Privacy Notice

• Account data: name, email address and login credentials. Used to create and secure your account and to identify you to the members of your groups. Legal basis: performance of our contract with you.
• Group and expense data: group names and types, member names and email addresses you invite, expense amounts, currencies, categories, dates, notes, split details, settlements, budgets, saved card reward categories and receipt images you upload. Used to provide the shared ledger and budgeting features. Legal basis: performance of our contract with you.
• Support messages: what you write to us and our replies. Used to answer you and improve the product. Legal basis: contract and legitimate interests.
• Usage and technical data: device and browser information, IP address, log and error data, and basic feature usage. Used to keep the service secure, prevent fraud and abuse, diagnose faults and improve the product. Legal basis: legitimate interests.

Expenses, split shares, balances, notes and receipts you add to a group are visible to the other members of that group, along with your name. Balance reminders are sent privately to the person who owes and are not shown to the rest of the group.

• Subprocessors: Supabase (database, authentication and file storage), Cloudflare (hosting and edge infrastructure) and Lovable (transactional email delivery), each acting on our instructions and only for the purposes described in this notice.
• Professional advisers: legal, accounting or tax advisers where needed.
• Authorities: where we are required to disclose by law or to protect legal rights or safety.

We do not sell your personal data or share it for advertising.

Our providers may process data in the United States and other countries. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.

We keep account, group and expense data for as long as your account is active, so your shared history stays intact for the other members. If you delete your account, we delete or anonymise your personal data within 90 days, except records we must keep longer for tax, accounting or legal reasons. Error and log data is kept for a short period, normally under 12 months.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to certain processing, or provide it in a portable format. You can withdraw consent where we rely on it, and you can opt out of non-essential emails at any time. If you are in the UK or EEA you also have the right to complain to your supervisory authority. We respond to requests within one month.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encrypted storage, row-level access rules so members only reach data from their own groups, hashed credentials, leaked-password checks and least-privilege access to our systems. No system is perfectly secure, but we take this seriously and will notify you and the relevant authority where the law requires it.

Slighe uses only essential cookies and browser storage, to keep you signed in, remember your session and keep the app secure. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings, though signing in will not work without the essential ones.

Slighe is not intended for children under 16. If you believe a child has given us personal data, contact us through the Help page and we will delete it.

If we update this notice we will change the date at the top of this page and, for significant changes, tell you in the app.