1. Who are we?
Kwenta is a personal budgeting platform developed and operated by vivaden.be, with its registered office at Runcvoort 42, 2170 Merksem, Belgium. You can reach us at hallo@vivaden.be.
vivaden.be acts as the data controller within the meaning of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
2. What data do we collect?
2.1 Account data
- Email address (required to sign up)
- Name (optional, entered during onboarding)
- Language preference (for the app and the emails we send you)
- Hashed passwords (stored by Supabase Auth — we never see your password in readable form)
2.2 Financial data
- Net monthly income (per household member, optional)
- Household type and composition
- Budget categories and the budgets you set
- Manually entered transactions (amount, date, description, category)
- Savings goals and progress
- Scenario settings and planning data
The service has no access to your bank account. All financial data is entered manually by you alone.
2.3 Technical data
- IP address (processed by our hosting provider Vercel)
- Browser type and operating system (via server logs)
- Session cookies for authentication
- Feature usage (anonymised analytics data)
2.4 Payment data
Payments are processed by Stripe. vivaden.be does not store full payment card details. Stripe shares the subscription status, the subscription ID and billing dates with us for the purpose of access management. Stripe acts as an independent controller for payment transactions.
3. Why do we process your data?
| Purpose | Legal basis |
|---|
| Providing the service: showing your budget, goals and reports | Performance of a contract (art. 6.1.b GDPR) |
| Authenticating and securing your account | Performance of a contract (art. 6.1.b GDPR) |
| Subscription management and billing | Performance of a contract (art. 6.1.b GDPR) |
| Legal obligations (statutory bookkeeping retention) | Legal obligation (art. 6.1.c GDPR) |
| Improving the service through anonymised statistics | Legitimate interest (art. 6.1.f GDPR) |
| Emails about your account and subscription | Performance of a contract (art. 6.1.b GDPR) |
| Marketing newsletter (only with consent) | Consent (art. 6.1.a GDPR) |
4. How long do we keep your data?
- Account data: for as long as your account is active, plus at most 30 days after deletion.
- Financial data: for as long as your account is active. On deletion, all transactions, goals and budget data are permanently erased.
- Billing data: 7 years from the invoice date (statutory retention period in Belgium).
- Logs: at most 90 days.
5. Who do we share your data with?
We never sell your data. We share it only with:
- Supabase Inc. (database hosting and authentication) — data centre in the EU (Frankfurt). Supabase processes data as a processor on behalf of vivaden.be.
- Vercel Inc. (hosting of the web application) — Edge Network with a presence in the EU.
- Stripe Inc. (payment processing) — independent controller for payment data; Privacy Shield / SCCs apply.
All sub-processors are contractually required to protect your data in accordance with the GDPR. No data is transferred outside the EEA without appropriate safeguards.
6. Cookies and local storage
Through the Kwenta service, vivaden.be uses:
- Strictly necessary session cookies (authentication via Supabase) — required for the service to function, no consent needed.
- Preference cookies (demo mode, language choice) — session-bound, at most 24 hours; the language preference is kept for one year.
- Local storage (localStorage) for subscription preferences — this stays on your device and is not sent to our servers.
We use no advertising cookies and no third-party tracking cookies. See our cookie policy for the full breakdown.
7. Your rights
Under the GDPR you have the following rights:
- Right of access — you can ask what data we hold about you.
- Right to rectification — you can have inaccurate data corrected.
- Right to erasure (“right to be forgotten”) — you can have your account and all associated data permanently deleted.
- Right to restriction of processing — in certain cases you can have processing restricted.
- Right to data portability — you can download your financial data as a CSV file from the app.
- Right to object — you can object to processing based on legitimate interest.
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.
To exercise your rights, send an email to hallo@vivaden.be. We respond within 30 days.
You have the right to lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels.
8. Security
vivaden.be takes appropriate technical and organisational measures:
- Encrypted connections (HTTPS/TLS for all communication)
- Hashed passwords (bcrypt via Supabase Auth)
- Row Level Security (RLS) in the database: every user can reach only their own data
- Strict separation of service-role keys (used server-side only)
- Regular backups via Supabase
9. Changes
vivaden.be may amend this privacy policy. In the event of material changes we will inform you by email or through a notice in the app, at least 30 days before the change takes effect. The “last updated” date at the top shows when the policy was last changed.