Who processes your data
Every third party that receives any of your data, what exactly it receives, and when. Maintained from the code, not from a privacy template.
Last updated: October 30, 2026
This list was compiled by reading every outbound call in the application code on the date above. It names the service, what it receives, and under which condition. If you find an outbound call that is not here, write to info@assetli.app.
Always, for every user
| Service | What it receives | Why |
|---|---|---|
| Vercel (Frankfurt) | Every request to the app: method, path, status, timing, your IP; output of server functions (error messages) | Hosting of the application and API, scheduled jobs (daily notifications and emails) |
| Vercel Web Analytics | The page address, the page you came from, device type and your country derived from the IP address. No cookies; the visit identifier is a hash of IP and browser that is valid for a single day, so visits cannot be linked across days. Runs on the public site and in the dashboard without consent, because it stores nothing in your browser; it does not run in the mobile app | Page-view statistics |
| MongoDB Atlas (Frankfurt) | All application data | Database |
| Cloudflare R2 | Files you attach: documents, photos, receipts. They are kept in a private bucket with EU jurisdiction and no public address, and are shown only to their signed-in owner through a signed link valid for at most 15 minutes. Public reference data (price lists, statistics) comes from a separate public R2 bucket | Object storage for documents and reference data packs |
| Vercel Blob | Subscription and budget icons you upload, temporary files and previews | Small files and icons |
| GitHub | A database access credential, stored in GitHub Actions secrets for scheduled jobs (backup, daily notifications, price-list ingestion). When these jobs run, they work with the database directly, and the backup is created as a second copy of the database dump, encrypted with AES-256 before upload and kept 30 days. They have not run on GitHub since 21 October 2026 (a failed payment on the GitHub account); daily notifications are triggered by Vercel. The primary backup is on the operator’s own computer and is not sent to any third party | Backups and scheduled jobs |
| jsDelivr | Your IP and browser headers when it serves script files, like any CDN | Script delivery |
When you use the Android app
| Service | What it receives |
|---|---|
| Expo (650 Industries, Inc., USA) | Every time the app starts, it asks Expo whether an over-the-air update is available, sending the platform, the app version, the update channel and the ID of the installed update, a random installation ID created by the app (not derived from the hardware or your account) and, like any connection, your IP address. If the previous update failed to start, also a technical description of that error. No account data. Expo acts as our processor; transfers to the USA are covered by the standard contractual clauses (module 2) in Expo’s terms, and Expo states in its privacy policy that it is certified under the EU–US Data Privacy Framework. |
| Google Firebase Cloud Messaging (Google LLC, USA) | Only if you allow notifications on your phone: the device registration token, which our server stores under your account, and for each notification its title, a short text and a link to an app screen. By default the text contains no amounts (it is also visible on the lock screen); you can turn them on in Settings → Notifications. Firebase holds an undelivered message for at most one day. We send directly from our server, without the Expo push service. Transfers to the USA are covered by Standard Contractual Clauses. |
Everything else the app sends, including error reports and the anonymous tap counts of the More screen, goes to our own API, like the web. Google Play, which distributes the app, is not on this list: it handles downloads and updates from the store as a separate controller under its own policy and receives no account data from us; purchases made in the app are described under “When you pay”.
When you use the iPhone app
| Service | What it receives |
|---|---|
| Apple Push Notification service (Apple Inc., USA) | Only if you allow notifications on your iPhone: the device token, which our server stores under your account, and for each notification its title, a short text and a link to an app screen. By default the text contains no amounts (it is also visible on the lock screen); you can turn them on in Settings → Notifications. A notification that cannot be delivered expires after one day. We send directly from our server to Apple, without Firebase or the Expo push service. |
Over-the-air updates work the same way as in the Android app (Expo, above), and error reports and the anonymous tap counts of the More screen go to our own API in the same way.
The App Store, which distributes the app, handles downloads and updates as a separate controller under its own policy and receives no account data from us; purchases made in the app are described under “When you pay”.
When you pay
| Service | What it receives |
|---|---|
| Stripe | Your email, name and payment details. Card numbers never pass through Assetli. Payment records stay with Stripe under its own retention rules. |
| App Store (Apple Inc., USA) | Only if you buy a plan or AI credit in the iPhone app. Apple processes the payment as a separate controller under its own policy; your card details and your Apple ID stay with Apple. We give Apple only a pseudonymous identifier derived from your account ID (a UUID, not your email or name) so that the purchase can be matched to your account, and receive back the transaction identifiers, the product, the subscription status and the renewal date. A subscription bought through the App Store can only be cancelled in your Apple account settings — deleting your Assetli account does not cancel it. |
| Google Play (Google LLC, USA) | Only if you buy a plan or AI credit in the Android app. Google processes the payment as a separate controller under its own policy; your card details and your Google account stay with Google. We give Google only a one-way hash of your account ID (not your email or name) so that the purchase can be matched to your account. Our server then verifies the purchase with Google using its token (which it stores encrypted) and receives back the order identifier, the product, the subscription status and end date, the country and the price. When you delete your Assetli account, our server stops the subscription from renewing at Google. |
When Assetli emails you
| Service | What it receives |
|---|---|
| Resend | Your email address, the subject and body of the message, and its language. A notification email carries the same text as the in-app notification, so a budget alert includes the amounts it mentions. In return, Resend tells us the delivery status of each email (delivered, undeliverable, complaint); after a permanent delivery failure or a complaint we only send that address emails you ask for yourself (password reset, address verification) and account security e-mails. The new sign-in e-mail also carries the device (type, browser, operating system), the approximate country and the time of the sign-in. |
What we keep about sent emails ourselves (a log without the message text, 400 days), how to unsubscribe with one click and when tips by email are sent is described in Notifications and emails.
When you sign in or send a form
| Service | What it receives |
|---|---|
| Your Google account identity if you sign in with Google. On the sign-in, sign-up, contact and roadmap forms, reCAPTCHA sends Google browser signals to tell humans from bots. | |
| Facebook (Meta) | The sign-in page does not offer Facebook sign-in. Meta would receive your Facebook account identity only with such a sign-in. |
| Sign in with Apple (Apple Inc., USA) | Only if you sign in with Apple: Apple gives us your Apple ID identifier, your email address (or a relay address if you hide it) and, the first time only, your name. Our server exchanges the sign-in code for tokens at Apple and stores the refresh token encrypted — it is used only when you delete your account, to tell Apple to revoke the link. |
On the website, after cookie consent
| Service | What it receives |
|---|---|
| Google Analytics | Page views and interactions on the website; one sign-up event sent by our server, only with analytics consent |
| Microsoft Clarity | Page views and session recordings on the website |
| CookieHub | Your consent choice |
| Better Stack | Loads the status page embedded at /status. The status line in the footer asks our server, not Better Stack — your browser never contacts it |
| Google Fonts | Your IP and browser headers when the browser downloads web fonts |
None of these see API traffic or the MCP connection.
When you use AI features
| Service | What it receives | Which feature |
|---|---|---|
| Anthropic | Your messages, the financial snapshot of the active profile and the results of the tools the model calls | In-app assistant, weekly review |
| Anthropic | Description and merchant of uncategorised transactions | AI categorisation (opt-in) |
| Anthropic | The header row and a few sample rows of a CSV, never the whole statement | Assisted column mapping on import |
| Anthropic | The whole scanned statement (PDF), only when you explicitly confirm the transcription for that specific file | Transcription of a scanned statement on import |
| Anthropic | The listing text, the facts extracted from it and the protocol; optionally a scanned zoning plan you chose to have read | Property check |
| Anthropic | Your inputs to the planner | Vacation planner suggestions |
| Anthropic | The whole PDF you upload — an energy bill, a price list or contract, or a supplier’s offer — only when you upload it yourself; only prices, consumption and tariff details are kept, the file is not stored | Energy price comparison |
| Anthropic | At most the first 2,000 characters of text you paste (e.g. an online-shop order); the text is not stored | Importing valuables with AI |
| Anthropic | Text you paste (a broker statement, a trade confirmation e-mail, a table) or a trades file that no other import could read — at most 20,000 characters; neither the text nor the file is stored, only the trades you confirm in the preview | Smart trade import (stocks, ETFs, crypto) |
| Anthropic | The name, category, condition and age of the item and the additional details you write for the listing; for the listing description also your notes on the item. For the price estimate the model also searches the web for comparable offers (Anthropic’s web search) | Listing and market price estimate for a valuable |
| Anthropic | The title and text of feedback or a feature suggestion you send through the form on the website | Automatic translation of feedback into the other languages |
| OpenAI or Google | The same data as the in-app assistant or AI categorisation sends to Anthropic, only if you entered your own API key for that provider and the Assetli budget is exhausted | In-app assistant and AI categorisation with your own key |
In the mobile app, AI features run only after you consent to sharing data with AI; you can withdraw it in Settings → Privacy & Data.
The MCP connection sends nothing to any AI provider from our side. Your AI client (Claude, ChatGPT, Gemini) receives the tool results directly; see Security and data flow.
Outside the app’s features: the operator uses an AI coding assistant from Anthropic for development and fixes. Checking scripts run against the production database, so their output may be processed by Anthropic as a processor; see Known limitations.
Market data
| Service | What it receives |
|---|---|
| Alpha Vantage, Tiingo, Twelve Data, Yahoo Finance, Finnhub, EOD Historical Data, Marketstack | Ticker symbols of the stocks and ETFs you hold. Never quantities or values. |
| CoinMarketCap, CoinGecko | Symbols of the cryptocurrencies you hold |
| frankfurter.app | Currency codes, for ECB exchange rates |
Fuel and electricity prices for the vehicle calculator are static tables in the application; no query is made.
Only if you switch it on
| Service | What it receives |
|---|---|
| Wallet by BudgetBakers | The Wallet API token you pasted, on every sync. Assetli reads your Wallet records and never writes to Wallet. |
| Resend (Email import) | The messages you send to your secret address: sender, subject, body and the statement attachments. It keeps a copy of each message, attachments included, for 30 days and does not allow earlier deletion. Assetli reads the attachment in memory and does not store it. |
| Claude, ChatGPT, Gemini (MCP) | Results of the tools your AI client calls, under the scope you granted |
When you run a property check
These sources are queried only during a check, with the minimum needed to answer one question. The listing portal itself is never contacted by the server.
| Source | What it receives |
|---|---|
| OpenStreetMap Nominatim and Overpass | The address, to obtain coordinates; the coordinates, to list amenities around the point |
| Wikidata | The municipality name, for demographics |
| ČÚZK (RÚIAN, ArcGIS) | The address and parcel identification |
| SPÚ (BPEJ), ČGS (radon, landslides), HEIS VÚV (floods), IPR Praha (noise), NGÚP (zoning) | The coordinates of the point |
| ARES | The name of the owners’ association or company and the street |
| ISIR insolvency register | The seller’s name and date of birth, or company ID, as you typed them. The birth number is never sent and cannot be entered. |
A check run without an account is cached for 7 days by a fingerprint of the listing text, so the same listing pasted by ten people is analysed once.
What is not on this list
No error-tracking service, no advertising network, no data broker, no bank API. There is no server-side fetching of listing pages.