Terms & Privacy

These Terms of Use and this Privacy Policy apply to hold. (the Application), a personal finance and budgeting app operated for users in the European Economic Area (EEA), the United Kingdom, and Switzerland, as well as other regions where the Application is made available.

Personal data means information that relates to you and can identify you directly or indirectly (for example, your email address or financial records you enter). Data includes personal data and other information you enter or generate in the Application.

We write this policy in clear, plain language, as required by GDPR Article 12. If anything is unclear, contact us (see Contact).

Terms of Use
Privacy Policy
Open-source licenses
Contact
Policy updates

Terms of Use

Overview and acceptance

The Application is provided by Weboria (we, us, or the Provider) on an "as is" and "as available" basis, without warranties of any kind, whether express or implied, except where mandatory consumer law in your country of residence provides otherwise.

Any statistics, projections, or summaries shown in the Application may be incomplete or incorrect. You are responsible for verifying information before relying on it. hold. is for informational and organizational purposes only and does not provide financial, investment, tax, or legal advice. The AI assistant (Holdy) offers general guidance based on your data; it is not a regulated financial adviser.

By downloading, installing, creating an account, or using the Application, you agree to these Terms of Use and the Privacy Policy below. If you do not agree, do not use the Application. We may update these documents from time to time by posting a new version on our website and updating the Policy updates section. Where required by law, we will notify you of material changes. If you continue using the Application after an update takes effect, you accept the updated Terms.

Eligibility and acceptable use

You must be at least 16 years old (or the minimum age required in your country to consent to data processing, if higher) to use the Application. You represent that you are legally permitted to use the Application in your jurisdiction and that any information you enter is information you have the right to use.

You agree not to:

use the Application in a way that interferes with its operation, attempts unauthorized access, or violates applicable laws;
share credentials or attempt to access another person's account without permission;
upload unlawful, infringing, or malicious content (including through receipt images or chat messages);
reverse engineer, scrape, or resell the Application except where mandatory law allows.

The Application requires an account (email and password and/or supported third-party sign-in). You are responsible for keeping your credentials secure.

Premium household sharing lets you invite another person to view selected financial data (for example, transactions and budgets marked as household-visible). By inviting someone or accepting an invite, you instruct us to share relevant Data with that household member. You remain responsible for what you choose to share and for inviting only people you trust.

Subscriptions and payments

Certain features require a paid subscription purchased through the Apple App Store, Google Play, or other platforms we support. Prices, billing periods, renewal, and cancellation are shown at purchase and governed by the relevant store's terms. Refunds are handled according to platform rules and applicable consumer law.

Liability

To the fullest extent permitted by applicable law, the Provider will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, Data, or goodwill arising from your use of (or inability to use) the Application.

Where liability limitations are allowed, the Provider's total liability for any claim will not exceed the amount you paid for the Application or subscriptions in the twelve (12) months before the event giving rise to the claim (or EUR 0 if you did not pay).

Nothing in these Terms limits liability where it cannot be limited under applicable law, including mandatory consumer protections in the EU/EEA and UK. We do not exclude liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation.

License

The Application is licensed, not sold. Subject to these Terms, we grant you a personal, non-exclusive, non-transferable, revocable license to install and use the Application for your own personal, non-commercial use on devices you own or control.

Intellectual property

The Application, including its design, code, Holdy persona, logos, and related content, is owned by the Provider or its licensors and is protected by applicable intellectual-property laws. These Terms do not grant you any rights to our trademarks or brand assets except as needed to use the Application as intended.

You retain ownership of the Data you enter. You grant us a limited license to host, process, and display that Data solely to provide and improve the Application, as described in the Privacy Policy.

Third-party services

The Application relies on third-party services to operate, including cloud hosting, payment and subscription platforms, optional sign-in providers, AI inference, and operating-system services (notifications, secure storage). Those services are governed by their own terms and privacy policies. We are not responsible for third-party services outside our reasonable control.

A list of categories of service providers (processors) we use is in the Privacy Policy.

Governing law and disputes

If you are a consumer in the EU/EEA or UK, you may bring proceedings in the courts of your country of residence where permitted by law. You may also use the European Commission's Online Dispute Resolution (ODR) platform for out-of-court dispute resolution where applicable.

Termination

These Terms remain in effect until terminated. You may stop using the Application at any time and may request account deletion as described in the Privacy Policy. We may suspend or terminate your access if you materially violate these Terms or where required by law. Sections intended to survive (including warranty disclaimer, limitation of liability, and intellectual property) will survive termination.

Updates, availability, and support

We may modify, suspend, or discontinue any part of the Application at any time, including features and supported integrations, and may release updates without obligation to continue supporting prior versions. We aim to provide reasonable support via support@holdmy.app

Privacy Policy

We value the security and privacy of your financial Data. This Privacy Policy explains who processes your personal data, what we collect, why we use it, where it is stored, who we share it with, and how you can control it — in line with the EU General Data Protection Regulation (GDPR) Chapter 3 and equivalent UK law.

We do not sell your personal information and we do not use advertising or cross-app tracking for monetisation.

Data controller

The data controller (the organization that decides why and how your personal data is processed) for hold. is:

Weboria
Email: support@holdmy.app

When you create an account or otherwise give us personal data, we inform you of the following (and this policy provides the full detail):

What you need to know	Summary
Who we are	See Data controller above.
Why we process your data	To provide the Application: account, sync, budgeting, optional household sharing, subscriptions, receipt scanning, and AI assistant features. See Purposes and legal bases.
Legal basis	Contract, legitimate interests, consent (where required), or legal obligation.
Recipients	Our processors, your household members (if you share), sign-in providers you choose, and authorities when required by law. See Data sharing.
Transfers outside the EEA	Some providers may process data outside the EU/EEA; we use appropriate safeguards. See International transfers.
How long we keep data	While your account is active and as needed for the purposes above; see Data retention.
Your rights	Access, rectification, erasure, restriction, portability, objection, withdraw consent, and complain to a supervisory authority. See Your rights.
Whether you must provide data	Email and account data are required to create an account and use core features. Financial data you enter is voluntary but necessary if you want to use budgeting and tracking features. Without an account, we cannot provide the service.
Automated processing	Holdy uses automated processing to answer questions; it does not make decisions with legal or similarly significant effects on you. See Automated processing and AI (Holdy).

If we receive personal data about you from someone else (for example, a household invite sent to your email), we process it to manage that invitation and, if you accept, to provide shared household features. We tell you this when you accept the invite or create an account linked to it.

What data we process

Depending on how you use the Application, we may process:

Account and profile data — email address, authentication identifiers, display name, avatar, preferred language and currency, onboarding preferences, notification settings;
Financial data you enter — accounts, transactions, categories, budgets, goals, and related notes or merchants;
Household data — household membership, invites, and transactions or budgets you mark as visible to your household;
Receipt and OCR data — images you submit for scanning, extracted text and structured fields, and processing status;
AI assistant (Holdy) data — chat messages you send, locale, and financial summaries retrieved on our servers to answer your questions; conversation history is stored locally on your device only;
Subscription data — premium entitlement status;
Technical and usage data — app version, device/OS type where needed for security or support; usage counters for fair-use limits on premium features.

We do not require access to your bank login credentials. Unless a future integration is explicitly offered and disclosed, hold. does not connect directly to financial institutions on your behalf.

Purposes and legal bases

We process personal data only where we have a valid legal basis under GDPR Article 6:

Purpose	Examples	Legal basis
Provide the service	Account, sync, budgets, accounts, analytics	Contract (Art. 6(1)(b))
Premium features	Subscriptions, household sharing, receipt scan, Holdy	Contract; Consent for Holdy (asked in-app before first use)
Security and abuse prevention	Authentication, access control, rate limits	Legitimate interests (Art. 6(1)(f)) — keeping the service and users safe
Improve reliability	Error diagnosis, support	Legitimate interests — maintaining a stable service
Optional notifications	Budget alerts, reminders	Consent (Art. 6(1)(a)) — you can disable in settings
Legal compliance	Responding to lawful requests, tax/accounting if applicable	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we balance our interests against your rights. You may object to processing based on legitimate interests (see Your rights).

Where data is stored

Cloud

Your account and financial Data are stored on our cloud backend (database and file storage), protected by authentication and access rules so you — and authorized household members, where applicable — can access only data you are permitted to see. Server-side processing handles sync, AI chat, receipt extraction, exchange rates, and subscription status.

On your device

The Application keeps an encrypted local cache for offline access and performance. Encryption keys are stored in your device's secure storage. Holdy chat history and some preferences may remain on-device only. Signing out removes local user Data from the device as implemented in the app.

We share personal data only as needed to operate the Application:

With your household members — when you mark records as household-visible or join a shared household;
With service providers (processors) — cloud hosting, payment/subscription platforms, AI inference, email delivery, and similar vendors under data-processing agreements that require them to protect your data and act only on our instructions;
With sign-in providers — if you choose third-party sign-in, that provider processes data according to its own policy;
When required by law — court orders, lawful requests from authorities, or to protect rights and safety.

We do not share your Data with advertisers.

Data integrity and accuracy

Integrity: We design hold. for reliable sync between your devices and our cloud backend. However, no system is perfect: network issues, client bugs, or outages may cause temporary inconsistency or loss.

Accuracy (GDPR Article 16): You can correct inaccurate or incomplete personal data directly in the Application (profile, transactions, accounts, etc.). You may also ask us to rectify data you cannot edit yourself by contacting support@holdmy.app.

Security

We use measures appropriate to the sensitivity of financial Data, including encrypted local storage, encryption in transit, authenticated access to backend services, and access controls in the database and file storage.

Security also depends on your device: use a strong passcode or biometrics and keep your operating system updated. Never share your account credentials or household invites with untrusted parties.

If a personal data breach is likely to result in a high risk to your rights, we will notify you without undue delay, as required by GDPR Article 34, in addition to notifying supervisory authorities where required.

Data retention

We retain personal data:

While your account is active — to provide the Application;
After deletion requests — only as long as needed to complete erasure or where we must retain data by law (for example, accounting records);
Support correspondence — as long as needed to respond and for reasonable record-keeping, unless you request deletion where applicable.

Your rights

If you are in the EU/EEA, UK, or Switzerland, you have the following rights under GDPR Chapter 3. We will not charge a fee for a valid request unless it is manifestly unfounded or excessive.

Email support@holdmy.app with the right you wish to exercise and enough information for us to identify your account. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you why). We may ask you to verify your identity before acting on a request.

Right of access (Article 15)

You may request confirmation of whether we process your personal data and receive a copy, together with information about purposes, categories, recipients, retention, and your other rights.

Right to rectification (Article 16)

See Data integrity and accuracy.

Right to erasure (Article 17 — "right to be forgotten")

You may ask us to delete your personal data where, for example, it is no longer needed for the purpose it was collected, you withdraw consent (where consent was the basis), or you object and we have no overriding grounds.

Erasure may not apply where we must keep data to comply with law, establish or defend legal claims, or where other GDPR exceptions apply. Deleting your account does not automatically delete household-visible records that other members still rely on.

Right to restrict processing (Article 18)

You may ask us to temporarily limit how we use your data (for example, while we verify accuracy or assess an objection).

Right to data portability (Article 20)

Where processing is based on consent or contract and is automated, you may request your personal data in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible.

Right to object (Article 21)

You may object to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, or we need the data for legal claims. If we ever use your data for direct marketing, you may object at any time and we will stop immediately.

Where processing is based on consent (for example, Holdy or push notifications), you may withdraw consent at any time via in-app settings or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Notification of changes (Article 19)

If we rectify, erase, or restrict processing of your data, we will tell you — and any recipients we disclosed the data to, where required — unless this is impossible or disproportionate.

Right to complain

You may lodge a complaint with your local supervisory authority. EU authorities are listed by the European Data Protection Board.

International transfers

Some service providers may process data outside the EU/EEA. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures.

Automated processing and AI (Holdy)

Holdy uses automated processing to interpret your questions and retrieve your financial Data on our servers. Outputs are informational only. Holdy does not make decisions that produce legal or similarly significant effects on you (GDPR Article 22).

Before first use, the Application asks for your consent in clear, plain language and explains that financial summaries are sent to our AI provider while conversation history stays on your device. You may decline and still use non-AI features.

Analytics and diagnostics

We do not operate an in-app advertising or behavioral analytics stack. App stores may collect aggregated crash or diagnostics data according to your device settings. If you email support, we receive only what you choose to share.

Children

The Application is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

Data deletion

You can limit or delete Data in several ways:

In the Application — delete individual transactions, accounts, budgets, and other records you created;
Sign out — removes local cached Data from the device;
Uninstall — removes the Application from your device; cloud Data remains until you delete your account or request erasure.

To request full erasure of your account and associated cloud Data, email support@holdmy.app.

Open-source licenses

hold. includes open-source software components. Those components are licensed by their respective authors under applicable open-source licenses, as included in the Application or package documentation.

The Application name, Holdy persona, logos, and related trademarks are owned by the Provider or licensors.

Contact

Privacy and data rights: support@holdmy.app

Terms and general support: support@holdmy.app

We aim to respond to privacy requests within the GDPR timeframe (generally one month).