Privacy policy

Lunda is a planning calendar for your money. We keep your information to run Lunda for you, and for nothing else.

Who we are

Lunda is a product of Samvle Inc. (“Samvle”, “we”, “us”), a Canadian company based in Ontario. This policy covers lundaapp.com, its sign-in and admin pages, and Lunda’s emails, whether you use the free or the paid plan. We are responsible for the personal information described here. Our Privacy Officer oversees how we handle it and can be reached at support@lundaapp.com (subject line “Privacy request”). This policy is written to meet Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector. It doesn’t cover other companies’ services you choose to connect (such as your budget app); their own policies apply.

What we collect

We don’t collect your bank login, and we don’t connect to your bank directly.

We may also work out totals that can’t identify anyone (for example, how many members use a page, or where members are from by country) to understand and improve Lunda. Totals like these aren’t personal information, and they never include anything read from your budget app (YNAB or Lunch Money).

How we use it

Only for these purposes:

• To run Lunda for you: sign-in, saving your plan across your devices, receipts, connections you set up.
• To run your subscription and apply the right currency and taxes.
• To send you emails about your account, your trial and plan, and replies to feedback and bug reports you send (you can turn these emails off in Settings → Account).
• To answer support questions and fix problems.
• To improve Lunda, using totals that don’t identify you.
• To meet our legal obligations and protect our rights.
• For anything else, only with your consent.

We don’t make decisions about you based solely on automated processing. We don’t send marketing emails without your consent. Where we rely on your consent, you can withdraw it (for example by removing a connection); some features may then stop working.

Budget-app connections

Connections are one-way. We read from your budget app only when you ask (for example, by pressing Refresh), and we never write to it or move money. Your access keys are encrypted (AES-256) before they’re stored on our servers, never sent back to your browser, and used only for your requests. You can disconnect at any time in Lunda, and also revoke access in your budget app.

Data from YNAB and Lunch Money, in detail:

• What we read: the plan or budget you pick when connecting: its accounts (name, type, balance) and its currency, and, when you use a feature that needs them (Plan vs. actual, Find repeating charges), its transactions for the dates shown (date, amount, payee or memo, account, cleared or not). YNAB access is read-only. We don’t use or keep categories, goals or anything else.
• How we use it: only to show it to you in Lunda: pulled accounts and their balances on the Accounts page and in the planners, and transactions in the review screens, where you choose which ones to add to your calendar or confirm. We don’t use it for anything else: it’s never part of the totals we work out to improve Lunda, and we never sell it, use it for advertising, or analyze it for anyone else.
• What we store, and where: the accounts you pull (name, type, balance and its date) and the items you choose to add or confirm become part of your plan, stored encrypted in Canada with the rest of your plan. Transactions you don’t add are not stored: they’re read for the screen and discarded. Your access key is stored encrypted, apart from your plan.
• How long we keep it: the access key until you disconnect or delete your profile (YNAB access keys also expire on their own and are renewed only while you stay connected). What’s in your plan stays until you remove it or delete your profile; deleting your profile removes everything right away, and from backups within 90 days.
• Who sees it: only you. It is never passed to any third party, other than the service providers listed below that store and run Lunda for us, under contract, and no one on our team can open your plan.
• Before anything changes: if Lunda ever needs to read a new kind of data from your budget app, or to use it in a new way, we’ll update this policy first and ask for your consent in Lunda before reading it. Until you agree, nothing new is read.
• Deleting it: disconnect in Lunda (Accounts page → From your budget app) to remove the key, or delete your profile to remove everything. You can also ask us at support@lundaapp.com and we’ll delete it.

Who we share it with

Only the service providers we need to run the app, under contracts that limit them to that work:

• Website: Vercel (United States)
• Database, sign-in and receipt storage: Supabase, with your data stored in Canada (Montreal)
• Email: Resend and Microsoft (United States and Canada)
• Payments and sales tax: Stripe (United States and Canada)
• Optional sign-in: Google or Apple, only if you choose to sign in with them
• Bot protection: Cloudflare Turnstile, on the sign-in, sign-up and password pages, which checks your browser (not your account) to keep automated sign-ups out

We also share information when the law requires it (for example, a court order), or when it’s needed to protect our rights or someone’s safety. If Samvle Inc. is ever reorganised, sold or merged, your information would move with Lunda to whoever runs it, under this policy, and we’d tell you first.

Your plan, receipts and account are stored in Canada. Some of our service providers (the website, email and payments) may process information outside Canada or outside Quebec. Before doing so we assess the protections in place and require by contract that your information be protected to a standard comparable to this policy. Information held outside Canada may be accessible to authorities under local law.

How long we keep it

We keep your information while you have a Lunda account, on any plan.

• When a trial or paid plan ends: nothing is deleted. Your calendar stays free and the paid pages lock, with what you set up kept, until you upgrade again or delete your profile.
• When you delete your profile: your plan, receipts and connections are removed from our live systems right away, and from backups within 90 days.
• Feedback and bug reports: you can remove one from your list at any time. We keep it until we've dealt with it and archived it, then delete it 90 days after archiving, or right away when you delete your profile.
• Billing records (what you paid and when) are kept for as long as tax law requires (in Canada, generally six years).

We may keep totals that can’t identify you.

Your choices and rights

• See and download your data at any time (Settings → Data: a backup of everything, or a CSV of your items).
• Correct it in the app, or ask us to.
• Delete your profile and everything in it (Settings → Account → Delete profile).
• Withdraw consent, for example by removing a budget-app connection.
• Ask questions or complain to support@lundaapp.com with the subject “Privacy request”. We’ll reply within 30 days and may need to confirm your identity first. You can also contact the Office of the Privacy Commissioner of Canada, or in Quebec the Commission d’accès à l’information.

Ask us for a copy of what we hold about you, and we’ll give it to you, except where the law lets us hold something back (for example, information about someone else, or part of a legal dispute); if so, we’ll tell you why.

If you live in the European Union or the United Kingdom, you also have rights under the GDPR and UK GDPR: to access, correct or delete your data, to limit or object to how it’s used, to receive it in a portable format, and to complain to your data protection authority. Samvle Inc. is responsible for your data; our providers process it for us. We rely on our agreement with you (to run Lunda), our legitimate interest in keeping it secure and working, our legal obligations, and your consent where we ask for it.

Security

We protect your information with measures that fit how sensitive it is:

• Everything is encrypted in transit and stored encrypted; budget-app keys are encrypted a second time (AES-256), with the key kept apart from the database.
• Each person’s plan and receipts can only be reached by their own account; receipts are stored privately, one folder per person.
• Only the people who run Lunda can reach our systems, with two-step sign-in, and no one on the team can open your plan.
• Card details never reach us.

No system is perfectly secure. If a breach creates a real risk of significant harm, we’ll tell you and the Privacy Commissioner as the law requires.

Cookies

We use only the cookies needed to keep you signed in and remember your settings. No advertising or tracking cookies; website visits are counted without cookies (see the table above).

Children

Lunda is for adults (18 or older, or the age of majority where you live). We don’t knowingly hold information about anyone younger; if you think we do, tell us and we’ll delete it.

Changes

We’ll post any change to this policy at lundaapp.com/privacy with its date. If a change matters to how we handle your information, we’ll tell you in Lunda or by email before it takes effect. For data from your budget app, we go further and ask for your consent first (see Data from YNAB and Lunch Money above).

Contact

Samvle Inc., Toronto, Ontario, Canada · support@lundaapp.com