🔒 Privacy Policy

Last updated: October 6, 2026

Gigi ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This privacy policy explains how we collect, use, and protect information when you use our app.

This public website

The public website is hosted by Vercel. To deliver and secure the site, the hosting service processes technical request data, including IP address, requested URL and browser information. Interactive examples on this website are calculated locally in your browser: entered amounts, choices and example questions are not saved or transmitted. They do not create an app account or schedule a reminder. Google Analytics is loaded only with your consent. See the cookie policy for purposes, cookies, retention periods and withdrawing consent. Cookies

1. Who are we?

Gigi is a personal financial coach app developed by:

2. What data do we collect?

2.1 Data you provide to us

• Account data: Email address, name (optional), profile photo (optional)
• Financial data: Income, expenses, savings goals, and other financial information you enter to use the app
• Payment data: When you subscribe to a premium plan, payment data is processed by the Apple App Store, Google Play, Stripe, RevenueCat and/or their payment processors depending on the platform. We do not store credit card numbers.
• Communication: Messages you send to Gigi (our AI coach) and support requests
• Notification preferences: Your push notification settings, preferred time and day for reminders, and device information for delivering notifications

2.2 Automatically collected data

• Usage data: How you use the app, which features you visit, and error messages
• Device data: Device type, operating system, app version
• Analytical data: Product usage and technical information, which may be linked to a pseudonymous account identifier.

3. How do we use your data?

We use your data for:

• Delivering and personalizing our services
• Processing payments and managing subscriptions
• Sending important account notifications
• Improving our app and developing new features
• Responding to support requests
• Sending optional newsletters (only with your consent)

3.1 Internal analysis and product improvement

We use EU-hosted PostHog to understand app usage. Events can include page visits, interactions, technical device information and a pseudonymous account identifier. This is not fully anonymous data. Session replay is disabled and text and attributes are masked in automatic capture. We do not sell this data.

3.2 Legal basis for processing (Art. 6 GDPR)

We process your data based on the following legal grounds:

• Performance of contract (Art. 6.1.b): Delivering the Gigi service, payment processing, account management, and AI coaching
• Legitimate interest (Art. 6.1.f): Product improvement, security, fraud prevention, and anonymized analyses
• Consent (Art. 6.1.a): Newsletters, optional analytics, and marketing communications
• Legal obligation (Art. 6.1.c): Retention of payment data in accordance with accounting regulations

3.3 Push Notifications and Email Communication

3.3.1 Push Notifications

When you enable push notifications, we process:

• Your push subscription endpoint (technical address for delivering notifications)
• Your preferred time and day for reminders
• Your device type and browser (for compatibility)

3.3.2 Email Communication

We send the following types of emails:

• Transactional emails: Payment confirmations, invoices, account changes, and security notifications. Legal basis: performance of contract (Art. 6.1.b GDPR)
• Service emails: Important service updates and policy changes. Legal basis: legitimate interest (Art. 6.1.f GDPR)
• Marketing emails: Newsletters, tips, and recommendations. Legal basis: consent (Art. 6.1.a GDPR)

You can unsubscribe from marketing emails at any time via the unsubscribe link in each email.

3.4 Optional advertising measurement with Meta and TikTok

In versions offering this feature, Gigi starts the native Meta App Events and TikTok Business SDKs only after your separate, optional consent during sign-up or in Settings. On iPhone, Apple’s tracking permission is also required. Refusal does not affect Gigi or your subscription. The legal basis is consent (Article 6(1)(a) GDPR).

We use Meta and TikTok only after you agree. We share installation, app-open, registration, trial-start and subscription purchase or renewal events. Subscription events may include the amount and currency charged. The SDKs also send advertising, installation and session identifiers, IP address, approximate location, language, device, app, SDK and campaign information. These are not anonymous and may be linked to your accounts with those services.

Your budget, income, expenses, goals, conversations and partner information are not shared. Automatic purchase logging, enriched interaction capture, screenshots, customer matching with email or contact information, and SDK crash/monitoring uploads are disabled. Gigi sends no GPS coordinates. Withdrawal does not affect the lawfulness of earlier processing. This choice is separate from website cookies.

You can refuse or withdraw in Settings → Advertising measurement. Withdrawal stops new measurement requests and cancels pending transmissions on this device; it does not erase data already received. For access or deletion, contact privacy@gigimoney.com or use the providers’ privacy options. Their policies govern retention and international processing.

Meta Privacy Policy · TikTok Privacy Policy · TikTok Business Products (Data) Terms

4. Who do we share your data with?

We share data with the service providers below and, if you consent, with Meta and TikTok as described in section 3.4.

4.1 Service providers

• Supabase: Database and authentication (EU servers)
• Google Firebase Cloud Messaging and Apple Push Notification service: If you enable push notifications, we use a registration token for your device to deliver notifications. Google processes this token and the content of Android notifications; Apple does so for iOS. You can turn off push notifications in your device settings.
• Stripe: Web payment processing (PCI-DSS certified)
• Apple App Store and Google Play: Native app subscription payments, receipts, refunds and store-managed billing
• RevenueCat: Subscription entitlement management and purchase status synchronization
• Resend: Email delivery
• PostHog: Privacy-conscious product analytics (EU-hosted)
• Anthropic (Claude): AI features (Gigi buddy). Your conversations with Gigi are processed by Anthropic via their Claude API to deliver the service. Anthropic does not use this data to train their models. See Anthropic's privacy policy for more information.
• ElevenLabs: If you enable voice, your microphone recording is sent through our server to ElevenLabs for transcription. Text to be spoken, which may include information from your conversation, is sent to ElevenLabs to generate speech. The transcript and relevant context are processed by Anthropic to answer your question. Gigi does not save microphone recordings in its voice gateway. ElevenLabs retention depends on the service and account configuration; we do not promise zero retention. See ElevenLabs’ privacy policy. You can use text chat without enabling the microphone.

4.2 Legal requirements

We may share data if required by law or to protect our rights.

4.3 Data processing agreements

With all our service providers (sub-processors), we have concluded data processing agreements in accordance with Article 28 GDPR, which detail technical and organizational security measures.

5. How long do we retain your data?

• Account data: As long as your account is active, plus 30 days after deletion
• Financial data: As long as your account is active
• Payment history: 7 years (legal requirement)
• Gigi conversations: The current text chat keeps its history in the active app session. Relevant messages and context are sent to our AI providers to generate replies. Provider retention is governed by their policies and our service configuration; we do not promise a fixed 90-day period or zero retention.

6. Your rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access: You can request what data we have about you
• Right to rectification: You can request correction of inaccurate data
• Right to erasure: You can request deletion of your data
• Right to restrict processing: You can limit the processing of your data
• Right to data portability: You can export your data in a common format
• Right to object: You can object to certain processing activities

To exercise any of these rights, contact us at privacy@gigimoney.com.

6a. Additional privacy information for US users

We do not sell your personal information for money. The optional disclosure to Meta and TikTok described above may be considered “sharing” or a “sale” under applicable US state privacy laws. You can refuse or turn off Advertising measurement in Settings. Depending on your state, you may also have rights to access, correct, delete or export personal information, and to opt out of targeted advertising. Contact privacy@gigimoney.com to exercise these rights.

You can exercise these rights by contacting privacy@gigimoney.com. We will verify your request before taking action.

7. Security

We take the security of your data seriously:

• All data is transmitted encrypted (HTTPS/TLS)
• Core account data is stored on secure EU servers; external providers may process data internationally as described in this policy
• Access to data is restricted to authorized personnel
• Regular security audits and updates

8. Cookies and local storage

Our app uses:

• Strictly necessary cookies: For authentication, session management, and app functionality. These cookies are essential and cannot be disabled.
• Local storage and account synchronization: Gigi stores data on your device for offline use and preferences. When you sign in, personal planning data, including income, expenses, savings, Horizon events and selected preferences, is also synchronized with your account through Supabase so it can be used on your other devices. This personal synchronization does not share those data with your partner. Together has its own shared-data features. When conflicting versions need your choice, a recovery copy is kept on the device.
• Analytical cookies: The website offers a cookie choice for optional analytics. The current native app does not expose the same cookie-settings control. Contact privacy@gigimoney.com with questions or objections about analytics.

The optional native Meta and TikTok SDKs use app and device identifiers rather than browser cookies. Its separate advertising-measurement choice is described in section 3.4; website cookie preferences do not enable it.

9. Minors

Gigi is not intended for persons under 16 years of age. In the United States, Gigi is not directed to children under 13. We do not knowingly collect data from children. If you are a parent or guardian and discover that your child has provided data, please contact us.

10. International transfer

Your data is primarily processed within the European Economic Area (EEA). If data is processed outside the EEA (e.g., for AI features), we ensure appropriate safeguards in accordance with GDPR.

10a. Data breaches

In case of a security breach of personal data (data breach):

• We will notify the competent supervisory authority (Data Protection Authority) within 72 hours in accordance with Article 33 GDPR
• We will inform affected users without undue delay when the data breach poses a high risk to their rights and freedoms (Article 34 GDPR)
• We will document all data breaches in an internal register, including the facts, consequences, and corrective measures taken

11. Changes to this policy

We may update this privacy policy periodically. For significant changes, we will notify you via the app or email. The "last updated" date above indicates the most recent version.

12. Contact