Data & Compliance

Scope and relationship to our policies

This Data & Compliance notice supplements the Privacy Policy and Terms of Use. The Privacy Policy describes the personal information we process and the choices available to you. This notice describes the controls we use to govern that processing. If the documents conflict about personal information, the Privacy Policy controls.

Data-governance principles

We design and operate Wallexa around these principles:

• Purpose limitation: we use information for the purposes described when it is collected.
• Data minimization: we collect only what the feature reasonably needs.
• User control: profile editing, expense deletion, permission controls, and account deletion are available to users.
• Access control: authenticated access is restricted by ownership and group membership, not merely by possession of an app account.
• Retention limitation: data is deleted or de-identified when it is no longer needed, subject to legal, safety, fraud-prevention, and backup obligations.
• No sale or targeted advertising: we do not sell personal information or use it for cross-context behavioral advertising.

Security controls

• TLS protects data in transit and our infrastructure providers encrypt stored data at rest.
• Database row-level security and storage policies restrict access to user-owned or authorized group data.
• Privileged server operations authenticate the caller and validate authorization before acting.
• Purchase tokens are stored as cryptographic hashes, and Google Play purchases are verified server-side before Premium access is granted.
• Release checks scan for unsafe permissions, exposed secrets, missing data policies, and dependency vulnerabilities.
• Administrative access is limited to authorized operational needs.

No service can guarantee absolute security. We investigate suspected incidents and will notify affected people and regulators when applicable law requires it.

Service providers and international processing

Current providers include Supabase, Vercel, Google Play, and Twilio where SMS authentication is enabled. Google Gemini handled historical voice processing; new processing is disabled. Providers operate under their applicable terms and data-processing arrangements, including their own security and billing purposes.

Information may be processed outside your country. Where applicable, we rely on recognized transfer mechanisms and contractual safeguards provided by our vendors. Contact us for information relevant to your location.

Retention and deletion

• Account and profile data is retained while the account is active.
• Account deletion removes private wallet/expense records, authored chat and uploads. Shared financial records retain their amounts and confirmation states under “Deleted user”; referenced private contacts lose their contact details. Remaining members keep access to shared groups and records. See the Privacy Policy for the scope and limits of this de-identification.
• Voice files remain while needed for the corresponding expense or until deletion.
• Purchase and security records may be retained as needed for subscription verification, fraud prevention, disputes, tax, and legal compliance.
• Safety reports may be retained to investigate abuse, protect users, and document enforcement decisions.
• Residual encrypted backups may persist for a limited cycle before secure expiry.

You can request full account deletion in Account → Delete Account or at https://split-audiv-wallet.vercel.app/delete-account.

Privacy rights and requests

Depending on where you live, you may have rights to know or access, correct, delete, restrict, object, or receive a portable copy of personal information. You may also have a right to complain to your local data-protection authority. We do not discriminate against users for exercising privacy rights.

Email ans991998@gmail.com to make a request that is not available in the app. We may verify your identity and authority before disclosing or changing data. We will respond within the period required by applicable law.

Payments, AI, and automated processing

Google Play processes subscription payments. Wallexa receives purchase status and identifiers needed to verify access, but not your complete payment-card details.

New voice processing is disabled. Historical AI output may be inaccurate and must be reviewed. Wallet balances and transfers are bookkeeping entries, not custody or movement of money. Wallexa does not make automated legal, employment, lending, insurance, or similarly significant decisions about you.

Contact and updates

The operator is Ans Mahmood. Questions about data governance, security, or compliance can be sent to ans991998@gmail.com. We may update this notice as our controls or legal obligations change and will post the current version here.