Privacy at Equilibra

1. Controller and contact

The controller for processing by Equilibra is Cybran Technologie Corporation, Harpstedter Straße 24, 27211 Bassum, Deutschland. For questions about your data or to exercise your rights, contact us at cihtog@hotmail.de.

2. Account, operation and security

We process your account and access information, including your name, email address, hashed password, language, account status, approvals and, where applicable, two-factor authentication data. This supports registration, sign-in, account access and account-related communication. The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the agreed service.

To protect the service, we process technical connection, session and security information, such as IP addresses, browser information, login events and administrative changes. Our legitimate interests under Article 6(1)(f) GDPR are to prevent unauthorised access, resolve errors and keep changes traceable. The portal privacy notice provides additional information about general website use and the services used there.

Information required for sign-in must be provided so that we can offer your account. You choose what additional content to enter. Security and account notices are separate from optional notifications, which you can manage in the available settings.

3. Financial data, imports and sharing

Equilibra processes financial data that you enter or import: ledgers, accounts and balances, transactions, amounts, currencies, dates, recurring transactions, budgets, loans, categories, tags, notes, import files and their rows. Depending on the contents, this may include IBANs, payment counterparties’ names and payment references.

We use this information for your financial overview, matching imports against transactions, calculations, analyses and forecasts. The legal basis for providing these agreed features is Article 6(1)(b) GDPR. Manually uploaded bank files do not give Equilibra access to your online banking, and Equilibra does not initiate bank payments through those files.

When you share content with other users, authorised members or recipients can access it within the scope of the feature. This includes shared ledgers, contacts, financial requests, chat messages and attachments. We process memberships, permissions, communications and processing status for these features. Choose permissions carefully and share only necessary information.

Payment counterparty information may come from your entries or bank imports, even if those people do not use Equilibra. It is processed to identify, reconcile and keep your financial activities traceable. The legal basis is Article 6(1)(f) GDPR where the necessary processing is justified by our interest in providing these features and your interest in accurate financial management, and the affected people’s rights do not override those interests. Limit this information to what is necessary for these purposes. Affected payment counterparties can also contact our privacy contact and exercise their rights.

4. Particularly personal information

Financial data does not automatically fall within the special categories of personal data in Article 9 GDPR. However, individual transactions, recipients or notes may reveal information about health, religion, political beliefs or trade union membership. Please avoid including such information when it is unnecessary for your financial management.

Your own consent does not authorise you to consent on behalf of other people to processing of their data. It is also not a blanket permission to process special categories of data. Such processing additionally requires an applicable exception under Article 9(2) GDPR. Do not enter this content in Mia; blocking external AI does not change the sensitivity of information already stored.

5. Mia: external AI currently blocked

Mia’s external AI feature is currently blocked for all accounts, including administrators. Equilibra sends no new requests to external AI services. Earlier consent does not override this block. You can continue using financial management and features that do not use an external AI service.

The block does not delete Mia conversations, messages or related technical execution data already stored in Equilibra. The deletion criteria below apply to this content. You can withdraw earlier consent with effect for the future in Mia settings or through our privacy contact; this does not affect the lawfulness of earlier processing. Requests already transmitted cannot be recalled.

Where a consent record exists, we store its granting and withdrawal with the time, version and provider, linked to your account and without prompt content. This consent record is retained until your account is permanently deleted; the shorter retention period for Mia conversations does not apply to it.

Optional external AI assistance for questions about the application and analyses of the active personal ledger is planned for a later release. Shared ledgers and shared accounts are also excluded from this later external AI feature. Before use, we will inform you again about the specific content transmitted, provider, retention periods and any transfers to third countries. Activation will only be considered after that information and your renewed, separate consent under Article 6(1)(a) GDPR. Using Equilibra and any earlier consent do not replace this new decision.

Existing AI replies can be incorrect or incomplete. A proposed change to your transactions requires your explicit confirmation; check amounts, accounts and consequences before applying a suggestion. Equilibra does not use Mia to make solely automated decisions about you that have legal or similarly significant effects, including creditworthiness or lending decisions.

6. Hosting, recipients and earlier AI processing

Equilibra is hosted by Hetzner on servers in Germany. The hosting provider supplies the infrastructure for the application and its stored data. The German hosting location does not mean that every connected service processes data exclusively in Germany or the European Economic Area.

Email and technical service providers used to operate the service may have access to data where necessary for their tasks. Authorised administrative access serves operation, security and handling your support request. The portal privacy notice explains, in particular, email delivery and security checks during sign-in.

The technically connected OpenAI API is blocked for new Mia requests. Where content was already transmitted during earlier use, the block does not remove it from the provider. Content and metadata may remain there for abuse monitoring or in technical caches. OpenAI describes a standard abuse-monitoring retention period of up to 30 days; legal or security-related exceptions may require longer retention. You can contact our privacy contact to clarify which data was involved in an earlier request.

Before any later external AI feature is activated, its provider, processing locations, retention periods and, where applicable, the basis for transfers outside the European Economic Area will be described specifically. This notice does not promise a particular third-country transfer mechanism or exclusively EU processing for such a future feature.

7. Retention and deletion

Account content and financial data are generally retained for the duration of your use and the relevant feature. Scheduled account deletion includes a 30-day recovery period. Final deletion is processed afterwards. Links to shared ledgers, loans or other users may require separate review to protect their data and rights. We can explain any continued retention required in your particular case on request.

Import files and imported rows are stored for processing, reconciliation and traceability of the import. They do not automatically disappear when reconciliation is complete. You can request their deletion through our privacy contact. Transactions already created from an import are independent ledger data; their treatment is considered separately when data is deleted.

Previously stored Mia conversations, messages and related technical execution data provide conversation history and traceability of requested actions. The deletion criterion for a conversation is inactivity of 30 days since its last message, or since creation for empty conversations. Confirmed transactions remain as independent ledger data. You can also request deletion of stored Mia content through our privacy contact. Deletion in Equilibra does not remove data still being processed by the external provider within its retention periods.

The regular deletion criterion for login and administrative security events is an age of 180 days. Where legal obligations or the resolution of specific claims require further retention, it is limited to the relevant reason and purpose.

Backup copies may contain data already deleted from the live system. When handling a deletion, we also consider backup copies and whether further retention is necessary for recovery after data loss or for a specific legal obligation. No fixed automatic overwrite period or immediate removal from every backup is promised.

8. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where we process data based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent at any time with effect for the future.

Contact cihtog@hotmail.de and describe the affected data or feature as specifically as possible. Do not send complete bank statements or login credentials. Where necessary, we verify your identity before disclosing or changing personal data.

You may complain to a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement. For the stated location in Lower Saxony, the State Commissioner for Data Protection of Lower Saxony is one possible point of contact.

9. Changes to this notice

We update this notice when features or data processing change materially. Any required new consent for additional AI processing will be requested before that processing starts. Changing this notice alone does not activate additional data transfers.