Global Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains how Gleapinn Ltd collects, uses, shares and protects personal information when you use the Gleapinn app and the website at gleapinn.app (together, the "Service"). It applies wherever you live. Sections 13 and 14 add information for people in the United States and for people whose data is covered by UK data protection law.

1. Who we are

The Service is operated by Gleapinn Ltd ("Gleapinn", "we", "us", "our"), a company incorporated in England and Wales.

• Company number: 17224039
• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• ICO registration number: ZC170204
• Privacy contact: privacy@gleapinn.app

Gleapinn Ltd is responsible for the personal information described in this policy (in UK and EU terms, it is the "controller"). The read-only link to your card is provided by Plaid Inc., which handles some of your information under its own privacy policy (Section 4).

2. The short version

• Read-only. When you link a card, we receive transaction information. We never receive your banking username or password, we do not store your balances, and we cannot move money.
• Amounts are never shared. We use amounts only to run features for you. They are never shown to your Friends or anyone else.
• Private by default. Every brand starts private. Your Friends see a brand only after you choose to share it. You can stop sharing it at any time.
• No selling, no ads. We do not sell your personal information, we do not share it for targeted advertising, and we do not use it for advertising.
• You're in control. You can download your data, unlink cards, change what you share, turn crash reporting on or off, and delete your account, all in the app.

3. Information we collect

3.1 Account and profile information

When you create an account, we collect your email address. We also collect the profile information you choose to provide: your display name, handle, profile image, preferred language and default currency.

You can sign in with Sign in with Apple, Sign in with Google, or a one-time link sent to your email. If you use Apple or Google, we receive the email address that provider shares with us, which for Apple may be a private relay address, and the name you have allowed it to share. We never receive your Apple or Google password.

We keep a record of your acceptance of our Terms of Service, including which version you accepted and when.

3.2 Card and transaction information (through Plaid)

If you choose to link a debit or credit card, Plaid gives us read-only access to that card's transactions. We receive and store:

• Card details: the last four digits of the card number, the card's name as your bank describes it, the card type and the name of your bank. We use these to identify the card to you. We never receive or store your full card number.
• Transactions: the date, amount and currency; the name of the business (which we match to a brand); the category; the payment channel (for example, online or in person); and, where your bank provides them, the business's location (such as city, postal code and map coordinates), the names of other parties to the transaction and payment reference details.

Plaid may also return account balances while the link is set up. We discard them immediately and do not store them.

Transaction information can reveal sensitive things about you, such as your health, religion or political views (for example, a payment to a pharmacy, a place of worship or a campaign). We use transaction information only to provide the Service to you, as described in Section 5. We do not use it to infer or build profiles about these characteristics.

3.3 Friends and social activity

To provide the social side of the Service, we process:

• your Friends, and the invitations you send, receive and accept, including through invitation links and QR codes;
• the Circles you create to filter your Friends;
• your social activity, such as posts about brands you share, how you respond to your Friends' activity, and the notifications these generate; and
• your notification settings, including which notification categories you receive and which Friends you have muted.

3.4 Sharing choices and consent records

We record your per-brand sharing choices, meaning which brands you share and which you keep private. This makes the Service behave as you decided, and makes it take effect when you stop sharing.

We also keep a record of the consents you give and withdraw, including which version of this policy was in effect at the time. These include:

• your acceptance of the Terms;
• your consent when you link each card (Section 4); and
• your choice about crash reporting (Section 3.6).

3.5 Device permissions

The app asks your device for permission before it uses the following features. You can change these permissions at any time in your device settings.

• Camera: used only to scan a Gleapinn invitation QR code. The camera image is processed on your device to read the code. We do not store or upload it.
• Photos: used only if you choose a profile image from your photo library. We upload only the image you select.
• Notifications: if you allow notifications, we store a push token and your device's name so that we can send notifications to that device.

We do not access your device's location, contacts, microphone or biometric data.

3.6 Diagnostics

• Crash reports: sent only if you turn crash reporting on. They include the app version, device type, operating system and technical details of the error. You can turn this off at any time in Settings › Privacy & Data. We work to keep your financial and social content out of crash reports.
• Security and service logs: our hosting providers keep standard technical logs when your device connects to the Service, such as IP address, time and request details. We use them to keep the Service secure and working.

We do not use advertising identifiers. We do not track you across other companies' apps or websites, and we do not currently collect product analytics in the app. If we ever start, we will update this policy first and ask for your consent where the law requires it.

Some of your own data may be cached on your device in encrypted form so the app works quickly. It is removed when you sign out or delete your account.

3.7 Subscription information

If you buy Gleapinn Unlimited, the purchase is handled by the Apple App Store or Google Play and recorded by our subscription provider, RevenueCat. We receive your subscription status, meaning which plan you have, whether it is active, and when it renews or ends. We never receive your payment card number or payment credentials.

3.8 Communications with us

If you email us, we keep your message, your email address and our reply so that we can help you and keep a record of the conversation.

3.9 Website

When you visit gleapinn.app, our hosting provider processes standard technical information, such as your IP address, browser type and the pages you request, to deliver and protect the site. We also use Vercel Web Analytics to count visits to the website in aggregate: which pages are viewed, the referring site, and your country, browser, operating system and device type. It does not use cookies, and it does not identify you or follow you across other websites. It measures the website only, not the app. The website does not use advertising cookies.

4. How we use Plaid

Gleapinn uses Plaid Inc. ("Plaid") to link to your card and to collect transaction information from your financial institution.

By linking a card, you grant Gleapinn and Plaid the right, power and authority to act on your behalf to access and transmit your personal and financial information from your financial institution. You agree to your personal and financial information being transferred, stored and processed by Plaid in accordance with the Plaid End User Privacy Policy.

What this means in practice:

• Plaid, not Gleapinn, handles your bank sign-in. Depending on your bank, you sign in through Plaid's interface or through your bank's own interface. Gleapinn never sees or stores these credentials.
• Plaid collects information from your bank, such as account details and transactions, and passes to us only what we need to provide the Service (Section 3.2).
• Plaid also uses your information for its own purposes, as described in its End User Privacy Policy. These include operating, securing and improving its services and preventing fraud. Plaid's handling of your information is governed by its policy, not by ours.
• Your consent is recorded. Before the link is made, Plaid shows you its own consent screen. When the link is complete, we record your consent against your account, with the date and the version of this policy then in effect.
• You can end the link at any time: in the app by unlinking the card, through your bank, or through Plaid's consumer portal at my.plaid.com, where you can also see and manage the information Plaid holds about you.

5. How we use your information

We use your information to:

1. provide the Service: create and run your account, sign you in, link your cards, organize your transactions into brands and categories, and show you your own activity, including amounts, which only you can see;
2. run sharing: show a brand to your Friends when you choose to share it, without amounts (Section 6), and ask you to review new brands;
3. connect you with Friends: process invitations and Circles, and deliver notifications you have not turned off;
4. manage your subscription and the extra cards it unlocks;
5. keep the Service safe and working: prevent abuse and fraud, secure accounts, and diagnose and fix faults (including through crash reports, if you allow them);
6. communicate with you: send sign-in links, service and security messages, and replies to your requests; and
7. meet legal obligations, and establish, exercise or defend legal claims.

We do not use your information for advertising. We do not sell it. We do not use your transaction information to make decisions about you that have legal or similarly significant effects, such as decisions about credit, insurance or employment.

6. How sharing with Friends works

• Every brand starts private. A private brand is not visible to your Friends.
• When you share a brand, your Friends can see that you use it, and patterns such as how often, never the amounts.
• Recent activity only. Your Friends see activity for a shared brand from the last 90 days.
• Stopping sharing. When you stop sharing a brand, your Friends can no longer see it, including your past activity with it. The activity is not deleted. It stays in your account. If you share the brand again, your Friends can see your activity with it from the last 90 days again.
• Profile. Your Friends, and people you invite or who invite you, can see your display name, handle and profile image.

Amounts never appear to your Friends anywhere in the Service, whether or not a brand is shared.

7. Who we share information with

We share personal information only as follows:

• With your Friends: only what you choose to share, as described in Section 6.
• With Plaid: to set up and maintain the link to your card (Section 4).
• With service providers: companies that host, secure and deliver the Service for us. They are bound by contract to use your information only to provide services to us, and to protect it. They are listed in Section 10.
• With Apple and Google: if you sign in with them, buy a subscription through their stores, or receive push notifications, which pass through their notification services. Their own privacy policies apply.
• For legal reasons: where we reasonably believe it is necessary to comply with the law, legal process or a lawful request from a public authority; to enforce our Terms; or to protect the rights, safety or property of our users, the public or Gleapinn.
• In a business transaction: if Gleapinn is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction. It will stay subject to this policy, or we will tell you before it becomes subject to a different one.
• With your direction: in any other case, only when you ask us to or agree to it.

We do not sell your personal information or share it for cross-context behavioral advertising. We do not disclose aggregated or de-identified information derived from your transactions to anyone outside Gleapinn. If that ever changes, we will update this policy, and ask for your consent where the law requires it, before the change applies to you.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

Deleting your Gleapinn account does not delete information held by Plaid under its own policy. You can manage that at my.plaid.com.

9. Where your information is stored and transferred

Your account, social and transaction information, and crash reports if you allow them, are stored on infrastructure in the United States.

Gleapinn Ltd is a UK company, and some of our providers and team members may access information from other countries, including the United Kingdom. When personal information covered by UK data protection law is transferred to the United States or another country, we use appropriate safeguards. These include the UK Extension to the EU–US Data Privacy Framework (where a provider is certified under it) and the UK International Data Transfer Agreement or Addendum. You can ask for details of these safeguards at privacy@gleapinn.app.

10. Our service providers

We will keep this list up to date.

11. Security

We protect your information with technical and organizational measures, including:

• encryption in transit and at rest;
• encryption of the tokens that link your cards to Plaid, readable only by server functions that users cannot call;
• per-user access controls on every database table;
• limiting our team's access to what their role needs; and
• a read-only design, so the Service cannot move money and never holds your banking credentials.

No system is perfectly secure. If we become aware of a security incident that affects your information, we will notify you and the authorities as the law requires. You can report a security concern to security@gleapinn.app.

12. Your choices and rights

Wherever you live, you can use these controls in the app:

• Download My Data (Profile › Settings) gives you a machine-readable copy of your profile, sharing choices, Terms acceptance and crash-reporting choice, Friends and transaction history. For a copy of anything else we hold about you, including the consent records made when you linked your cards, email privacy@gleapinn.app.
• Delete Account (Profile › Settings) starts the deletion described in Section 8 and shows its progress.
• Crash reporting (Settings › Privacy & Data) can be turned on or off at any time.
• Per-brand sharing can be changed at any time (Section 6).
• Cards can be unlinked at any time.
• Notifications can be managed by category and by Friend in the app, and turned off in your device settings.
• Device permissions (camera, photos, notifications) can be changed in your device settings.

For any other request, including correcting information you cannot edit yourself, email privacy@gleapinn.app. We may need to verify your identity before acting on a request. We usually do this by confirming that the request comes from the email address on your account. We will not treat you differently for exercising your rights.

13. Additional information for people in the United States

This Section applies to residents of U.S. states that have comprehensive consumer privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Oregon and others. We give the rights below to all U.S. users, whether or not a state law requires us to.

13.1 Your rights

Depending on where you live, you have the right to:

• know and access the personal information we have collected about you, including the categories of information, its sources, why we use it and who we disclose it to;
• get a copy of your personal information in a portable format;
• correct inaccurate personal information;
• delete your personal information;
• opt out of the sale of personal information, its sharing for targeted or cross-context behavioral advertising, and profiling that produces legal or similarly significant effects. We do none of these;
• limit the use of sensitive personal information. We use sensitive personal information only for purposes the law permits without offering this right (Section 13.3); and
• not be discriminated against for exercising these rights.

How to make a request: use the in-app controls in Section 12, or email privacy@gleapinn.app. We will respond within 45 days, or within any longer period the law allows, in which case we will tell you. You can make a request through an authorized agent. We will ask the agent for proof of your written permission, and may ask you to verify your identity directly with us.

Appeals: if we decline your request, you can appeal by emailing privacy@gleapinn.app with the subject line "Privacy Appeal". We will respond within the time the law requires. If you are not satisfied, you can contact your state Attorney General.

13.2 Categories of personal information

In the past 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act:

We do not collect government ID numbers, biometric information, precise device location, or the contents of your messages outside the Service. Section 8 explains how long we keep each type of information.

13.3 Sensitive personal information

We use sensitive personal information only to provide the Service you request, to keep it secure, and for the other purposes permitted by Cal. Code Regs. tit. 11, § 7027(m) and similar state laws. We do not use it to infer characteristics about you.

13.4 Sale, sharing and signals

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we do none of these, we do not need to act on Global Privacy Control or "Do Not Track" browser signals. If that changes, we will honor them.

13.5 California "Shine the Light"

We do not disclose personal information to third parties for their own direct marketing purposes.

14. Additional information under UK data protection law

Gleapinn Ltd is established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to how we handle your personal information, wherever you live.

14.1 Our legal bases

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing we carried out before you withdrew. Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object.

14.2 Your rights

Under UK data protection law, you have the right to access, correct and erase your personal information; to restrict or object to its processing; to data portability; and to withdraw consent at any time. We will respond within one month. In some cases the law allows us to extend this by up to two more months, and we will tell you if we do.

14.3 Complaints

Please contact us first at privacy@gleapinn.app so that we can try to help. You can also complain to the UK Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; ico.org.uk; 0303 123 1113. If you live elsewhere, you may also be able to complain to the data protection authority where you live.

15. Age

The Service is for adults only. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will close the account and delete the information. If you believe someone under 18 is using the Service, contact privacy@gleapinn.app.

16. Changes to this policy

We may update this policy as the Service develops or the law changes. We will update the "Last updated" date at the top. For material changes, we will notify you through the Service or by email before the change applies to you, and ask for your consent again where the law requires it. Each consent you give is recorded against the version of this policy in effect at that time.

17. Contact us

Gleapinn Ltd
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
privacy@gleapinn.app