Ledgerlight

Privacy Notice

Last updated: 3 October 2026

Controller

Pedro Rodriguez ("we") is the developer of Ledgerlight and the data controller for personal data processed through it. We decide why and how your data is used. We do not own or operate the servers and databases the Service runs on — that infrastructure is provided and operated by Lovable (Lovable Cloud, built on Supabase), which stores and processes data on our behalf as our service provider. Our responsibility is limited to developing and operating the app itself; the running, maintenance and protection of the underlying infrastructure is Lovable's responsibility.

Data we collect and why

  • Account data (email, login credentials) — to create and secure your account (contract).
  • Finance records you enter or import (accounts, movements, categories, goals, uploaded statements) — to provide the Service (contract).
  • Device and push data (notification token, device label) — to send notifications you enable (consent).
  • Technical data (IP address, device/browser details, error logs) — security, fraud prevention and keeping the Service working (legitimate interests).
  • Support messages — to answer your requests (contract / legitimate interests).
  • AI requests you explicitly trigger (e.g. scanning a photo, asking the assistant) — sent to an AI provider only to produce the answer (contract).

We do not sell your data, show ads or use third-party advertising trackers.

Who we share it with

  • Lovable (Lovable Cloud), our hosting and database platform, which stores and runs the Service on our behalf.
  • Other service providers that run parts of the Service (push notification delivery, AI processing when you request it).
  • Paddle.com, our Merchant of Record, for the sale of the product, payments, tax compliance and invoicing.
  • Professional advisers (legal, accounting) where needed.
  • Authorities where required by law.

International transfers

Some providers may process data outside the EEA. Where they do, we rely on safeguards such as adequacy decisions or Standard Contractual Clauses.

Retention

We keep your data while your account is active. When you delete your account, or data is no longer needed, it is deleted or anonymised, except where we must keep records by law.

Who is responsible for what

Lovable operates the hosting, database, sign-in and storage infrastructure that keeps Ledgerlight running. It is responsible for the security of that infrastructure (data-centre and network security, encryption while data travels and at rest on its systems), keeping the service available and holding database backups.

The developer (Pedro Rodriguez) is responsible for the app itself: what it collects and why, how it behaves, and answering your questions about your data.

Where your data is stored and who can access it

Your data is stored in the Service's cloud database, hosted through Lovable (Lovable Cloud, built on Supabase infrastructure). We (the developer) do not own or operate the databases; Lovable operates them on our behalf. The database is encrypted at rest and all connections to it are encrypted in transit. Database-level access controls ensure each account's data is private to that account and other users cannot see it.

The developer of the Service (Pedro Rodriguez) is not the owner or operator of the database infrastructure — Lovable operates it on our behalf. The developer nevertheless has administrative access to the data and may view it where strictly necessary for operating, securing, debugging or supporting the Service (for example, when you ask for help with your account). We do not browse user data for any other purpose, and we never sell or share it with advertisers.

Security

Within the app, we use appropriate technical and organisational measures, including encrypted connections and database-level access controls so each account's data is private to that account. The underlying hosting, database and network infrastructure — including encryption at rest and data-centre security — is provided and secured by Lovable, our infrastructure provider.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, object to processing, and withdraw consent at any time. You can also complain to your supervisory authority (in Portugal, the CNPD). We respond within one month.

Cookies and local storage

We use only essential storage on your device (sign-in session, offline data, theme preference) needed for the app to work. No analytics or marketing cookies are used.