Isenly Privacy Policy
Last updated: 18 October 2026This policy explains what personal data we process when you use Isenly, for what purpose, on what legal basis, and what rights you have over it. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
It applies to the Isenly app, for your personal and shared finances, and to this website.
1.Data controller
| Controller | Sheila Chairi |
|---|---|
| Contact email | js.tl.2803@proton.me |
2.What data we process
2.1 Account data
- Email address.
- Display name or alias and, if you upload one, a profile picture.
- A system-generated user identifier.
- If you sign in with Google or Apple: the identifier that provider gives us and your email address. If you use Sign in with Apple with the hide-my-email option, we only receive Apple’s anonymous relay address.
2.2 Financial data you enter
- Transactions: amount, currency, date, description, category and notes.
- Accounts, budgets, limits, savings goals and recurring expenses.
- Shared spaces (workspaces), members, invitations and shared-expense settlements.
- Attachments you link to a transaction (images, PDFs or other documents).
Isenly does not connect to your bank and has no access to your bank accounts, cards or statements. All financial information is what you enter manually or capture by scanning a receipt.
2.3 Receipt images
When you use the scanning feature, the photo of the receipt is sent to our server and to an artificial intelligence provider in order to extract the line items and amounts. This is detailed in section 4.
2.4 Technical data
- Device identifier and push notification token.
- Language, time zone and app version.
- Technical logs of errors and API access, including IP address.
2.5 Isenly Pro subscription
If you subscribe to Isenly Pro in the Isenly app, you buy it with your App Store or Google Play account, and the store charges you: we never receive your card or payment details. To know whether you have the subscription we use RevenueCat, which checks it with the store. From that purchase we process:
- The store, the plan, the purchase, renewal and expiry dates, whether it is active or awaiting payment, and whether it is a real or a test purchase.
- The transaction identifiers provided by the store.
We identify you to RevenueCat only by your Isenly account identifier: we do not send it your name or your email address. RevenueCat also receives the purchase data above and your device’s language and currency, which it needs to check it.
2.6 Data we do NOT process
- We do not collect biometric data. If you enable Face ID, Touch ID or fingerprint unlock, the verification happens on your device and we only receive a success or failure result.
- We do not use your information for advertising and we do not sell it to third parties.
- We do not use advertising trackers or advertising identifiers.
3.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account, and providing the service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Syncing your data across devices | Performance of a contract (Art. 6(1)(b)) |
| Knowing whether you have Isenly Pro and giving you access to its features | Performance of a contract (Art. 6(1)(b)) |
| Sharing expenses with the members of a shared space | Performance of a contract (Art. 6(1)(b)) |
| Extracting data from a receipt using AI | Consent (Art. 6(1)(a)), given when you deliberately start a scan |
| Sending you push notifications about your activity | Consent (Art. 6(1)(a)), revocable in settings |
| Security, abuse prevention and error diagnosis | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
4.Receipt scanning with artificial intelligence
This matters. Please read it before scanning a receipt.
When you use scanning, the image you capture is transmitted to our servers and from there to Google AI Studio (Google Ireland Limited / Google LLC) for automated analysis. The model returns the detected line items and amounts in structured form; you review and confirm the result before anything is saved.
This feature is optional. If you do not use it, no image is sent to any AI provider. You can keep recording transactions manually with the app’s full functionality.
Bear in mind that a receipt may contain information you would not expect (merchant name, location, medication, partially visible card details). We recommend not scanning receipts containing data you would rather not have processed.
No automated decisions with legal effects are made about you: the AI only proposes data that you confirm or correct.
4.1 What exactly is sent
- The receipt image, compressed before sending.
- The list of your workspace category names, so the model can suggest an existing category.
We do not send your email address, your name, your user identifier or any data about your accounts, balances or previous transactions. The request to the AI provider does not allow you to be identified.
4.2 How Google uses the images
Read this before scanning a receipt.
The analysis is currently performed using the free tier of Google AI Studio. Under Google’s published terms for that tier, Google may use the content submitted — the receipt image and the analysis result — to develop and improve its products and its artificial intelligence models. Google also states that human reviewers may read, annotate and process that content.
This means the image you choose to scan becomes subject to Google’s terms and is no longer under our exclusive control. For that reason:
- Scanning is entirely optional. If you do not use it, no image is sent to any AI provider.
- We recommend that you do not scan receipts containing information you consider sensitive, such as medical or pharmacy invoices or any document with visible health or identity data.
- You can keep recording all your transactions manually, with no loss of functionality.
We are working to migrate this feature to a paid Google plan under which submitted data is not used to train models. We will update this policy and notify you when that happens.
4.3 How long Isenly keeps the image
If, after reviewing the result, you attach the image to the transaction, it is stored encrypted in our storage service and remains accessible only to you and to the members of the relevant shared space until you delete it.
If you do not attach it, or you discard the scan result, the image is removed from our servers and no copy is kept.
You can delete an individual attachment at any time from the transaction detail view, without deleting the transaction or your account.
6.Recipients and processors
We do not sell or transfer your data. We rely on the following providers, acting as processors under contract:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database and file storage | EU / USA |
| PowerSync | Cross-device synchronisation engine | EU / USA |
| Google (AI Studio, free tier) | Receipt image analysis. Google also processes the data for its own model-improvement purposes (see section 4.2). | EU / USA |
| Firebase Cloud Messaging (Google) | Push notification delivery | EU / USA |
| Vercel | Hosting of the API and the Isenly website | EU / USA |
| Resend | Delivery of the service’s emails (for example, account verification, invitations and notices) | EU (sent from Ireland) / USA |
| RevenueCat | Checking Isenly Pro purchases and renewals with the App Store and Google Play. It receives your account identifier, the purchase data provided by the store and your device’s language and currency; never your name or email address. | USA |
| Apple / Google | Federated sign-in and app distribution | EU / USA |
When you buy Isenly Pro, Apple or Google charge you as independent controllers, under their own terms and their own privacy policy. When you delete your account, we also delete your customer record at RevenueCat. Deleting your account does not cancel the subscription in the store: only you can do that, from your App Store or Google Play account settings.
We may also disclose data to public authorities where we are under a legal obligation to do so.
7.International transfers
Some of these providers process data outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision, including the EU–US Data Privacy Framework where applicable.
8.Retention periods
- Account and financial data: for as long as your account is active.
- After account deletion: erased within a maximum of 30 days, except backups, which are overwritten within a maximum of 90 days.
- Receipt images: until you delete the attachment or your account.
- Isenly Pro subscription data: while your account is active. When you delete it, we also delete it at RevenueCat.
- Technical logs: a maximum of 90 days.
- Data subject to a legal retention obligation: for the period required by applicable law.
If you delete your account but belong to a shared space, transactions affecting other members’ balances may be retained in anonymised form so as not to break the group’s accounting.
9.Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure: delete your data and your account.
- Restriction of and objection to processing.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent at any time, without retroactive effect.
Write to us at js.tl.2803@proton.me. We will respond within one month at the latest. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency or with your local supervisory authority.
10.Deleting your account
You can delete your account and all its data from within the app, under Profile → Settings → Delete account. You do not need to contact us or go through any external process.
You may also request it by writing to js.tl.2803@proton.me.
11.Minimum age and family use
To create your own account in Isenly you must be 16 or older. This is the age set by Article 8 GDPR as the general threshold in the European Union for a person to consent on their own behalf to the processing of their data by an information society service.
11.1 Use by children under 16
Isenly is also designed as a tool for financial education within a family, and a child under 16 may use the app: as a member of a shared space created and administered by an adult, or on that adult’s device.
In that case the account holder is always the adult, who accepts the Terms of Use and decides what information is recorded in the shared space. We do not create separate accounts for children under 16 and we do not process their data separately.
If we detect an account created by a person under 16, we will delete it together with its data. If you are a parent or guardian and believe a child in your care has created an account or provided us with data, write to js.tl.2803@proton.me and we will act immediately.
Isenly is not directed to children under 13 and we do not knowingly collect their personal data, in accordance with applicable online child protection legislation.
The age rating shown on the App Store refers to the suitability of the app’s content and is independent of this account creation requirement.
12.Security
- All communications are encrypted using TLS.
- Data is encrypted at rest by our providers.
- Credentials and session tokens are stored in the operating system’s secure store (Keychain on iOS and macOS, Keystore on Android).
- Data access is controlled at row level, so each user can only read their own data and that of the shared spaces they belong to.
- You can enable biometric app lock in settings.
13.Changes to this policy
If we make a substantial change to this policy, we will notify you within the app or by email before the changes take effect. The date of the last update always appears at the top of this document.
14.Contact
For any question about this policy or about how we process your data: js.tl.2803@proton.me.
© 2026 Isenly. All rights reserved.