Privacy Policy
Last updated: 1 June 2026
On this page
Lekkafy ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at lekkafy.com and our mobile applications. It also covers our obligations and your rights under the UK GDPR and EU GDPR.
This policy describes the processing we carry out and the lawful basis for each activity — see "Lawful Basis for Processing" below. Where we rely on your consent for a specific purpose (such as optional marketing communications), we will ask for it separately and you may withdraw it at any time; this policy alone is not a substitute for that consent.
1. Who We Are
Lekkafy Ltd is a family budgeting application and acts as the Data Controller for personal data you provide when using our service. We determine the purposes and means of processing your personal data. We are registered in England and Wales (Company No. 17378238) and with the Information Commissioner's Office (ICO Registration No. C1997472).
For data protection enquiries, contact us at support@lekkafy.com.
2. Information We Collect
2.1 Information you provide directly
- Account information: Your email address (used for passwordless sign-in via magic link).
- Display name: A name or alias of your choice — this does not need to be your real name. We do not ask for or verify your legal identity.
- Financial data: Expense records, budget limits, income entries, loan records, and category labels that you manually enter or import.
- Family data: A family name and display names for members you choose to add. These are aliases and do not need to reflect real names.
- Receipts and statements: Images or PDFs you upload for AI-assisted parsing. These are processed and discarded; we do not store raw documents beyond the session.
2.2 Information collected automatically
- Authentication logs: Our authentication infrastructure automatically logs sign-in event timestamps and IP addresses for security purposes. We do not read or process these logs directly; they are retained by our infrastructure provider as a data processor under our agreement with them.
2.3 What we never ask for
- We never connect to your bank account.
- We never ask you for bank credentials or passwords, and do not have a form field or feature that requests them.
- We never use open banking or third-party financial data aggregators.
- We do not use analytics or tracking tools. No feature-usage metrics, session recordings, or behavioural tracking of any kind.
- We do not collect device information, crash reports, or operating system data.
- We do not sell your data to advertisers or third parties.
Note: bank statements or receipts you choose to upload may incidentally contain details such as a sort code, account number, or masked card number printed on the document. We don't ask for or require this information. Our AI extraction is constrained to return only transaction data (date, merchant, amount, category) — it has no field to output account numbers or similar identifiers, so they are not saved even if present in the source document. The uploaded image or file itself is sent for processing and is not stored on our servers; see 2.1 above.
3. How We Use Your Information
- To provide, operate, and maintain the Lekkafy service.
- To authenticate your identity via magic-link email.
- To process AI-assisted features such as receipt scanning, statement parsing, and budget suggestions.
- Ask Lekka: when you ask Lekka a question, it can query your recorded financial data — spending, budgets, transactions, commitments, savings, and your safety-net/runway figures — to compute an answer. Your question and the relevant data needed to answer it are sent to our AI provider to generate a response. We do not save a transcript of your conversations with Lekka on our servers.
- To send transactional emails (magic links, family invitations, budget alerts). We never send unsolicited marketing without your consent.
- To detect, investigate, and prevent fraudulent or unauthorised activity.
- To comply with legal obligations.
4. Lawful Basis for Processing (UK GDPR / EU GDPR)
We process your data under the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b)) |
| Storing financial records you enter | Contract (Art. 6(1)(b)) |
| Sending magic links and invitations | Contract (Art. 6(1)(b)) |
| Security monitoring and fraud prevention | Legitimate Interests (Art. 6(1)(f)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
| Legal holds or regulatory requests | Legal Obligation (Art. 6(1)(c)) |
5. Data Storage and Security
Your data is stored on infrastructure hosted in the EU (Ireland) region. We implement the following safeguards:
- All data is encrypted in transit and at rest using industry-standard protocols.
- Database-level security policies enforce access according to your user and household permissions: your own entries are visible only to you and, where you use Family mode or belong to a household, to that household's members. Individual mode is a personal view for decluttering your own entries — it is not a private space hidden from your household. See "Family Features" in our Terms of Service for how household access works.
- Passwordless authentication: no passwords are ever stored or transmitted.
- Access to production systems is restricted to authorised personnel only.
- Regular security reviews and dependency audits.
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to support@lekkafy.com.
6. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We share data only with:
- Infrastructure provider: Supabase — database, authentication, and file storage hosted in the EU (Ireland) (data processor).
- AI processing provider: Google, via the Gemini API. When you scan a receipt, import a statement, use Ask Lekka, or receive AI-generated budget suggestions, the relevant image, text, or financial data needed to answer your request is sent to Google's Gemini API for processing. This processing may occur on infrastructure outside the EU (see "International Data Transfers" below).
- Email delivery provider: Resend, via Supabase's authentication email integration — sends transactional emails (magic links, family invitations). This necessarily includes the email content (such as your magic link), not only your email address.
- Law enforcement or regulators: where required by applicable law or court order.
All third-party processors are contractually bound to process your data only as instructed and to maintain appropriate security standards.
7. Data Retention
We retain your data for as long as your account is active. Specifically:
- Account and profile data: retained until account deletion.
- Financial records (expenses, budgets): retained until you delete them or delete your account.
- Authentication logs: retained for 90 days for security purposes, then automatically purged.
- Deleted data: purged from backups within 30 days of deletion.
8. International Data Transfers
Your account data, financial records, and files are stored on Supabase infrastructure in the EU (Ireland). Processing through Google's Gemini API (receipt scanning, statement parsing, Ask Lekka, and budget suggestions) may involve Google infrastructure located outside the UK/EEA, including in the US.
For this and any other transfer outside the UK/EEA, we rely on the applicable safeguard for that specific vendor, which may include:
- The EU-US Data Privacy Framework and its UK Extension, where the receiving vendor is certified.
- UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs), where certification does not apply.
You can request details of the safeguard applicable to a specific processor by emailing support@lekkafy.com.
9. Your Rights Under GDPR
As a data subject under UK GDPR and EU GDPR, you have the following rights, which we honour without charge within one calendar month of a verified request (extendable by up to two further months for complex requests, with notice):
Right of Access (Art. 15)
Request a copy of all personal data we hold about you, including how it is processed.
Right to Rectification (Art. 16)
Correct any inaccurate or incomplete personal data. You can update most data directly in the app.
Right to Erasure — 'Right to be Forgotten' (Art. 17)
Request deletion of your personal data. You can delete your account directly from Settings → Security → Delete Account. Upon deletion, data is purged within 30 days.
Right to Restriction (Art. 18)
Request that we restrict processing of your data while a dispute is being resolved.
Right to Data Portability (Art. 20)
Receive a copy of your personal data in a structured, machine-readable format to transfer to another service. Submit your request by email and we will fulfil it within one calendar month.
Right to Object (Art. 21)
Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Art. 7(3))
Withdraw consent for any consent-based processing at any time without affecting the lawfulness of prior processing.
Rights Related to Automated Decision-Making (Art. 22)
Lekkafy does not make solely automated decisions with significant legal effects. AI-generated insights are informational only.
How to exercise your rights
Email support@lekkafy.com with your request. We may ask you to verify your identity before fulfilling the request. We will respond within one calendar month, as required by UK GDPR (extendable by up to two further months for complex requests, with notice).
10. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority (ICO for UK, applicable DPA for EU) within 72 hours of becoming aware.
- Notify affected individuals without undue delay if the breach is likely to result in high risk.
12. Age Requirement
Lekkafy is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at support@lekkafy.com and we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in how we process your data or in applicable law. We will notify you of material changes by email or via an in-app notice at least 14 days before the change takes effect. Where a change requires your consent (for example, a new use of your data that relies on consent as its lawful basis), we will ask for that consent separately before relying on it.
15. Contact Us
For any privacy or data protection questions:
Lekkafy Ltd
Registered Office: 82A James Carter Road, Mildenhall, Bury Saint Edmunds, IP28 7DE, United Kingdom
Email: support@lekkafy.com
Website: lekkafy.com