Privacy Policy

2. Scope of this policy and source of the data

This policy covers the website, the JuSplit application and, once published, the related mobile apps. Data may be provided directly by the data subject, generated while using the service, obtained from Google or Apple when the user chooses to sign in with the respective account, or entered by the other parent, for example in the case of an invitation, a child's name, or a shared entry.

A user who provides data referring to other people must be entitled to do so, limit it to what is necessary and, where appropriate, inform them about the use of JuSplit and this policy.

3. Data processed

• Account data: name, email, password stored as a hash, any Google or Apple identifier, role, account status, creation and update dates.
• Access and preferences: date and time of last login, IP address, country derived from the IP address, registration source (website or iOS/Android app), theme preference and personal settings.
• Children's data: the name, initial or nickname chosen by the parents to link an expense to a child. JuSplit does not ask for date of birth or photographs of the child.
• Shared relationship data: identity of the two connected accounts, primary/secondary role, connection status, how often settlements occur and their reference date, categories and change requests.
• Expenses: description, date, amount, child, category, location, notes, author, and statuses with dates and authors of approval and confirmation.
• Expense attachments (JuSplit Plus): photos or PDFs of receipts and invoices optionally uploaded by the user. The file is visible to both connected parents, like the expense it relates to, and must not contain photographs of people or health, judicial or identity documents.
• Subscription and payments (JuSplit Plus): customer and subscription identifiers assigned by Stripe, chosen plan, status, renewal date and the user who subscribed; name and email are shared with Stripe to create the customer. JuSplit does not receive or store card numbers or complete payment data, which the user enters directly on Stripe's page.
• Settlements: period, amounts, who declares owing or receiving a sum, the declared method (cash, bank transfer, cheque or other), approvals, disputes, cancellations and confirmations. JuSplit does not process card numbers, IBANs or bank transactions.
• Invitations and communications: invitee's email, channel, token and invitation status; in-app notifications, email delivery outcome and copies of transactional messages needed for the service.
• Technical data and activity log: action, author, timestamp, IP address, user agent, the entity involved and operation metadata; failed login attempts and administrative operations; on the mobile app, the device token needed to send push notifications.
• Website visit statistics: cookie-free and aggregated: page visited, date and time, referring site, device type, language, country derived from the IP address, and a random non-reversible identifier (computed from IP and browser, which changes every day and does not allow a person to be recognised from one day to the next). The IP address is not stored in these statistics and the country is derived locally, without sending the IP to external services. Visitors who enable «Do Not Track» or Global Privacy Control, and administrators, are not recorded.
• Feedback: messages sent through the Feedback page (type, optional rating, text and, if provided, name and email, language and country); if sent from an account, the link to that account. The IP address is not stored with the message.
• Support and exercise of rights: content of requests, correspondence, identity checks and outcome of the handling.

4. Purposes and legal bases

JuSplit does not use data for behavioural advertising, does not sell personal data, does not carry out profiling, and does not make decisions based solely on automated processing that produce legal or similarly significant effects. If optional, consent-based purposes are introduced in the future, they will be presented with a separate, revocable choice, without conflating them with acceptance of the Terms or acknowledgement of this policy.

5. Provision of data

Name, email, login credential and data needed for the requested features are required to create and use the account. Failure to provide them prevents the related feature from being delivered. Location, notes, child, category and settlement method are optional unless the interface indicates them as required for a specific flow. Signing in with Google or Apple is optional: email and password can be used when that option is available. The JuSplit Plus subscription is optional and requires the data needed for payment, entered on Stripe's page.

6. Children's data and particularly sensitive information

The service is aimed at adults and is not offered directly to minors; therefore, the digital consent of a minor under Art. 8 GDPR is not the basis used to provide JuSplit. A child's name is entered by an adult to organise shared expenses. It is recommended to use an initial or a nickname and not to enter further identifying elements.

Free-text fields are not meant to collect health, judicial, biometric data, political opinions, religious beliefs, sexual orientation, or other special category data. Users must avoid diagnoses, documents and sensitive details, using generic descriptions such as “medical expense” instead. Optional attachments (JuSplit Plus) must be limited to receipts or invoices, without photographs of people or health, judicial or identity documents. If such data is entered despite these instructions, the Controller may restrict or remove it and processes it only to the extent necessary to provide and protect the service, or to establish, exercise or defend a legal claim. The user entering it must be entitled to do so.

7. Who the data is shared with

Data may be accessible, within the limits of their respective functions, to:

• the connected other parent: receives the shared data needed for expenses, settlements and communications to work;
• authorised staff and collaborators: access only when necessary for administration, support, security and compliance, under confidentiality obligations;
• Hetzner: hosting and database provider on servers in Germany, appointed as data processor where applicable;
• Amazon Web Services / Amazon SES: provider of transactional email delivery, which may receive the recipient address, name, subject and content of the message; the operating region must be verified and documented before launch;
• Google: when the user chooses Google OAuth, Google authenticates the user and shares an identifier, name and authorised email with JuSplit; the website also uses Google Fonts, which involves a technical connection to Google's servers and the transmission of data such as IP address and user agent;
• Apple: when the user chooses “Sign in with Apple”, Apple authenticates the user and shares an identifier, the name (if shared) and an email address, possibly anonymised by Apple, with JuSplit;
• Google Firebase Cloud Messaging: on the mobile app, to deliver push notifications, receives the device token and the notification text;
• Stripe (Stripe Payments Europe Ltd, Ireland, and group companies): handles payments and JuSplit Plus subscriptions. It receives the user's name and email and collects payment and billing data directly on its own page. For certain purposes, such as fraud prevention and regulatory obligations, Stripe acts as an independent controller under its own policy (stripe.com/en-it/privacy);
• advisors and authorities: professionals bound by confidentiality, judicial or administrative authorities, and other recipients when necessary by law or to protect legal rights.

The up-to-date list of data processors can be requested at the privacy contact. Google processes data related to its own services also according to its own terms and policies.

8. International transfers

The main infrastructure is located in the European Union. Some international providers, in particular Google, Apple, Stripe and AWS or their sub-processors, may process data also outside the European Economic Area. In such cases the Controller relies, as applicable, on adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses approved by the European Commission, and supplementary measures. Information about the safeguards applied is available on request at the privacy contact.

9. Retention periods

Data is not kept indefinitely. The retention criteria are:

• account and preferences: for the lifetime of the account; after a valid request for closure, deletion or anonymisation, data no longer needed is normally removed within 30 days;
• invitations: the link normally expires after 7 days; email, status and invitation metadata are kept for up to 12 months from the response or expiry, for security and abuse prevention;
• password reset: the link expires after one hour; technical records are deleted within 30 days of use or expiry, unless security needs require otherwise;
• notifications: up to 24 months, unless they are part of a dispute or still needed for the account;
• unconfirmed expenses and operational data: for the duration of the connection and up to 24 months after it ends, unless deleted earlier or a further need arises;
• confirmed expenses, settlements and shared adjustments: for as long as at least one of the two users needs them in their history and, as a rule, not beyond 10 years from the closure of the period or connection, unless disputes or obligations require longer retention;
• website visit statistics: up to 13 months, then automatically deleted;
• feedback: up to 24 months from submission; feedback sent from an account is deleted together with the account;
• security and activity logs: 24 months; only evidence strictly linked to confirmed operations, administrative access, incidents or disputes may be kept together with the related report for up to 10 years or until the dispute is settled;
• subscription and payment data (JuSplit Plus): up to 10 years from payment, for accounting and tax obligations;
• expense attachments: together with the expense they are linked to, following the periods indicated for expenses; they can be removed earlier by the user who entered the expense and are deleted when an unconfirmed expense is deleted;
• proof of acceptance of the Terms and acknowledgement of this policy: up to 10 years from account closure, to demonstrate the relationship and compliance;
• support and privacy requests: 24 months from closure, or longer if necessary for legal obligations or defence of rights;
• backups: ordinary maximum cycle of 90 days; they are isolated and used only for restoration, unless incidents or specific obligations require otherwise.

Once the period expires, data is deleted or anonymised. If a dispute arises, retention may be suspended, limited to the data necessary, until the dispute is resolved and the related protection periods expire.

10. Account deletion and shared history

The account can be deleted self-service from Settings → Delete account, on the website and in the app, or on request to the privacy contact (in which case JuSplit verifies the requester's identity and normally responds within one month). Deletion removes name, email, password and login connections, expenses not yet confirmed together with their attachments, notifications, feedback sent from the account, and access and notification tokens; if the parent who subscribed to JuSplit Plus deletes their account, the subscription is cancelled. However, closing the account and deleting data are not always the same operation: part of the history also concerns the other parent, and deleting it entirely could harm their rights or prevent the handling of disputes.

In these cases JuSplit deletes exclusively personal data no longer needed, stops ordinary use of the account and, where technically possible, replaces name and email with a neutral reference. Shared entries and the evidence needed are limited to mere retention and remain available to the other parent for the applicable period. Each request is assessed on its merits, and any refusal, limitation or deferral is explained.

11. How data is processed, and security

Processing takes place mainly through electronic means. JuSplit applies proportionate technical and organisational measures, including hashed passwords, encrypted connections where available, HttpOnly and SameSite session cookies, CSRF protection, access controls, operation logging, and keeping infrastructure credentials separate from the document root.

Administrators can access data only for authorised tasks. The “sign in as” function allows reproducing the user's view for support purposes; the start and end of such impersonation are logged with the administrator, date and time. No system is risk-free: any breaches are handled according to the obligations set out in Articles 33 and 34 GDPR.

12. Rights of data subjects

Where provided by the GDPR, the data subject may request:

• access to their data and to information about the processing;
• rectification or completion of inaccurate data;
• erasure of data;
• restriction of processing;
• portability of data provided, when processing is automated and based on a contract or consent (the expense history can be downloaded as a CSV from Settings on the website);
• objection to processing based on legitimate interest, for reasons connected with their particular situation;
• withdrawal of any consent given, without affecting processing carried out before the withdrawal;
• information on the safeguards used for international transfers.

Requests should be sent to privacy@jusplit.com. JuSplit may ask for information necessary to verify identity and responds within the legal deadlines. These rights are not absolute: any limitations will be explained, particularly when shared data, third-party rights, legal obligations or the need to defend a claim are involved.

The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante) or the competent supervisory authority in their own Member State, and may bring the matter before a court.

13. Cookies and external services

The website uses a strictly necessary session cookie and, at present, does not use advertising or profiling cookies. Details on duration, providers and the choices available are in the Cookie Policy. Links to external services and any Google or Apple authentication are also subject to the respective providers' own policies. Payment for JuSplit Plus takes place on a Stripe page, which may set its own cookies.

14. Changes to this policy

This policy may be updated for regulatory, organisational or technical changes. The version and effective date are shown at the top of this page. Significant changes will be communicated through appropriate means, for example a notice within the service or by email. Previous versions and the record of changes are kept by the Controller for accountability purposes.