Privacy policy
Axevallr has read-only access to bank accounts. The bank integration uses account information services only. It cannot initiate payments, move money, or change anything at your bank.
1. Who we are
The controller responsible for the personal data described in this policy is PETAR BALTOV, Individual, of 126 Belomorski Street, Plovdiv, Bulgaria (“we”, “us”).
For anything relating to your personal data, write to [email protected]. Other ways to reach us are on the contact page.
2. Scope
This policy covers two separate things:
- This website, axevallr.com, which is public and informational.
- The Axevallr application, a private dashboard that is not publicly available. Only operators we have individually authorised can sign in to it.
3. This website
This website sets no cookies, runs no scripts, uses no analytics and makes no requests to third parties. Every file it uses, including fonts, styles and images, is served from axevallr.com itself. Nothing on it tracks you.
The website is hosted on Cloudflare Pages. To deliver pages and protect the site against
attacks, Cloudflare processes the technical details of each request: your IP address, browser
user agent, the page requested and the time of the request. We have not enabled Cloudflare
Web Analytics. If Cloudflare's security systems need to challenge a request they suspect is
automated, they may set a strictly necessary security cookie (such as
cf_clearance) that is not used for tracking.
4. The application
Bank data, retrieved only with your consent
When you choose to connect a bank account, you are sent to your bank to log in and approve access. You authenticate directly with your bank: we never see or store your online-banking username, password or other login credentials. Once you approve, the following is retrieved from your bank through Enable Banking, an authorised account information service provider (see section 7):
- Account details: account number (IBAN), account name, product name, account type and currency.
- Balances: amounts, balance types and the dates they refer to.
- Transactions: amount, currency, direction, booking and value dates, status, the name and account number of the other party, the payment reference or description, the bank's transaction code, and exchange-rate details for foreign-currency payments. We keep the full transaction record as your bank supplied it.
- Connection details: your bank's name and country, when you gave consent and when it expires, a pseudonymous identifier supplied by Enable Banking, and the session reference that lets us retrieve updates until consent expires.
Transactions naturally include the names and account numbers of people and businesses you pay or receive money from. That information is processed only as part of your own records and is never used for any other purpose.
Sign-in
You sign in to the application with a GitHub or Google account. We receive your name, email address and profile picture from the provider you choose, and admit you only if your email address is on our list of authorised operators. The application has no passwords of its own. A session cookie keeps you signed in; it is strictly necessary for the application to work.
5. Legal basis
- Bank data: your explicit consent (GDPR Article 6(1)(a)), which you give in Axevallr and then confirm with your bank as the account-access consent required for account information services under the EU Payment Services Directive (PSD2).
- Sign-in data: necessary to provide the application you asked to use (GDPR Article 6(1)(b)).
- Website request data: our legitimate interest in delivering this website and keeping it secure (GDPR Article 6(1)(f)).
6. What we use it for
Bank data is used for one purpose: to show you an overview of your own finances, including balances, transaction history and spending grouped by category. Transactions are categorised automatically from the merchant name to build that overview, and for nothing else.
We do not:
- make automated decisions about you, or profile you in a way that has legal or similarly significant effects;
- use your data for advertising or marketing;
- sell your data, or share it with anyone other than the service providers listed in section 7, who handle it only to provide the service;
- use your data for credit scoring, lending or any other financial product.
7. Service providers
- Enable Banking Oy
- Otakaari 5, 02150 Espoo, Finland, business ID 2988499-7. An account information service provider authorised and supervised by the Finnish Financial Supervisory Authority (FIN-FSA). Enable Banking connects to your bank, handles the consent process and passes your account information to us. It processes your data under its own privacy notice.
- Application hosting
- The application and its database are self-hosted on a server operated by us in Bulgaria. No cloud provider stores the application's database. The server is not exposed to the public internet; it is reachable only over a private network provided by Tailscale Inc., whose connections are end-to-end encrypted so that Tailscale cannot read the traffic.
- Cloudflare, Inc.
- Hosts this website and handles its domain name (see section 3). It does not host or process any data from the application.
- GitHub, Inc. and Google LLC
- Only the one you choose to sign in with. It confirms your identity and sends us the sign-in details described in section 4.
8. Retention and deletion
Bank data is kept for as long as the bank connection exists in Axevallr. Consent given to your bank lasts at most 90 days, or less if your bank sets a shorter limit. When it expires, no further data is retrieved until you reconnect; data already retrieved stays until you remove the connection.
When you remove a connection in Axevallr, we ask Enable Banking to end the session, and we permanently delete the connection and every account, balance and transaction retrieved through it. We delete your data even if Enable Banking cannot be reached at that moment; the bank-side consent then expires on its own schedule, and you can also revoke it at your bank straight away (see section 10).
A short record of each connection attempt is kept as a security audit trail: the bank's name and country, the time of the attempt, its outcome and the pseudonymous identifier. It contains no account numbers, balances or transactions. You can ask us to delete it.
Your email address stays on the list of authorised operators until your access is removed.
9. Security
- The session reference that allows access to your accounts is encrypted at rest with AES-256-GCM.
- The application is not reachable from the public internet, only over an encrypted private network.
- Only operators whose email address we have individually authorised can sign in, and only through GitHub or Google. There are no passwords to steal.
- Account numbers are masked before they are shown in the browser.
- Access to the server and database is restricted to the authorised operator.
10. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, and to object to its processing.
You can withdraw your consent at any time. To stop all access to a bank account, do both of the following:
- Remove the connection in Axevallr (Banking, then Remove next to the connection). This ends retrieval and deletes the data, as described in section 8.
- Revoke access at your bank, usually under connected apps or third-party access in your bank's app or online banking.
Either step on its own stops further retrieval. Withdrawing consent does not affect the lawfulness of processing before you withdrew it.
To exercise any other right, email [email protected]. We reply within one month.
11. International transfers
Bank data is stored only on the application server in Bulgaria and is retrieved through Enable Banking, which is established in Finland. We do not transfer bank data outside the European Economic Area.
Cloudflare, GitHub and Google are US companies and may process the website request data or sign-in data described above outside the EEA. They rely on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses for those transfers.
12. Complaints
If you think we have handled your data unlawfully, you can complain to a data protection supervisory authority. Ours is European Data Protection Board (EDPB). You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to put things right first, so please contact us too.
13. Contact
Data protection questions and requests:
[email protected].
Postal address: PETAR BALTOV, 126 Belomorski Street, Plovdiv, Bulgaria.
14. Changes to this policy
If this policy changes, the new version will be published on this page with a new “last updated” date. If a change affects how bank data is used, we will ask for your consent again before it applies.