Data protection
Privacy Policy
Last updated: 08/06/2026
Data controller
Olabanco is responsible for the processing carried out by Olabanco. For any question or to exercise your rights, contact contact@olabanco.com.
Data processed and purposes
| Data | Purposes | Legal basis | Retention |
|---|---|---|---|
| Identity, email address, city, and country | Create and administer the account, communicate with the user, and produce internal statistics | Performance of the service and legitimate interest in improving it | For the lifetime of the account, then deleted subject to legal obligations |
| Accounts and account numbers, transactions, budgets, categories, and imports | Provide the requested financial management features | Performance of the service | For the lifetime of the account; deleted with the account |
| Email address, hashed password, and reset tokens | Authenticate the user, enable account recovery, and check password strength | Performance of the service and legitimate interest in securing it | Hashed password for the lifetime of the account; reset tokens remain valid for one hour and are then purged |
| Technical data, IP address where applicable, sessions, and security events | Prevent abuse, diagnose incidents, and secure the service | Legitimate interest in securing the service | Limited to security needs, as specified by the hosting configuration |
Source and required nature of the data
Data is provided directly by the user or generated while they use the service. An email address and password are required to create and secure an account. Other profile information and financial data are provided according to the features used; without them, the corresponding feature may not work.
Recipients and hosting
Profile information is used exclusively to manage the relationship between Olabanco and the user and to produce internal statistics that help improve the service. It is not sold, rented, or disclosed to third parties for commercial, advertising, or prospecting purposes.
Data is accessible only to people authorized to operate Olabanco and to providers essential to the service, including the hosting and email providers. Declared hosting provider: OVHcloud VPS, Francfort; location: Allemagne.
When a password is created or changed, Olabanco may query Have I Been Pwned’s Pwned Passwords service to detect passwords known from data breaches. Only the first five characters of the password’s SHA-1 hash are transmitted over a secure connection. The password, its full hash, the email address, and profile information are never sent to this service. The result is used immediately and is not retained by Olabanco.
Olabanco does not sell data or use advertising trackers. Any new provider or transfer outside the European Economic Area must be documented and appropriately safeguarded before it is introduced.
Cookies
The service uses only technical cookies required for sessions, authentication, and form protection. Authenticated sessions expire after 30 minutes of inactivity. These cookies are not used for advertising. If non-essential trackers are introduced, your prior choice will be requested.
Your rights
You may request access, rectification, erasure, or restriction and, where the relevant conditions apply, data portability or objection to processing. Signed-in users can export their data and delete their account from their profile.
We respond within the applicable legal time limit, generally one month. You may also lodge a complaint with the French data protection authority, the CNIL.
Security and incidents
Olabanco applies measures including per-user data isolation, strengthened password hashing, account-number encryption, form protection, rate limiting, and expiration of inactive sessions. In production, communications are protected by HTTPS and technical access is restricted.
These measures reduce risk but cannot guarantee absolute security. Every incident is assessed and, where required by law, reported to the CNIL and affected individuals.
Automated decision-making
Olabanco does not make decisions that produce legal effects or similarly significantly affect users solely on the basis of automated processing.