Privacy Policy

Last updated: August 29, 2025

SpendLoom is a product of Vineyard Reality Technologies LTD (“Vineyard,” “we,” “our,” “us”). We respect your privacy and are committed to protecting your personal and financial data. This Privacy Policy explains how we collect, use, share, store, and protect information when you use SpendLoom’s applications, website, and related services (“Services”).

We process personal data in accordance with Ghana’s Data Protection Act, 2012 (Act 843) and, where applicable, the EU General Data Protection Regulation (GDPR).

1) Information We Collect

• Account & Billing Data: name, email, phone, password (hashed), billing details.
• Financial Data You Provide: Mobile Money (MoMo) and/or bank statements you upload; parsed transactions (amounts, dates, descriptions, merchant/counterparty, balances).
• Technical & Usage Data: device and browser information, IP address, log data (auth events, feature usage), diagnostic and performance data, cookies/identifiers (see our Cookie Policy).

2) Lawful Bases for Processing

We rely on one or more of the following legal bases under Act 843/GDPR:

• Consent (e.g., when you upload statements or opt-in to marketing).
• Contract (to provide the Services you request under our Terms).
• Legal obligation (e.g., tax, accounting, fraud prevention).
• Legitimate interests (e.g., product improvement, security), balanced against your rights.

You may withdraw consent at any time where consent is the lawful basis.

3) How We Use Your Information

• Provide and improve SpendLoom’s parsing, categorization, analytics, exports, and dashboards.
• Authenticate users, secure accounts, and prevent fraud/abuse.
• Process payments and manage subscriptions.
• Communicate service updates, account notices, and (if opted-in) marketing.
• Comply with applicable laws and enforce our Terms.

We do not sell your personal or financial data.

4) Sharing Your Information

• Service providers/sub-processors (e.g., hosting, storage, analytics, payments) under contracts requiring appropriate safeguards.
• Legal/disclosure when required by law, regulation, or valid process.
• Business transfers (merger, acquisition, or asset sale) with continued protection of your data.

A current list of core sub-processors is available on request. All are bound by obligations no less protective than this policy and our DPA.

5) International Data Transfers

Your data may be processed outside your country. For EU data subjects, we use appropriate safeguards such as Standard Contractual Clauses (SCCs). For Ghanaian users, cross-border transfers are performed in line with Act 843.

6) Data Retention

We retain personal and financial data only as long as necessary to provide the Services, meet legal obligations, or resolve disputes. You can delete uploaded statements at any time; you may also request account deletion.

7) Your Rights

Ghana (Act 843): rights to access; prevent processing likely to cause damage/distress; prevent processing for direct marketing; request correction, blocking, or deletion of inaccurate data.

EU (GDPR): rights to access, rectification, erasure, restriction, objection, data portability, and to not be subject to certain automated decisions including profiling.

To exercise rights, email team@spendloom.com. We will respond within statutory timelines.

You may lodge complaints with the Data Protection Commission (Ghana) or your local EU supervisory authority.

8) Cookies & Tracking

We use necessary cookies for core functions and optional analytics cookies with consent. Manage preferences via our banner or your browser settings. See our Cookie Policy.

9) Children’s Privacy

Our Services are not directed to individuals under 18. If we learn a minor has provided personal data, we will delete it.

10) Security

We use industry-standard safeguards, including TLS in transit and encryption at rest, access controls, and monitoring. No system is 100% secure, but we work to protect your information continually.

11) Controller/Processor Roles

For most end-user accounts, Vineyard is the data controller. Where SpendLoom processes personal data on behalf of a business customer, Vineyard acts as processor under our Data Processing Agreement (DPA).

12) Changes to This Policy

We may update this policy from time to time. Material changes will be notified in-app or by email. Continued use after changes means you accept the updated policy.

13) Contact