Privacy Policy

Last updated: 05/05/2026

Privacy Policy

Last updated: March 2026

This privacy policy describes how Cobudge ("we", "us", "our") collects, uses, and protects your personal information when you use our platform.

1. Data Controller

Cobudge is operated from Switzerland. For any privacy-related inquiries, please contact us through our contact page.

2. Information We Collect

Account Information: When you create an account, we collect your name, email address, and password (stored as a secure hash). If you enable two-factor authentication, we store the associated TOTP secret or WebAuthn credential.

Financial Data: Transaction records, budget configurations, account balances, categories, goals, and any other financial information you enter into the platform. This data is provided voluntarily by you.

Usage Data: We collect minimal technical data necessary for the operation of the service: IP address (for security and rate limiting), browser type, and timestamps of access. We do not use analytics trackers or advertising cookies.

Payment Information: If you subscribe to a paid plan, payment processing is handled by our payment provider (Stripe). We do not store your credit card number. We receive only a customer identifier and subscription status from Stripe.

3. Legal Basis for Processing

We process your data based on the following legal grounds:

  • Contract performance: Processing necessary to provide you with the Cobudge service (Art. 6(1)(b) GDPR).
  • Legitimate interest: Security measures, fraud prevention, and service improvement (Art. 6(1)(f) GDPR).
  • Consent: Where you have given explicit consent, such as for optional communications (Art. 6(1)(a) GDPR).

Processing is carried out in accordance with the Swiss Federal Act on Data Protection (nLPD) and the principles of lawfulness, good faith, and proportionality (Art. 6 nLPD).

4. How We Use Your Information

Your data is used solely to:

  • Provide, maintain, and improve the Cobudge platform
  • Process your transactions and display your financial information
  • Authenticate your identity and secure your account
  • Send essential service notifications (password resets, security alerts)
  • Respond to your support requests
  • Process payments for paid subscriptions

We never sell, rent, or share your personal or financial data with third parties for marketing purposes.

5. Data Sharing

We share your data only with:

  • Payment processors (Stripe) for subscription billing — limited to payment-related data only
  • Hosting providers located in Switzerland for infrastructure services
  • Law enforcement when required by Swiss law or valid court order

We do not use any third-party analytics, advertising, or tracking services.

6. Data Retention

  • Active accounts: Your data is retained as long as your account is active.
  • Deleted accounts: Upon account deletion, your personal data is permanently removed within 30 days. Anonymized aggregate data may be retained for service improvement.
  • Legal obligations: Certain data may be retained longer where required by Swiss law (e.g., financial record-keeping obligations).

7. Your Rights

Under the Swiss Federal Act on Data Protection (nLPD) and the GDPR, you have the right to:

  • Access your personal data and obtain a copy
  • Rectify inaccurate or incomplete data
  • Delete your personal data ("right to be forgotten")
  • Export your data in a portable format
  • Object to processing based on legitimate interests
  • Withdraw consent at any time for consent-based processing
  • Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland

To exercise any of these rights, please contact us through our contact page.

8. Security Measures

We implement industry-standard security measures including:

  • Encryption of all data at rest and in transit (TLS 1.2+)
  • Two-factor authentication (TOTP and WebAuthn)
  • Role-based access control
  • Regular security audits
  • Secure password hashing (bcrypt)

9. International Transfers

Your data is stored and processed in Switzerland. Switzerland is recognized by the European Commission as providing an adequate level of data protection. We do not transfer your data to countries without adequate data protection unless required by the services described in Section 5.

10. Cookies

We use only essential cookies necessary for the platform to function. See our Cookie Policy for details.

11. Children's Privacy

Cobudge is not intended for children under 16 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes via email or a prominent notice on our platform.

13. Contact

For privacy-related questions or to exercise your rights, please contact us through our contact page.