Legal
Privacy Policy
Last updated: 17 October 2026
This policy is written in plain language. If a translated version conflicts with the English version, the English version controls, subject to any mandatory rights under applicable law.
1. Controller and contact
Q99 Chaintech Ltd (company number 17220339), Suite 10843, 5 Brayford Square, London, United Kingdom, E1 0SG, is the controller responsible for the personal data described in this policy. Privacy requests may be sent to [email protected].
2. Scope
This policy applies to the Smart Budget Manager website, mobile or desktop applications, synchronization services and support communications. A device or app-store provider may process additional data under its own privacy notice.
3. Data on your device
Financial records such as transactions, balances, categories, budgets and notes are designed to be managed locally on your device. Q99 Chaintech Ltd does not receive that readable content merely because you enter it. If you enable synchronization, sharing or backup, the relevant content is encrypted on your device before transmission and the service stores the encrypted payload.
4. Personal data we process
Depending on the features you use, we process account identifiers and contact details; authentication and authorized-device records; sharing roles and permissions; security events, timestamps, IP address and basic technical logs; encrypted synchronization or backup payloads; subscription or transaction status supplied by an app store without receiving your full payment-card details; support correspondence; and your language preference. We do not use third-party advertising trackers and do not make decisions producing legal or similarly significant effects solely by automated processing.
5. Purposes and lawful bases
We process account, device, synchronization, sharing and support data to provide and secure the service and perform our contract with you. We process limited technical and security data for our legitimate interests in preventing abuse, diagnosing faults and protecting the service and its users. We process records where necessary to comply with legal obligations. Where a feature legally requires consent, we ask for it separately and you may withdraw it at any time without affecting earlier lawful processing.
6. Cookies and local storage
The website uses the sbm_lang preference in a cookie and local storage to remember your selected language. The cookie lasts up to 12 months. We do not use this preference for advertising and the current website does not use third-party advertising cookies.
7. Sharing and recipients
We disclose personal data only as needed to infrastructure, hosting, security, support and app-store or payment service providers acting for us or under their own terms; professional advisers; authorities where law requires it; and people you authorize in a shared workspace. Encrypted financial payloads remain encrypted while held by the synchronization service. We do not sell personal data.
8. International transfers
Some service providers may process data outside the United Kingdom. Where required, we use a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You may request information about the safeguard applicable to your data by emailing us.
9. Retention and deletion
We keep account and authorization data while your account is active and then only for the period reasonably required for deletion, security, dispute resolution and legal compliance. Encrypted synchronization data is retained while the relevant synchronization, backup or account remains active and is then deleted or rendered inaccessible under our deletion and backup cycle. Support and transaction records are kept for as long as needed to handle the request and meet legal or accounting duties. Technical logs are kept only for the shortest period reasonably necessary for security and operations.
10. Security and recovery
We use access controls, transport security and client-side encryption for synchronized financial content. No system is completely secure. You are responsible for protecting your devices, credentials and recovery material. Because we do not hold the keys needed to read client-side encrypted content, losing every authorized device and recovery option may make that content permanently unrecoverable.
11. Your rights
Depending on applicable law, you may ask for access, correction, erasure, restriction or portability of your personal data, and may object to processing based on legitimate interests. You may withdraw consent where consent is the basis. Email [email protected]; we may need to verify your identity. You may also complain to the UK Information Commissioner's Office at ico.org.uk, or to the competent authority where you live or work.
12. Children and changes
The service is not directed to children who cannot lawfully agree to data processing in their jurisdiction. A parent or guardian must manage any permitted family use by a minor. We will update this policy when our processing materially changes and will provide an appropriate notice before a new use takes effect where required.