Who is responsible
Mehmet Ozyigit (trading as Velunoq). Contact: hello@velunoq.com. This notice covers Birivo; the studio website and other apps have their own notices.
Personal mode and an optional account
Without an account, your personal plan and entries stay in the app’s local storage. Device/browser backups and exports you choose are separate. Requesting a sign-in code sends your email, optional display name and session/connection information to Supabase; account emails are delivered through Spaceship/Spacemail. Creating an account alone does not upload your budget.
Shared data and its sources
Creating a family budget copies your plan, income/expense amounts and descriptions, schedules/installments, goal, currency, entries and notes to the cloud. Member identifiers and change history support access and syncing. The other member may enter information about you. Invitations store an email supplied by the inviting member; this verifies who can join. We do not access your bank or ask for card/bank credentials. Avoid identity numbers, passwords or detailed health information in free text.
Purposes and UK legal bases
We use account and budget data to provide the service you request (performance of a contract where necessary). Proportionate account security, misuse prevention and invitation verification rely on legitimate interests in operating a secure shared service. Applicable rights requests and legal obligations are handled under the relevant legal requirements. Optional marketing is not part of this processing. The application has no advertising or behavioural analytics SDK. Budget estimates do not make decisions with legal or similarly significant effects.
Who can access shared records
A member who joins sees your name/email and can view, edit and export the entire shared budget. Supabase provides hosting/authentication, Spaceship/Spacemail provides email, and authorised operational access may be needed for support or legal requirements. Access controls restrict unrelated users, but this is not end-to-end encryption or a promise that no authorised administrator or provider can access information.
International processing
The database region is Ireland. Email, security logs, support and provider subprocessors may involve other countries, including the United States or Singapore. The published Supabase DPA contains EU standard contractual clauses and a UK Addendum; supplier and transfer arrangements are reviewed for the applicable services. Database location alone is not a guarantee that all processing stays in Ireland. Contact us for information about applicable safeguards.
Retention and deletion
Active account and shared records remain while you use the service, subject to deletion requests and applicable legal requirements. Clearing local data does not clear the cloud. A deleted shared entry is hidden but currently retains a technical record; change history and expired invitations are also retained until cleanup. There is currently no active automatic 30-day cleanup promise. Open privacy requests remain until resolved. Support, provider logs and backup copies may have separate retention; ask us for the applicable details. We do not claim that every copy disappears immediately.
Security and recovery
Saving and syncing requires internet. Cloud syncing is not an independent backup of every past version. Recovery of every record, zero data loss and uninterrupted availability are not guaranteed. Regularly export important records and store them securely. This advice does not transfer our security/recovery responsibilities to you or remove your legal rights. Your earlier personal device copy is separate and does not receive shared changes.
Your rights and complaints
You can edit and export your active budget. Contact hello@velunoq.com to request access, correction, deletion, portability, restriction or to object, where applicable. Rights depend on the circumstances and governing law; identity checks are proportionate. We respond without undue delay, normally within one month under UK rules, explaining any permitted extension. You may complain to the UK ICO or your competent local authority. Requests do not require sending passwords or codes.
Changes and questions
We date this notice and explain material processing changes before introducing them. Contact us if you believe a child’s or another person’s information was shared inappropriately. This notice does not claim legal certification in every country.