions

4.3 Security and Compliance

• Protect against fraudulent, unauthorized, or illegal activity
• Enforce our Terms of Service
• Comply with legal obligations

4.4 Analytics and Research

• Analyze usage patterns and trends
• Conduct research and development
• Create aggregate, anonymized data for statistical purposes

5. AI & Automated Processing

Traq uses AI services provided by Anthropic (Claude) to process financial data for the following purposes:

• Automatic transaction categorization
• Budget recommendations based on spending history
• Tax deduction identification and categorization
• Receipt image scanning and data extraction (OCR)
• Tax liability estimation
• Recurring subscription detection

When AI features are used, relevant transaction data is sent to Anthropic's API for processing. Anthropic does not retain your data beyond the immediate processing request.

You can opt out of AI-powered features by simply not using them — no AI processing occurs unless you actively invoke an AI-powered feature. You may also request human review of any AI-generated output by contacting us.

6. Data We Do NOT Store

To protect your privacy, the following sensitive information is never stored in our systems:

• Bank login credentials — handled entirely by Plaid; we never see or store your bank username or password
• Full account or routing numbers — only the mask (last 4 digits) is stored for display purposes
• Credit card numbers — handled entirely by Stripe; we only store the last 4 digits and card brand for reference

Plaid access tokens used to retrieve your financial data are encrypted at rest using pgcrypto and are never exposed in plaintext outside the database.

7. How We Share Your Information

We may share your information in the following circumstances:

7.1 Service Providers

We share information with third-party vendors who perform services on our behalf, including:

• Plaid Inc. — Bank account connections, transaction data, and account balances
• Stripe — Payment processing, subscription management, and invoice payments
• Anthropic — AI processing of financial data (transaction categorization, tax estimation, OCR)
• Resend — Email delivery (invoices, notifications, password resets)
• Supabase — Database hosting, authentication, and file storage
• Vercel — Application hosting
• Upstash — Rate limiting (Redis)
• Sentry — Error tracking and monitoring (anonymized)
• Google — Analytics and search optimization

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

7.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Subpoenas, court orders, or legal process
• Requests from government authorities
• Situations involving potential threats to physical safety
• Violations of our Terms of Service

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have.

7.4 With Your Consent

We may share your information for other purposes with your explicit consent.

7.5 What We Don't Do

We do not sell your personal information. We do not share your financial data with third parties for their marketing purposes.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict access controls and authentication requirements
• Monitoring: Continuous security monitoring and intrusion detection
• Auditing: Regular security audits and penetration testing
• Compliance: SOC 2 Type II compliance (in progress)

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Data Retention

We retain your information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations (e.g., tax and accounting requirements)
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes. Financial transaction data may be retained for up to 7 years for compliance purposes.

10. Your Rights and Choices

10.1 Access and Portability

You have the right to access your personal information and request a copy of your data in a portable format. You can export your data from your account settings or by contacting us.

10.2 Correction

You can update your account information at any time through your account settings. If you need help correcting other information, please contact us.

10.3 Deletion

You can request deletion of your account and personal data by contacting us at privacy@traq.fi. We will process your request within 30 days, subject to any legal retention requirements.

10.4 Marketing Opt-Out

You can opt out of marketing communications by clicking the "unsubscribe" link in any marketing email or by updating your preferences in your account settings.

10.5 Cookie Preferences

You can manage your cookie preferences through your browser settings or through our cookie consent banner.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

11.1 Legal Basis for Processing

We process your data based on:

• Contract: To provide the Service you requested
• Consent: For marketing communications and optional features
• Legitimate Interests: For security, fraud prevention, and service improvement
• Legal Obligation: To comply with applicable laws

11.2 Additional Rights

• Right to Restriction: Request restriction of processing in certain circumstances
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

11.3 International Transfers

Your information may be transferred to and processed in countries outside the EEA. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

11.4 Data Protection Authority

For users in Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

12. California Users (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights

To exercise these rights, contact us at privacy@traq.fi or call us at the number provided on our Contact page.

13. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@traq.fi, and we will delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will also send you an email notification.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after any changes constitutes your acceptance of the new Privacy Policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@traq.fi
• Website: traq.fi/contact
• Address: Traq, Helsinki, Finland

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@traq.fi.