PRIVACY POLICY

Effective date: 17 July 2026

1. WHO WE ARE

The data controller responsible for your personal data is Márk Dávid Bíró, a sole proprietor (egyéni vállalkozó) operating under Hungarian law ("Worthi", "we", "us", "our").

  • Registered seat: 5462 Cibakháza, Öregszőlő I. út 21., Hungary
  • Tax number (adószám): 55615910-2-36
  • EU VAT number (közösségi adószám): HU55615910
  • Contact: support@worthiapp.net

For any privacy-related question or to exercise your rights under this Policy, contact us at support@worthiapp.net.

2. SCOPE

This Privacy Policy explains what personal data we collect through the Worthi app and website, why we collect it, how long we keep it, who we share it with, and what rights you have under the EU General Data Protection Regulation ("GDPR") and applicable Hungarian data protection law.

3. WHAT PERSONAL DATA WE COLLECT

  • Account data: when you sign in with your Apple ID or Google account, we receive your name and email address from Apple or Google to create and identify your Worthi account. We do not receive your Apple ID or Google password.
  • Financial data you enter manually: transactions, categories, budgets, savings goals, and notes you add yourself in the app.
  • Financial data from connected bank accounts: if you choose to link a bank account, we use Enable Banking, a regulated Account Information Service Provider (AISP), to retrieve your account balance and transaction history on a read-only basis, with your explicit consent. The retrieved data is then stored on Worthi's own backend (see Section 6).
  • Receipts and bank statements: if you upload a photo or PDF of a receipt or bank statement so that we can extract transaction data from it (OCR), we process that image or document, and store the extracted data (and the uploaded file) on Worthi's own backend.
  • Support communications: any information you share with us when you contact support@worthiapp.net.

We do not knowingly collect special categories of data (e.g. health, religion, political opinions). Please avoid including such information in free-text fields (e.g. transaction notes) unless strictly necessary.

4. WHY WE USE YOUR DATA AND OUR LEGAL BASIS

  • To provide and operate the Service, including account creation, bank account linking, and receipt/statement OCR processing (performance of a contract, Art. 6(1)(b) GDPR).
  • To maintain the security of the Service and prevent fraud (legitimate interest, Art. 6(1)(f) GDPR).
  • To communicate with you about your account or respond to support requests (performance of a contract / legitimate interest).
  • To comply with legal and accounting obligations (legal obligation, Art. 6(1)(c) GDPR).

5. CONNECTED BANK ACCOUNTS (OPEN BANKING)

Where you choose to connect a bank account, Worthi uses Enable Banking, a regulated third-party Account Information Service Provider (AISP), to retrieve your account balance and transaction data on a read-only basis, with your explicit consent. Enable Banking acts as our data processor for this purpose. We never receive or store your online banking login credentials. The account and transaction data retrieved through Enable Banking is transferred to and stored on Worthi's own backend infrastructure (see Section 6). You can disconnect a linked account at any time in Settings.

6. WHERE AND HOW WE STORE YOUR DATA

All personal and financial data described in this Policy – including data you enter manually, data retrieved via Enable Banking, and data extracted from receipt or bank statement uploads – is stored and processed on Worthi's own backend infrastructure, hosted on Railway, using a PostgreSQL database. We do not share this data with any analytics, advertising, or other third-party service beyond what is stated in this Policy.

7. ADVERTISING AND MARKETING

We run advertising and marketing campaigns for Worthi through the Apple App Store, Google Play, Meta (Facebook and Instagram), TikTok, and influencer marketing partnerships. As of the effective date of this Policy, the Worthi app does not include any third-party advertising SDK, tracking pixel, or Conversion API integration, and we therefore do not share your personal data with these advertising platforms through the app itself. If this changes in the future – for example, if we add a pixel or a Conversions API integration for ad measurement – we will update this Policy accordingly and, where required by law, ask for your consent beforehand.

8. HOW WE SHARE YOUR DATA

We do not sell your personal data. We share it only with:

  • Enable Banking, acting as our data processor, solely to retrieve account and transaction data for bank accounts you choose to connect.
  • Railway, our hosting/infrastructure provider, acting as our data processor, hosting our backend and database.
  • Authorities, where required by law or to protect our legal rights.
  • A successor entity, in the event of a merger, acquisition, or asset sale, subject to the same protections described in this Policy.

9. INTERNATIONAL DATA TRANSFERS

Where any of the service providers listed in Section 8 store or process data outside the European Economic Area, we ensure an adequate level of protection through appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

10. DATA RETENTION

We retain your personal data for as long as your account remains active. If you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain certain data for longer to comply with legal, accounting, or tax obligations, or to resolve disputes.

11. DATA SECURITY

We apply technical and organizational measures appropriate to the risk, including encryption of data in transit and at rest, access controls, and regular security reviews. No system is completely secure, and we cannot guarantee absolute security.

12. YOUR RIGHTS

Under the GDPR, you have the right to: access your personal data; rectify inaccurate data; request erasure ("right to be forgotten"); restrict processing; receive your data in a portable format; object to processing based on legitimate interest; and withdraw consent at any time without affecting past processing. To exercise any of these rights, contact support@worthiapp.net. We will respond within one month, as required by the GDPR.

You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, "NAIH"), or with the supervisory authority of your own EU country of residence.

13. CHILDREN'S PRIVACY

The Service is not directed at children under 16, and we do not knowingly collect personal data from children under that age. If we become aware that we have collected such data without appropriate consent, we will delete it.

14. AUTOMATED SUGGESTIONS

Worthi may generate budgeting or category suggestions using automated logic. These are provided for informational purposes only, do not produce legal or similarly significant effects on you, and you always retain full control to review, edit, or reject any suggestion.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time, in particular as we add new features or integrations (e.g. advertising measurement tools, as described in Section 7). Material changes will be communicated via the app or by email before they take effect.

16. CONTACT

For any question about this Privacy Policy or to exercise your rights, contact support@worthiapp.net.