Privacy Notice

This Privacy Notice explains how eBuildersLabs ("we", "us"), which operates the Esgrey Alliance financial workspace ("the Service"), handles personal data. eBuildersLabs is the data controller for the personal data described here and decides why and how it is processed.

1. Personal data we collect

• Account data — name, email address, login credentials or OAuth identifier, workspace name, currency and locale preferences.
• Financial workspace content you enter — wallets and account labels, transactions, budgets, savings goals, recurring rules, purchase requests, comments and weekly review notes.
• Relationship data — invitations you send, the people you invite into a workspace, and the permissions you grant them.
• Support and communications — messages you send us and their contents.
• Technical and usage data — IP address, device and browser identifiers, log timestamps, pages used, and error diagnostics.

Card and billing details are collected and processed by Paystack, our payment processor (a PCI-DSS Level 1 certified provider), not by us. We never see or store your full card number. We receive only the subscription status and non-sensitive order metadata we need to provide your plan.

2. Why we use it, and our legal basis

• Creating and running your account and workspace — performance of our contract with you.
• Providing the Service (storing your financial records, generating reports, running scheduled recurring entries, sending in-app notifications) — performance of our contract.
• AI features (briefings, summaries, coaching) — performance of our contract; workspace content is sent to our AI processor only to generate your requested output.
• Security, abuse and fraud prevention — legitimate interests in keeping the Service safe.
• Product improvement and aggregate analytics — legitimate interests in improving the Service.
• Customer support — performance of our contract and legitimate interests.
• Marketing emails — your consent, withdrawable at any time.
• Accounting, tax and legal records — compliance with a legal obligation.

3. Who we share data with

• Service providers / subprocessors — cloud hosting and database providers, authentication, email delivery, AI model providers and error monitoring, all acting on our instructions.
• Paystack, our payment processor, for taking payments, managing recurring subscriptions and issuing receipts.
• People you invite — anyone you add to your workspace sees the data your chosen permissions allow. You control and can revoke this at any time.
• Professional advisers — legal and accounting advisers, where necessary.
• Authorities — where required by law or to protect legal rights.

We do not sell personal data.

4. International transfers

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

We keep account and workspace data for as long as your account is active. If you delete your account or ask us to erase it, we delete or anonymise your personal data within 90 days, except records we must keep for legal, tax or dispute-resolution purposes. Backups age out on their normal cycle.

6. Your rights

Subject to applicable law, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests or withdraw consent at any time. We respond within one month. If you are in the UK/EEA you may also complain to your local supervisory authority.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest with our hosting provider, row-level access rules that scope data to your workspace, role-based permissions and access logging. No system is perfectly secure, but we review these measures regularly.

8. Cookies

We use essential cookies and local storage to keep you signed in and hold your workspace preferences; these are required for the Service to work. Where we use analytics or marketing cookies we ask for your consent first, and you can change your browser settings at any time to block or delete cookies.

9. Children

The Service is not intended for children under 16.

10. Contact

For any privacy question or to exercise your rights, contact eBuildersLabs at ebuilderslabs@gmail.com. Billing and order enquiries are handled by eBuildersLabs directly at the same address.