Privacy Policy

1. Who we are

Kronero is operated by Athlegan AB, a Swedish limited company (aktiebolag), org.nr 559259-0318, with its registered address at Kvällsvägen 2, 146 31 Tullinge, Sweden. For all matters related to this policy or your data, contact us at support@kronero.com.

We are the data controller for the personal data described below. We are based in Sweden, and our processing is governed by the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act (lag 2018:218), and the Swedish Electronic Communications Act (lag 2022:482).

2. The short version

• We collect only what we need to run a personal-finance service: your email, the data you enter into your plan, and a small amount of analytics about how you use the site.
• We do not sell your data, and we do not use it to train AI models.
• If you accept cookies, we also load Meta and Google advertising tags so we can show you Kronero ads on Facebook, Instagram, Google Search, and the Google Display Network. We never send your account email, name, or financial data to those providers.
• Analytics and advertising cookies fire only after you accept the cookie banner. You can decline and still use the site.
• You can ask for a copy of your data, or for it to be deleted, at any time by emailing support@kronero.com.

3. What we collect, why, and on what legal basis

Under GDPR Article 6, every piece of processing needs a legal basis. Here is ours, broken down by activity:

We do not engage in solely automated decision-making with legal or similarly significant effects on you, and we do not collect any of the special categories of data listed in GDPR Article 9 (health, beliefs, biometrics, etc.).

4. Cookies and similar technologies

Kronero uses a single browser cookie, and only after you click Accept on the cookie banner. The cookie is encrypted and signed (AES-GCM), but we want to be clear that it is not "small": it bundles several pieces of state that the application needs to function.

Until you accept the banner, we set no cookie at all, we do not run any analytics or marketing scripts, and we do not load any third-party tags. Network requests to our advertising and analytics sub-processors begin only after you click Accept.

Advertising and retargeting tags

When you accept cookies, we load two third-party advertising tags. Each one sets its own cookies in your browser (under its own domain) and uses them to recognise you across visits, so we can show you ads on the advertising platform that referred you. Both are gated entirely by your consent — withdrawing it stops the tags from loading on subsequent page views.

Both providers receive the page URL you are viewing, your IP address, your browser's user agent, and (for Meta) the cookie identifiers above when the tag fires. There is one form-submission exception: when you submit the public waiting-list form, our server additionally sends Meta a one-way SHA-256 hash of the email you typed, so the conversion can be matched to a Meta ad. The email itself is never transmitted in cleartext. We do not send either provider your name, your financial figures, or any data you have entered into the app.

If you would prefer to opt out of advertising tags only, you can decline cookies at the banner — the rest of the service remains fully available. You can also reset your choice from your browser at any time (clearing site cookies for kronero.com), which will re-show the banner on your next visit.

5. Who else handles your data (sub-processors)

Running Kronero requires a small set of trusted service providers. We share only what each one needs for its job, and we have data-processing agreements in place with each. Current sub-processors:

Internal operational alerting may also send error metadata to a self-hosted notification topic (ntfy.sh) and an operator alert mailbox; these channels do not receive your routine activity, only failures that need an engineer's attention.

6. How we use AI

We use a large language model hosted by OpenAI for two distinct purposes, each with its own opt-out:

Daily report narration. Daily reports are written by the model. To produce one report, we send OpenAI a templated prompt containing your display name, household name, plan figures (balance, buffer, daily plan, spending vs plan over the prior period), the voice/tone instructions you have set, and the previous day's generated report for narrative continuity. The narration prompt itself does not include transaction-level data.

Auto-matching of bank transactions. If your household has connected one or more bank accounts via Enable Banking and the household manager has left auto-matching enabled in the Manage tab (it is on by default), once per day we send OpenAI a separate prompt asking it to match newly imported transactions to the unfulfilled bills and currently due expenses you have logged. That prompt contains the bank-statement descriptions and rounded amounts of new transactions plus the names, amounts, and notes of those bills and expenses. We do not send your name, household name, account numbers, balances, plan figures, or any voice or continuity context in this prompt — it is scoped to the matching task only.

OpenAI processes data from both prompts under the same API terms, which we rely on as follows:

• No model training. OpenAI is contractually committed not to train its models on data sent through the API. We have not opted into any data-sharing programmes.
• Retention at OpenAI. Under OpenAI's default API policy, inputs and outputs are retained for up to 30 days for abuse and misuse monitoring, then deleted (subject to legal hold). There is no API parameter to shorten this — it is a binary choice between the 30-day default and a "Zero Data Retention" arrangement.
• Zero Data Retention (ZDR). We have applied for ZDR with OpenAI. Once active, OpenAI does not store inputs or outputs at all and the 30-day abuse-monitoring window does not apply. Until the policy version below is updated to confirm active ZDR, assume the 30-day default.
• Internal storage of narration output. We persist the model's daily-report response (subject and body) in our own database, in a daily_reports row. The next day's prompt re-uses that response as continuity context, and the row also lets you read your own past reports. We do not persist the narration prompt itself — only the model's reply. Both subject and body are deleted on account deletion.
• Internal storage of matching output. The model's transaction-matching reply is parsed into rows on a transaction_matchings table that link a transaction to the bill or expense it most likely paid, together with the confidence the model assigned. This audit lets you see which transaction was credited to which bill, and stops us re-sending the same transaction to OpenAI on subsequent days. These rows are deleted when the underlying bank transaction is deleted (which happens on account deletion).
• What we never send. Account passwords, contact-form messages, and the contents of password-protected fields are never sent to OpenAI. Bank-statement descriptions, transaction amounts, and bill/expense metadata are sent only for transaction auto-matching, only when the household has not opted out, and only for the transactions that have not already been considered.

You have two independent opt-outs:

• Opt out of report narration by turning off "Receive AI-generated insights" on your Notifications settings. Your daily reports keep arriving with the deterministic plan summary, and your name, voice instructions, and personalised continuity context stop being sent to OpenAI. Shared household figures (balance, buffer, daily plan, prior-period spending) may still appear in reports generated for household co-members who have not opted out, since those reports are written about their view of the same household.
• Opt out of transaction auto-matching by turning off "Send transactions to OpenAI for daily auto-matching" on the household's Manage tab. The morning bank sync still runs (so balances and transactions still flow into Kronero), but no transaction data leaves Kronero for OpenAI. Any household manager can flip this setting and it applies to everyone in the household. The two opt-outs are independent — turning either one off does not automatically turn the other off.

7. Transfers outside the EU/EEA

Several of the providers listed above are headquartered in the United States. Where personal data is transferred to the US, we rely on:

• The EU–US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795), where the provider is certified under the framework; and
• The European Commission's Standard Contractual Clauses (Module 2, Decision (EU) 2021/914) as a fallback, supplemented by the technical and organisational measures each provider documents in its data-processing addendum.

You can request a copy of the relevant transfer mechanism at support@kronero.com.

8. How long we keep your data

We keep personal data only as long as we have a clear reason to. Concrete timeframes per category:

• Account data — kept while your account is active. If you ask us to delete your account, we remove your personal data from our database within 30 days; encrypted backups expire on their own rolling schedule (no longer than 30 days after deletion).
• Inactive accounts — if you do not log in for 24 months, we delete the account and its data on the same terms as a user-requested deletion. Before we do, you receive four reminder emails on the run-up to deletion: 2 months, 1 month, 1 week, and 1 day before the scheduled date. Logging in at any point during the cadence resets the clock and cancels the deletion — no need to reply to the email or click anything in it beyond the login link.
• Waiting-list signups — kept until you ask us to remove you, or until we have invited you and you have created an account. If we have not been able to invite you within 24 months of signup, we delete your prospect record. We send a single reminder email 30 days before that deletion so you have a chance to ask for an invitation if you still want one.
• Authentication tokens (magic links, invitation links, email-change confirmations) — expire automatically (15 minutes for magic links, 24 hours for email confirmations, 7 days for invitations) and are marked used on first consumption.
• Daily reports and plan history — retained for the lifetime of your account so you can review your own history. Removed on account deletion.
• Bank transactions — retained for the lifetime of the bank account in your household, whether they arrive through the Enable Banking aggregator sync or a CSV export you upload yourself. We never see your online-banking credentials in either path: aggregator consent is granted on your bank's own screen, and CSV uploads are parsed contents only.
• Operational logs — retained for up to 30 days, then deleted.
• Analytics events (Mixpanel) — retained at Mixpanel for the duration set by Mixpanel's free-plan default. Our project is on Mixpanel's free tier, which does not expose the configurable retention setting available on paid tiers; we will shorten retention when we move to a plan that allows it. Regardless of the platform-wide retention window, when you delete your account we issue a Mixpanel deletion request keyed to your user identifier (Mixpanel "Right to Erasure" API); Mixpanel completes the deletion within 30 days and removes your historical events from their store independently of the standard retention window.

9. Our legitimate-interest balancing

Three of our processing activities rely on legitimate interest (GDPR Art. 6(1)(f)) rather than your consent or a contractual necessity: operational logs, security telemetry, and the operator-alert pipeline that routes warnings and errors to us. Article 6(1)(f) requires us to balance our interest against your rights and freedoms; here is the balance we drew, in plain terms:

• Necessity. Without operational logs we cannot diagnose failures, monitor service availability, defend against abuse and credential-stuffing, or meet our obligations under GDPR Article 32 (security of processing). There is no realistic less-intrusive alternative — we have to know what the application did when something goes wrong.
• Proportionality. The data we log is operational metadata, not personal interaction. The HTTP request log records method, path, status code, and request duration — nothing else. Application-layer errors and warnings may also include a user ID and a short error fingerprint so that a failed action can be traced. We do not log request bodies, IP addresses, your financial figures, or any of your free-text input. Logs are retained for 30 days and then deleted.
• Impact on you. The processing has minimal impact on your privacy: it does not profile you, draw inferences about you, build a behavioural picture of you, or share data with third parties for advertising. It exists only to keep the service working and secure for you and other users.
• Your right to object. You have an unconditional right under Article 21 to object to legitimate-interest processing. Email support@kronero.com; we will assess your objection on the merits and either stop the processing for you or explain in writing why our interest overrides yours. While we assess, we will mark your data as restricted and not use it for the disputed purpose.

10. Your rights

Under GDPR Articles 15–22, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data. Most account data is editable directly in the app under Profile.
• Erasure — ask us to delete your data ("right to be forgotten"). We will, unless we are required to retain something for a legal obligation.
• Restriction — ask us to pause processing while we investigate a concern.
• Portability — receive your data in a structured, machine-readable format, or have it sent directly to another controller where technically feasible.
• Object — object to processing based on legitimate interests (such as our operational logs).
• Withdraw consent — at any time, for any processing based on consent (cookies, newsletter). Withdrawal does not affect processing that already happened.

To exercise any of these rights, email support@kronero.com from the address associated with your account. We will respond within 30 days (longer only in genuinely complex cases, in which case we will tell you why and when to expect a reply).

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se. You may also contact the supervisory authority in your country of residence within the EU/EEA.

11. Security

Kronero uses encryption in transit (TLS) for every connection and encryption at rest for the database. Session cookies are encrypted with AES-GCM and signed. Passwords (when used) are hashed with bcrypt. Access to production systems is limited to the operator and protected by multi-factor authentication. We document our processors and review them periodically.

No system is perfectly secure. If we ever discover a personal data breach that is likely to result in a risk to your rights, we will notify the Swedish data protection authority within 72 hours and you without undue delay, in line with GDPR Articles 33 and 34.

12. Children

Kronero is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, please contact us at support@kronero.com and we will delete the account.

13. Changes to this policy

We may update this policy from time to time — for example, when we add a new sub-processor, change a feature, or clarify wording. The Last updated date at the top of the page reflects the current version. For material changes (a new processor, a new purpose, a new legal basis), we will notify you in the app or by email before the change takes effect.

14. Contact

Questions, requests, or concerns about your data:
support@kronero.com