Privacy Policy

Last updated: September 4, 2026 Effective date: April 20, 2026 Version: 2.1.0

1. Introduction

This Privacy Policy ("Policy") describes how Xiom OÜ, a private limited company incorporated in Estonia (registry code: 17487029, registered address: Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia) ("Xiom," "we," "our," or "us"), collects, uses, discloses, and protects personal information when you use the Prosperify mobile application and related services (collectively, the "Service").

Xiom OÜ is the data controller of personal data processed through the Service, except where this Policy expressly states otherwise.

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), Brazil's Lei Geral de Proteção de Dados ("LGPD"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), the Australian Privacy Act 1988, and other applicable laws in jurisdictions where we offer the Service.

By using the Service, you acknowledge that you have read and understood this Policy.

2. Scope

This Policy applies to all users of the Service worldwide. It covers personal information we collect through the Prosperify application, our website, customer support channels, and any related services we operate.

This Policy does not apply to third-party websites, services, or applications you may access through the Service. We encourage you to review the privacy policies of any third parties before providing them with personal information.

3. Information We Collect

3.1 Information You Provide Directly

Account information:

  • Name
  • Email address
  • Account credentials (passwords are stored only in hashed and salted form)
  • Profile information you choose to provide (e.g., currency preference, language, country of residence)

Financial information you enter:

  • Asset and liability data
  • Income and expense records
  • Investment portfolio information (holdings, valuations)
  • Net worth calculations and financial goals
  • Notes, tags, and categorizations you create

Important: Prosperify does not connect to your bank, broker, or any financial institution. We do not process payments, execute trades, or move money. Financial information in the Service is provided by you — typed in directly, imported from files you upload, or extracted from documents you choose to upload — and is used solely for your personal tracking purposes. Market prices and reference data are retrieved from third-party market data providers and are not linked to your identity.

Communications:

  • Messages you send through our in-app feedback system
  • Email correspondence with our support team
  • Information you provide in surveys or research participation

3.2 Information Collected Automatically

Device and technical information:

  • Device model, operating system, and version
  • Application version and unique application instance identifier
  • Language and time zone settings
  • Crash logs and diagnostic information

Usage information:

  • Features accessed and interaction patterns
  • Session duration and frequency
  • Aggregated, non-identifying behavioral analytics

Network information:

  • IP address (used for security, fraud prevention, and approximate location)
  • Approximate geographic location derived from IP address (country/region level only — we do not collect precise GPS location)

3.3 Information We Do Not Collect

To be clear about what we do not do:

  • We do not collect bank account numbers, credit card numbers, or payment credentials
  • We do not access your bank, brokerage, or other financial accounts
  • We do not collect biometric data (other than on-device biometric authentication, which never leaves your device)
  • We do not collect special category data under GDPR Article 9 (e.g., health, racial/ethnic origin, political opinions, religious beliefs)
  • We do not sell your personal information to third parties

3.4 Information from Third Parties

We may receive limited information from:

  • Authentication providers (e.g., Apple Sign-In, Google Sign-In) if you choose to use them — typically your name, email address, and a unique identifier
  • Service providers assisting with security, fraud prevention, and analytics (see Section 7)

4. Sensitivity of Financial Data

Although the financial information you enter into Prosperify is not classified as "special category data" under GDPR Article 9, we recognize that it is highly sensitive. We apply heightened safeguards to this data, including encryption at rest and in transit, strict access controls, and the security measures described in Section 8.

5. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 GDPR to process your personal information:

Where we rely on legitimate interests, we have conducted a balancing test to ensure our interests are not overridden by your rights and freedoms. You may request details of this assessment by contacting us.

You have the right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Information

We use personal information for the following purposes:

  • To provide the Service: create and manage your account, store your data, sync across your devices, and deliver the features you request
  • To personalize your experience: remember your preferences and tailor the interface to your settings
  • To generate AI-powered insights: analyze the financial data you enter to surface patterns, summaries, and personalized observations (only where you have access to such features and, where required, have given consent)
  • To display reference data: show market data, exchange rates, and similar reference information
  • To communicate with you: send service updates, security notices, policy changes, and respond to your inquiries
  • To improve the Service: analyze aggregated usage to identify bugs, improve features, and develop new functionality
  • To protect the Service: detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms
  • To comply with law: meet legal, regulatory, tax, and accounting obligations and respond to lawful requests from authorities
  • To enforce our rights: establish, exercise, or defend legal claims

7. Sharing and Disclosure of Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We disclose personal information only as described below.

7.1 Service Providers (Processors)

We share information with carefully selected service providers who process personal data on our behalf under written agreements that meet GDPR Article 28 requirements. Categories of processors include:

  • Cloud infrastructure, hosting, database, storage, authentication, and AI gateway — Lovable Cloud (operated by Lovable AB, with underlying infrastructure provided by Supabase, hosted in the European Union)
  • Federated authentication providers (where you choose to sign in with them) — Apple, Google
  • Crash reporting and product analytics — Sentry (Functional Software, Inc.)
  • Transactional and authentication email delivery — Lovable Cloud email service and Zoho Mail (Zoho Corporation B.V.)
  • Merchant of Record for direct purchases — Paddle.com Market Limited, which acts as an independent controller for the sale itself (payment processing, fraud checks, subscription management, invoicing, and tax compliance) and receives your name, email address, billing country, and any VAT/business identifier you provide at checkout
  • AI search and news retrieval — Perplexity AI, Inc. (queries you submit for market news and search; no account identifiers are sent)
  • Market data — third-party market data providers (instrument symbols only; no personal data)
  • AI and machine learning providers — accessed via the Lovable AI Gateway (currently Google, via the Gemini model family, as the underlying foundation-model provider); see our AI Use Notice for details

The list above is our current set of subprocessors and is updated on this page whenever it changes.

7.2 Legal and Regulatory Disclosures

We may disclose personal information when we believe in good faith that disclosure is necessary to:

  • Comply with applicable law, regulation, legal process, or governmental request
  • Enforce our Terms of Service or other agreements
  • Protect the rights, property, or safety of Xiom, our users, or others
  • Prevent or investigate possible wrongdoing in connection with the Service

7.3 Corporate Transactions

If Xiom is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information.

7.4 With Your Consent

We may share information for other purposes with your explicit consent.

8. Data Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, alteration, or disclosure, including:

  • Encryption in transit using TLS 1.2 or higher
  • Encryption at rest using AES-256 or equivalent industry-standard algorithms
  • Hashed and salted password storage (we never store passwords in plain text)
  • Secure authentication including support for biometric and device-based authentication
  • Access controls based on least-privilege principles, with internal access restricted to authorized personnel
  • Logging and monitoring of access to systems containing personal data
  • Regular security reviews and updates to our infrastructure and code
  • Secure software development practices including code review and dependency management
  • Vendor security assessment for service providers handling personal data

No security measure is perfect. While we work hard to protect your information, we cannot guarantee absolute security. You play an important role: keep your account credentials confidential, use a strong unique password, enable available authentication options on your device, and notify us promptly if you suspect unauthorized access.

Security Incident Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and will notify affected users without undue delay where the breach is likely to result in a high risk, in accordance with GDPR Articles 33 and 34 and equivalent laws.

9. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.

You may request deletion of your account and associated personal data at any time through the in-app Settings → Account → Delete Account option, or by contacting us at the address in Section 16.

10. International Data Transfers

Xiom OÜ is established in the European Union (Estonia). Personal data may be processed in the EU/EEA, the United Kingdom, and other countries where our service providers operate.

When personal data is transferred outside the EEA, the UK, or other jurisdictions with equivalent protections, we rely on appropriate safeguards, including:

  • Adequacy decisions issued by the European Commission or the UK Government, where available
  • Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) and the UK International Data Transfer Addendum
  • Supplementary measures where necessary in light of the Schrems II judgment, including encryption, pseudonymization, and contractual commitments
  • Other lawful transfer mechanisms where applicable (e.g., binding corporate rules, derogations under Article 49 GDPR)

You may request a copy of the relevant safeguards by contacting us.

11. Your Privacy Rights

The rights available to you depend on your jurisdiction. Where applicable laws grant you these rights, you may exercise them as described in Section 11.7.

11.1 Rights Under GDPR / UK GDPR (EEA, UK, Switzerland)

  • Right of access (Article 15): obtain confirmation of whether we process your data and a copy of that data
  • Right to rectification (Article 16): correct inaccurate or incomplete data
  • Right to erasure / "right to be forgotten" (Article 17): request deletion of your data
  • Right to restriction of processing (Article 18): limit how we process your data in certain circumstances
  • Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format and transmit it to another controller
  • Right to object (Article 21): object to processing based on legitimate interests, including profiling, and to direct marketing
  • Right not to be subject to automated decision-making (Article 22): see Section 12
  • Right to withdraw consent at any time, where processing is based on consent
  • Right to lodge a complaint with a supervisory authority (see Section 11.6)

11.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident:

  • Right to know what personal information we collect, use, disclose, and (if applicable) sell or share, including the categories of sources, purposes, and recipients
  • Right to delete personal information we have collected from you, subject to exceptions
  • Right to correct inaccurate personal information
  • Right to opt out of sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but this right is preserved
  • Right to limit use of sensitive personal information — we use sensitive personal information only for purposes permitted under CCPA/CPRA without requiring opt-in
  • Right to non-discrimination for exercising your rights
  • Right to designate an authorized agent to make requests on your behalf

We do not knowingly sell or share the personal information of consumers under 16 years of age. As stated in Section 13, the Service is not directed to anyone under 18.

11.3 Rights Under LGPD (Brazil)

If you are located in Brazil, you have the rights under Article 18 LGPD, including confirmation of processing, access, correction, anonymization or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent.

11.4 Rights Under PIPEDA (Canada)

If you are located in Canada, you have rights of access and correction with respect to your personal information, as well as the right to challenge our compliance with PIPEDA.

11.5 Rights Under the Australian Privacy Act

If you are located in Australia, you have rights of access and correction under the Australian Privacy Principles, and you may complain to the Office of the Australian Information Commissioner (OAIC).

11.6 Right to Lodge a Complaint (EEA, UK, Switzerland)

You have the right to lodge a complaint with a data protection supervisory authority. Our lead supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Tatari 39, 10134 Tallinn, Estonia

Website: aki.ee

Email: info@aki.ee

You may also lodge a complaint with the supervisory authority in your country of residence or place of work.

11.7 How to Exercise Your Rights

To exercise any of these rights, you may:

  • Use the privacy controls within the Service (Settings → Privacy)
  • Email us at privacy@prosperify.ai
  • Write to us at the address in Section 16

We will respond within the timeframes required by applicable law — generally within one month under GDPR (extendable by two further months for complex requests), within 45 days under CCPA/CPRA (extendable by 45 days), and within the periods specified by other applicable laws.

We may need to verify your identity before fulfilling your request. We do not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request, as permitted by law.

12. Automated Decision-Making and AI Features

Prosperify may include AI-powered features that analyze the financial data you enter to provide insights, summaries, and observations.

These AI features:

  • Are decision-support tools, not automated decisions
  • Do not produce legal effects or similarly significant effects on you within the meaning of GDPR Article 22
  • Provide informational outputs that you remain free to interpret, accept, ignore, or override

We do not use your personal data to train third-party foundation AI models without your explicit consent. Where AI features are powered by third-party providers, we contractually require them to process your data only as a processor on our instructions and not for their own model training, except where you have specifically opted in.

You may opt out of AI features at any time through Settings → AI Features.

13. Children's Privacy

The Service is not intended for individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. This is a contractual age limit set by us; it is stricter than the GDPR digital consent age (which is 16 in many EU member states and as low as 13 in others).

If we learn that we have collected personal information from a person under 18, we will delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@prosperify.ai.

14. Cookies and Similar Tracking Technologies

The Prosperify mobile application uses limited tracking technologies, including:

  • Strictly necessary technologies required for the Service to function (e.g., authentication tokens, session identifiers) — these do not require consent
  • Analytics SDKs that help us understand how users interact with the Service — where required by law (including the EU ePrivacy Directive), we request your consent before activating these
  • Crash reporting SDKs to identify bugs and stability issues — used on the basis of legitimate interests, with consent where required

You can manage your tracking preferences through Settings → Privacy → Tracking Preferences within the app. On iOS, you can also use App Tracking Transparency controls; on Android, you can use the advertising ID controls in your device settings.

If we operate a website at prosperify.ai, our use of cookies on that site is described in our separate Cookie Policy, available at https://prosperify.ai/cookies.

15. Data Protection Officer and EU Representative

Data Protection Officer (DPO): We have determined that we are not required to appoint a Data Protection Officer under Article 37 GDPR (we do not carry out, as a core activity, large-scale systematic monitoring of data subjects or large-scale processing of special categories of personal data, and we are not a public authority). You may direct any privacy inquiries to privacy@prosperify.ai.

EU Representative: Xiom OÜ is established in the European Union (Estonia), so designation of a separate EU representative under Article 27 GDPR is not required.

16. Contact Us

If you have questions, requests, or concerns about this Policy or our processing of your personal information, please contact us:

Xiom OÜ Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia Email (privacy): privacy@prosperify.ai Email (general): support@prosperify.ai

You may also reach us through the in-app feedback system at Settings → Help & Support, selecting "Privacy Request" as the category.

We aim to acknowledge inquiries within 5 business days and to resolve them within the timeframes set out in Section 11.7.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or legal requirements.

When we make material changes, we will:

  • Post the updated Policy in the Service and on our website
  • Update the "Last updated" date at the top of this Policy
  • Provide additional notice (e.g., in-app notification or email) where required by law or where the changes are significant

We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of an updated Policy constitutes acceptance of the changes, except where additional consent is required by law.

18. Governing Law

This Policy is governed by the laws of the Republic of Estonia, without prejudice to mandatory data protection laws and consumer protection rights available to you in your country of residence.

Nothing in this Policy limits your rights under applicable mandatory law.

This Policy is provided in English. If translations are made available, the English version prevails in the event of any conflict, except where mandatory local law requires otherwise.

gt; start free