Privacy policy

The short version

The website you are reading now collects nothing about you. No cookies, no analytics, no third-party scripts.

The app collects what it needs in order to work out who owes whom: your account, your trips and the expenses you log. Nothing is sold on, and nothing is used for advertising.

Who is responsible

Vemlaut is run as a private project by one person in Sweden, and that person is the data controller for the processing described here.

Questions, requests and full contact details go through hello@vemlaut.com.

The website

This site sets no cookies and runs no web analytics. The font is served from our own server rather than from a font provider, so your IP address never leaves the page.

The host that serves the page may log technical details — IP address, time, and which page was fetched — for operation and security. Those logs are not used to follow individual visitors and are not linked to any account.

What the app processes

If you create an account and use the app, the following is processed.

• Account details: email address and password. The password is handled by our identity provider and never reaches our own systems.
• Profile: the name you want to be seen by, an optional profile picture and an optional phone number.
• Trip data: trips you take part in, the names of the members, and expenses with amounts, currency, date and how they were split.
• Receipt images you choose to attach. If you ask the app to read a receipt, the image goes to a language model at Microsoft Azure inside the EU, which answers with lines and amounts. The answer is a draft for you to correct, and the image is used for nothing else.
• Technical information needed to deliver the service, such as sync timestamps and error logs.

Members without an account

A member on a trip is fundamentally a name someone typed in, and needs no account. That means you may end up entering the name of somebody who has no relationship with us at all. Enter only what you need in order to recognise each other — a first name is enough.

Why

The data is processed in order to deliver the service you asked for: logging expenses, splitting them and showing balances. The legal basis is performance of a contract.

For operation, security and debugging, technical data is processed on the basis of legitimate interest. Nothing is processed for marketing.

Where the data lives

The API runs in Sweden. The database, the account details and the receipt images sit with our providers inside the EU.

We use providers for hosting, database, storage and sign-in. They process data on our behalf and may not use it for their own purposes.

Exchange rates are fetched from the European Central Bank. That request contains no personal data — we ask for rates once a day for everyone, not on your behalf.

For how long

Account details and trip data are kept for as long as you have an account.

Deleting the account starts a fourteen-day grace period. During it you can sign in as usual and change your mind. After that your name, email address, phone number and profile picture are removed, and the account cannot be brought back.

Expenses you logged on a trip you shared with other people remain, without your name — they are the other travellers’ record of what the trip cost, and removing them would break their balances. A trip where no traveller has an account left is removed entirely.

Technical logs are kept briefly and cleared as they age.

Your rights

You have the right to know what data we hold about you, to have it corrected, to have it erased, to receive it in a machine-readable format, and to object to certain processing.

Send your request to hello@vemlaut.com. If you are unhappy with how we handle it, you can complain to the Swedish Authority for Privacy Protection (IMY) or to the supervisory authority where you live.

Changes

If something material changes, this page is updated, and the date at the top with it.