Polityka prywatności

This Privacy Policy explains how Royal Payment Solutions, LLC (“we”, “us”) processes personal data in RoyalWallet, the personal finance app at royalwallet.money, and on royalpaymentsolutions.com. We apply the EU General Data Protection Regulation (GDPR) as our standard everywhere and also respect the privacy laws of the US states and Canada where our users live. The demonstration environment at test.getroyalpay.com has its own privacy notice, shown there.

1. Controller and contact

Royal Payment Solutions, LLC, business and mailing address 1209 Mountain Road Pl NE, #4679, Albuquerque, NM 87110, USA, telephone +1 505-218-5574. Privacy contact: info@royalpaymentsolutions.com. Our Chief Compliance Officer is responsible for data protection.

2. Data we process

• Account data: email address, password hash (Argon2id; we never store the password itself), language, two-factor authentication settings, and the time of registration and last sign-in.
• Profile and settings: the display name you choose, home currency, the day your budget month starts, the privacy blur setting, and the optional text you add to payment reminders for shared expenses.
• Financial data you add: accounts (name, type, currency, opening balance and, for connected accounts, the institution and the last four digits shown by the bank), transactions (date, amount, currency, payee, description, category, notes and tags), budgets, savings goals, bills and subscriptions, spending vows, rules and categories you create.
• Statement files: files you upload are read on our server. Their contents are kept as a preview for up to 24 hours so you can check them, and are then deleted. Only the transactions you confirm are saved in your account.
• Shared expenses: the names or nicknames you enter for people you share costs with, the amounts and notes. We never contact these people.
• Bank connections (when available on your plan): the access token issued by the bank data provider (stored encrypted), the connection identifiers, the date your consent ends and the status of each synchronisation, together with the balances and transactions received. We never receive your bank sign-in details.
• Receipts: photos or PDF files you attach to a transaction yourself. Photos are saved again as a JPEG, which removes location, camera and any other embedded details; PDF files are stored as you upload them. A receipt can show items you bought and the shop’s details, so attach only receipts you want to keep here.
• Royal Advisor: the loans and other regular repayments it found in your transactions (payee, kind of debt, usual payment, dates and how sure it was) and your answer to each one; the debts you keep in Debt Siege (name, kind, balance, rate and payment, if you enter them). The habits, standing and answers Royal Advisor shows are calculated when you open the page and are not stored.
• Royal Advisor conversations (King plan): the questions you type, the answers, the date you agreed to use it, and the summary of figures sent with each question (monthly totals, spending per category, habits, debts, goals and your few largest payments as date, amount and category, in your home currency). The summary never contains your name, email address, account or card numbers, the payee of any transaction, or health and donation spending. A category name you typed yourself is sent only if it passes the content rules described in section 3; otherwise it is sent as “Other”.
• Invitations: your invitation code; who invited you, if anyone; for each friend you invited, the date they joined and whether they qualified; the free months you earned. To prevent abuse we keep a keyed hash of the network address used to sign up, never the address itself, for 30 days.
• Interest and waitlist: features you asked to be told about, and, if you have no account, the email address and language you gave us for that purpose.
• Royal Giving: your vote.
• Support: the topic, subject and messages of your support requests, our replies, and the IP address used to send them.
• Job applications (royalpaymentsolutions.com/careers): what you send us when you apply, such as your name, contact details, CV and messages.
• Site statistics: for each page view, the page, language, the host name of the site that linked to it, campaign parameters in the link, the type of device, and a visitor code that is a hash of IP address and browser keyed with a random value changed every day and then destroyed. We cannot link the code to a person or to visits on another day. App use is counted per feature and day, never per member.
• Business enquiries (royalpaymentsolutions.com): name, organisation, role, work email, country, type of enquiry and message, the page language and IP address.
• Security data: IP address and time of sign-ins and security-relevant actions (audit log), rate-limiting records.
• Server logs: IP address, date and time, requested address, referrer and browser type.

Transactions can show where you shop, eat or donate. We use them only to give you the Service. We do not analyse them to learn about your health, religion, political views, sexuality or other special categories of data, and we do not build profiles for anyone else. Royal Advisor deliberately leaves health and donation categories out of its habit analysis.

3. Purposes and legal bases

• Providing RoyalWallet, including imports, bank connections you request, automatic categories, budgets, bill detection, the bill calendar, merchants, insights, the cash-flow map, receipts you attach and reports: performance of our contract with you (Art. 6(1)(b) GDPR).
• People you add to shared expenses: our and your legitimate interest in letting you keep track of shared costs (Art. 6(1)(f) GDPR). The data stays in your account and is deleted with it.
• Security, abuse prevention and the audit trail: legitimate interests in protecting the Service and its users (Art. 6(1)(f) GDPR).
• Support requests and complaints: performance of the contract (Art. 6(1)(b) GDPR) or, for people without an account, our legitimate interest in answering them (Art. 6(1)(f) GDPR).
• Business enquiries: your consent given in the form (Art. 6(1)(a) GDPR) and our legitimate interest in replying to business contacts (Art. 6(1)(f) GDPR).
• “Tell me when it is ready” and the waitlist: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by email; this does not affect messages already sent.
• Royal Advisor (finding loans, reading spending habits, the payoff planner and the forecast): performance of our contract with you (Art. 6(1)(b) GDPR), as these are features of the app you use. This is profiling within the meaning of Art. 4(4) GDPR, done only for you and shown only to you. You can switch Royal Advisor off at any time in Settings; it then stops, and the findings you have not answered are deleted.
• Royal Advisor conversations (King plan): performance of our contract with you (Art. 6(1)(b) GDPR). The conversation starts only after you agree on the Royal Advisor page that your questions and the summary of your figures are sent to an AI model provider. You can stop at any time; your conversation is then deleted.
• Invitations and free months: performance of the invitation terms you accept by taking part (Art. 6(1)(b) GDPR); the network hash and review of suspicious sign-ups: our legitimate interest in preventing abuse of the programme (Art. 6(1)(f) GDPR).
• Site statistics: our legitimate interest in knowing how our sites are used and which campaigns work (Art. 6(1)(f) GDPR). Nothing is stored on or read from your device. If your browser sends Do Not Track or Global Privacy Control, you are not counted.
• Job applications: steps before a possible employment or service contract (Art. 6(1)(b) GDPR); keeping your application for future roles only with your consent (Art. 6(1)(a) GDPR).
• Keeping records the law requires, for example for tax once paid plans open: legal obligation (Art. 6(1)(c) GDPR).

We do not sell personal data, do not show advertising and do not make decisions with legal or similarly significant effects about you by automated means (Art. 22 GDPR). Automatic categories, Royal Advisor’s findings and estimates only affect what you see in your own app; they are never used to decide on credit, prices or access to anything, and they are never shared. Royal Shield and Royal Advisor Mini run entirely on our own servers. Only when you start a conversation with the full Royal Advisor on the King plan is the summary described in section 2 sent to an AI model provider; your transactions themselves, with payees, are never sent to any outside analysis or AI provider.

Before a question is sent, our servers check it, and every answer, against Royal Advisor’s content rules (no sexual, pornographic or otherwise indecent content, no hate or harassment, no graphic violence; see section 3 of the Terms of Use). The check is done by fixed word lists on our own servers, not by a person and not by another AI. A question that fails it is not sent to the provider and is not stored; we keep only a count of refused questions for the current day, to apply the daily limit, and delete it after 24 hours. The provider’s own safety filters are also switched on for every request. These checks only decide whether a message is answered; they have no other effect on you. We do not use staff hiring tools that make automated decisions.

Live demo. If you open the demo, we create a temporary demo account filled with sample data; you do not enter an email address or password. We use your IP address only to limit how many demos can be opened from one connection, on the basis of our legitimate interest in keeping the service available (Art. 6(1)(f) GDPR), and delete that record within 24 hours. The demo account and anything you type into it are deleted when you log out, and otherwise automatically no later than 48 hours after the demo was opened. Please do not enter real personal data in the demo.

4. Cookies and local storage

We use only strictly necessary cookies: rpsid (session and sign-in; it ends with the session or after 2 hours of inactivity) and _rs (protection against cross-site request forgery). When you choose the light or dark look in Settings or at the foot of our pages, a cookie rp_theme remembers that choice for 12 months; it holds only the word “light” or “dark”, is set only when you make the choice, and is strictly necessary to provide the look you asked for (Art. 5(3) of the ePrivacy Directive). Your browser also keeps two small notes in local storage: whether you switched the privacy blur on (rp-blur) and the date the payday greeting was last shown (rp-payday), so it appears once per payday. Neither leaves your device. Our site statistics use no cookies and no device storage, and we use no advertising cookies, so no consent banner is needed.

5. Recipients

• Service providers who process data on our behalf under data processing terms: our hosting provider (virtual servers) and our email provider, and, for Royal Advisor conversations on the King plan, an AI model provider in the United States, which processes your question and the summary of your figures only to write the answer.
• Bank data providers, once live bank connections open: regulated account information providers that handle your bank sign-in and consent under their own privacy notices. We will name each one here before the first connection.
• Authorities, only where the law requires it.

When paid plans open, the payment provider we use will be named here before the first payment is taken.

6. International transfers

We are a US company managed from the European Union. Data is processed in the EU and, where a provider is based there, in the United States. Where GDPR requires it for transfers to countries without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, or the EU-US Data Privacy Framework where the recipient is certified under it.

7. How long we keep data

• Your account and everything in it: until you delete the account. Accounts unused for 24 months are deleted after an email notice sent at least 30 days in advance.
• Statement previews: up to 24 hours.
• Receipts: until you delete the receipt, its transaction, the account it belongs to or your membership. The file is removed at once or, at the latest, by the daily clean-up within 24 hours. Receipts are never sent to an AI provider or to anyone else.
• Royal Advisor findings and your answers, and Debt Siege: until you delete them, switch Royal Advisor off (unanswered findings) or delete your account.
• Royal Advisor conversations: 90 days from each message, or earlier when you clear the conversation, stop using it or delete your account. The AI model provider keeps prompts only as long as its terms for paid services allow for abuse monitoring and does not use them to train its models.
• Transactions older than your plan shows: kept in your account and unlocked when you move to a plan that shows them. You can delete them yourself at any time under Settings, and they are always included in your data export.
• Invitations: the record of who invited whom and the free months, while either account exists; the network hash for 30 days after sign-up.
• Site statistics: up to 400 days. The daily key behind visitor codes is destroyed at the end of each day.
• Job applications: six months after the role is filled; 18 months if you agreed that we may consider you for future roles.
• Demo accounts: deleted when you log out of the demo, and otherwise automatically no later than 48 hours after the demo was opened.
• Bank connections: the access token is deleted, and the provider is asked to end the connection, when you remove it or delete your account. You choose whether the transactions it brought in stay.
• Web server logs: up to 14 days; application error logs: up to 90 days; audit log entries: up to 24 months.
• Support requests: deleted three years after they are closed, so that complaints can be evidenced.
• Business enquiries: up to 24 months, unless they lead to a contract.
• Waitlist and “tell me when it is ready” requests: until we have sent the message you asked for, or you withdraw consent.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to complain to a supervisory authority, in particular in the EU member state where you live. In the app you can export all your data (JSON or CSV) and delete your account under Settings at any time; for anything else, email us and we answer within one month. Residents of US states with privacy laws have comparable rights to know, correct and delete their data and not to be discriminated against for using them; we do not sell or share personal data for cross-context behavioural advertising. Residents of Canada can access and correct their personal information under PIPEDA and complain to the Office of the Privacy Commissioner of Canada; residents of Quebec also have the rights given by Quebec’s private-sector privacy law and can complain to the Commission d’accès à l’information.

9. Security

Encrypted connections (TLS, HSTS), Argon2id password hashing, optional two-factor authentication (TOTP), protection against cross-site request forgery, a strict Content Security Policy, bank access tokens encrypted at rest (XSalsa20-Poly1305) with a key kept outside the database, rate limiting, least-privilege access and an audit trail. No method of transmission or storage is completely secure; if a breach affects you, we will tell you as the law requires.

10. Children

RoyalWallet is for people aged 18 and over. We do not knowingly collect data from children.

11. Changes

We publish changes here with a new date and announce material changes in the app. Changes of 21 October 2026: Royal Advisor’s content rules and how they are checked (section 3); a fuller description of the summary sent with Royal Advisor questions; the rp_theme cookie for the light or dark look; receipts you can attach to transactions (sections 2, 3 and 7); the merchants page, the bill calendar, the cash-flow map and the weekly summary, which are calculated from the data you already keep and add no new categories of data. Changes of 17 October 2026: Royal Shield (loan detection, every plan) and Royal Advisor Mini (Duke) are rule-based on our own servers; the full Royal Advisor on King is an AI model that you choose to use, with conversations kept for 90 days; Royal Advisor became active (loan detection for every plan, habits and answers on Duke and King), with Debt Siege, Royal Forecast and the Treasury; invitations with free months; cookieless site statistics; job applications.