Privacy Policy

1. Data Controller

The controller of the processing described in this policy is [LEGAL ENTITY NAME], with registered office at [REGISTERED ADDRESS], VAT number [VAT NUMBER].

Privacy contact: info@richy-rich.com. Data Protection Officer: info@richy-rich.com.

2. Data We Collect

We process the data you provide when creating an account and using the platform, the data you choose to import or connect, and technical data generated by your use of the service.

The categories actually processed depend on the features you use: Richy does not require you to connect accounts or upload documents in order to have an account.

3. Financial Data

When you provide them manually, import them or connect them, Richy may process:

• ·bank accounts
• ·account balances
• ·transactions
• ·income
• ·expenses
• ·budgets
• ·investments
• ·liabilities
• ·assets (including real estate, vehicles, valuables)
• ·insurance information
• ·tax-related information
• ·uploaded financial documents
• ·wealth indicators generated from these data

4. Banking Data

If you link an account through a connected financial account provider, Richy receives account information such as account identifiers, masked account numbers, institution name, balances and transaction records.

Richy does not ask for, receive or store your online banking credentials: authentication happens with your bank or with the authorised provider that operates the connection.

5. Investment & Asset Data

Holdings, quantities, prices, currencies and the assets you register are processed to calculate portfolio value, allocation, concentration and estimated performance. Market prices and reference valuations may be obtained from external market data sources.

6. Tax and Document Data

Documents you upload (for example payslips, tax documents, statements, contracts, policies) are stored in private storage accessible only to your account and may be analysed to extract structured information that populates the platform.

7. Authentication & Account Data

To create and secure your account we process your email address, authentication data, and — if you sign in with a third-party identity provider — the basic profile information that provider returns. We also store profile preferences such as name, language, display currency and, optionally, an avatar image.

8. Technical Data

Technical data such as IP address, device and browser information, timestamps, and error or diagnostic logs are processed to operate the service, keep it secure and troubleshoot failures.

9. Purpose of Processing

• ·providing the platform and its features
• ·aggregating and displaying your financial picture
• ·categorising transactions and generating budgets, indicators and insights
• ·analysing documents you upload
• ·sending service notifications and reminders you have enabled
• ·managing subscriptions and payments
• ·security, abuse prevention and troubleshooting
• ·complying with legal obligations
• ·sending marketing communications, only where you have given separate consent

10. Legal Basis

Depending on the processing, the legal basis is: performance of the contract (providing the service you requested); your explicit consent (in particular for the processing of financial data, for connecting accounts, for AI memory features and for marketing); our legitimate interest (security, prevention of abuse, service improvement); and compliance with legal obligations.

Where processing is based on consent, you can withdraw it at any time without affecting processing already carried out.

11. Connected Financial Accounts (Open Banking)

Richy can let you link your own accounts using third-party providers that are authorised or enabled to operate account information services. Richy is not itself an account information service provider and does not hold a payment services authorisation.

In the current configuration, the connection layer is prepared for Salt Edge; the provider actually used in production is documented here once activated: Enable Banking Oy (PSD2-licensed Open Banking provider).

Data received: account identifiers and metadata, masked account numbers, institution names, balances and transaction records for the accounts you select.

Why: to show your balances, transactions, cash flow and wealth aggregates without manual entry.

Consent: the connection is created only after you grant consent within the provider's flow. Consents have a limited duration and may need to be renewed; Richy shows the consent status and, where applicable, the renewal requirement.

You can disconnect a linked account at any time from the Cash & Banking area. After disconnection, no new data is received; data already imported remains in your account until you delete it or delete your account.

12. AI-powered features

Some features use AI systems to interpret financial data, generate insights, categorise information, analyse documents and answer your questions.

To do so, the relevant portion of your data may be sent to the AI infrastructure used by the platform for the sole purpose of producing the response or the analysis you requested. The AI provider actually used in production is documented here once configured and verified: Google (Gemini models) via the Lovable AI gateway.

AI-generated information may contain errors and should not be considered professional financial, investment, tax or legal advice.

Rick's persistent memory is optional: it is active only if you enable it and can be revoked, which stops further memory storage and lets you delete stored memories.

13. Service Providers / Data Processors

We use external providers that process data on our behalf, in the following categories, limited to those actually used by the platform:

• ·Database, authentication, storage and hosting infrastructure
• ·Application hosting and delivery
• ·Open banking connectivity (see the Connected Financial Accounts section)
• ·AI processing
• ·Market data and reference valuations
• ·Payments and subscription management

14. International Data Transfers

Some providers may process data outside the European Economic Area. Where this happens, transfers are carried out on the basis of an adequacy decision or of appropriate safeguards such as the European Commission's Standard Contractual Clauses. The processing locations actually used are: [SERVER / PROCESSING LOCATIONS].

15. Data Retention

Your data is retained for as long as your account is active. After account deletion, data is deleted or anonymised within [RETENTION PERIOD], except where longer retention is required to comply with legal, accounting or tax obligations, or to defend a legal claim.

16. Security

Data is isolated per user at database level through row-level access rules; uploaded documents are kept in private storage reachable only by the owning account; transport is encrypted. Access to production systems is restricted.

No system can be guaranteed to be completely secure: please use a strong, unique password and keep your credentials confidential.

17. Automated Processing

Richy performs automated calculations and classifications (for example transaction categorisation, wealth indicators, spending capacity estimates and AI-generated insights). These outputs are informational and do not produce legal effects, and are not used to take decisions about you with legal or similarly significant effects.

On the free plan your financial data may be used in aggregate/statistical form to improve the product; the Premium plan removes this statistical profiling.

18. User Rights

Under the GDPR you have the right to:

• ·access your personal data
• ·obtain rectification of inaccurate data
• ·obtain erasure of your data
• ·obtain restriction of processing
• ·receive your data in a portable format
• ·object to processing based on legitimate interest
• ·withdraw consent where processing is based on consent
• ·rights relating to automated decision-making and profiling, where applicable
• ·lodge a complaint with the competent supervisory authority

To exercise these rights, write to info@richy-rich.com.

19. Delete your account and data

You can request deletion of your account and of the associated data from your account settings, or by writing to info@richy-rich.com.

Deletion removes your profile and the financial data linked to it. Some data may need to be retained for a limited period where required by legal, accounting or tax obligations, or to defend a legal claim: in that case it is kept only for as long as necessary and is not used for other purposes.

20. Complaints

If you believe the processing of your data infringes data protection law, you may lodge a complaint with the competent supervisory authority in your country of residence, work or of the alleged infringement.

21. Changes to this Privacy Policy

This policy may be updated. Each version carries a version number and a last-updated date. In case of material changes we will inform you through the service before the change takes effect, where required.

22. Contact

[LEGAL ENTITY NAME] — [REGISTERED ADDRESS] — info@richy-rich.com — DPO: info@richy-rich.com.