Privacy Policy

Version 1.5 · Unpublished draft · No effective date has been set.

NOT READY FOR PUBLICATION. Every field marked ACTION REQUIRED must be completed by the owner before release. Versions 1.2 and 1.3 have not been changed or replaced.

1. The essentials

Pennny helps you discover and pursue money you may be owed and manage supported consumer matters: refunds, wrong charges, delay and parking claims, bills, spending, reminders, price comparison and travel. We use the information needed for the features you choose, including connected email and bank data where you authorise access. You approve every consequential claim step; nothing is sent without your approval. AI can make mistakes; you can ask us to review information or an outcome affecting you.

You are told when you are dealing with Pennny's AI: in Ask and when Pennny drafts a letter for you.

Pennny is available to residents of the Netherlands only. Its site is pennny.ai and the app is app.pennny.ai.

Assistant chat (Ask) is optional. Conversations expire 90 days after creation, even if you continue using them. You can delete a conversation sooner. Deletion or expiry immediately removes access and stops further chat processing; removal from active storage finishes within 24 hours. Restricted backup copies expire within 35 days after deletion or expiry. These are Pennny's chosen limits, not periods mandated by the GDPR.

Deleting a conversation does not cancel a scan you already confirmed or delete a separate claim, invoice or payment record. Those records have their own purpose and retention rules in section 8. We do not use your conversation content for advertising or model training.

2. Who is responsible

Controller: Pennny B.V. KvK number: 42159747 Registered and postal address: Sydneystraat 6, 1175 RN Lijnden, the Netherlands Privacy contact: [ACTION REQUIRED: privacy mailbox] Support: [ACTION REQUIRED: support mailbox]

Pennny has not appointed a Data Protection Officer. The reasoning is recorded in the data protection impact assessment (docs/privacy/DPIA.md, "Is a DPO mandatory?") and is reassessed as Pennny grows. Questions and requests go to the privacy contact above. Pennny does not describe any person as its DPO.

This notice covers Pennny's website and app, account, support, payments and AI-assisted services. Our cookie, email-connection, bank-connection, SEPA and commercial notices provide additional details. Accepting terms, connecting an inbox, connecting a bank and authorising a payment are different actions; none is blanket permission for unrelated processing.

3. Information we use and where it comes from

Category	Examples and source
Account and preferences	Your name, email, account identifier, authentication information (password hash, or your Google sign-in), language, country and choices, supplied by you or your chosen sign-in provider.
Connected email (Gmail, Outlook)	Sender and recipient details, subject, dates, message text and attachments obtained through the connection you authorise, and structured facts derived from them. Processing a message does not mean retaining its complete body. Lists in the app show the sender and the subject cut to 60 characters.
Connected bank (Tink)	Account details, balances and booked transactions read through Tink, read-only, with your consent. Used to show your spending, warn you before money leaves and find money you can claim back (section 4).
Uploads	Documents and photos you add to a claim.
Claims, subscriptions and evidence	Purchase and contract information, tickets, invoices, correspondence, deadlines, documents you supply, and replies from the company handling your matter (the first 500 characters of a reply, cleaned of anything unsafe, are kept as claim evidence).
Payments and billing	Billing name and address, the payment method you give Stripe (a SEPA mandate on your IBAN, or a card), invoices, recoveries, transaction references and payment status. We keep the last four digits of your IBAN, never a full card number.
Comparison, travel and click-outs	The searches you run, the offers shown and the links you open to a partner site.
Assistant conversations	Titles, your messages, saved answers, cited sources, dates, turn status and the history of actions you request or confirm.
AI outputs	Extracted facts, classifications, summaries, opportunity suggestions and draft text. These may be inaccurate and can be personal data.
Support and security	Your correspondence, necessary device and network information, authentication and security events, and diagnostic information without chat content.
Consent and accountability	Your choices, approval and mandate records, privacy requests and the limited records needed to demonstrate what happened.

We may also use relevant public business information and information from companies, authorities or professional advisers involved in a matter. The provider table in section 7 identifies external recipients and services. If information concerns somebody else, we limit its use to the relevant purpose and provide any notice required to that person, unless a lawful exception applies. Names of other people (for example travel companions or other parties) are replaced by roles before the information reaches an AI service, unless the letter you approve needs the name.

Do not send passwords, access tokens, full payment-card details, identity documents or unrelated information about other people in chat. Identity documents uploaded to a claim are refused.

Special categories

Health details in an insurance claim. Some insurance claims need health details or medical documents. Pennny asks for them only after a separate, explicit consent step (GDPR article 9(2)(a)) shown before you upload anything or any AI service sees it. The consent is for that one claim. You can withdraw it at any time; Pennny then deletes the health details and documents for that claim and stops using them. Refusing does not affect the rest of Pennny.

Sensitive bank transactions. Transactions whose merchant or category points to health, a trade union, religion or politics are sorted by fixed rules only. They are never sent to an AI service.

Ordinary Assistant use does not need any other special category of data (sexual orientation, biometric or genetic data). We do not request it and do not deliberately accept it into the Assistant's stored or model context. Detection cannot guarantee that every sensitive detail will be recognised; contact us if you notice one. Criminal-offence data, such as a traffic fine, needs its own lawful authority and safeguards and is handled under the reviewed claim-processing rules in the data protection impact assessment, not on the basis of connecting an inbox.

4. Why we use information

Purpose	Legal basis and limits
Account, requested scans, membership and supported claim work	Performance of the service contract, only where the processing is objectively necessary for the feature you request.
Use your bank data to find claims (for example a double charge, a charge after you cancelled, or a refund that never arrived), show your spending and warn you before money leaves	Performance of the service contract for the features you switch on, and your consent to the bank connection, which you can withdraw by disconnecting.
Answer Assistant requests and save the limited conversation history	Performance of the requested service contract. The Assistant is optional and history has the fixed expiry in section 8.
Draft claim letters and follow an approved claim's replies	Performance of the requested claim service, limited to the relevant matter. Sending a consequential communication requires your approval of the exact text.
Reminders (renewals, deadlines, the end of your free week)	Performance of the service contract; the trial-ending reminder is protected because it protects you from an unexpected charge.
Price comparison and travel search	Performance of the service you request. Opening a partner link records a click-out (section 8).
Administer your subscription, mandate and fees	Performance of the contract; legal obligations for necessary tax and accounting records.
Detect payment evidence incidentally during discovery scans	Legitimate interest in correctly administering fees; the specific objection described in section 5 applies.
Protect accounts, investigate abuse and maintain service security	Legitimate interest in a secure service, supported by a documented necessity and balancing assessment; legal obligation where a specific obligation applies.
Respond to support and privacy requests	Performance of the service contract where applicable, legitimate interest in resolving support issues, and legal obligations for exercising privacy rights.
Health details in an insurance claim	Your explicit consent (GDPR article 9(2)(a)), separate from every other consent.
Establish, exercise or defend a specific legal claim	A documented applicable basis and, where needed, an additional sensitive-data condition; only necessary evidence, not indefinite general retention.

Pennny uses no analytics and no advertising technology at launch: analytics, None enabled.

Contract necessity is not established simply by writing a purpose in the terms. Where consent is the basis, you may withdraw it without affecting earlier lawful processing. We do not sell personal data, use transcripts to target advertisements, or train or fine-tune models on your chat content, your connected email or your bank data.

Required account details are needed to create an account. An inbox or bank connection is your choice. Without information necessary for a particular claim or payment we may be unable to provide that feature; we will explain what is needed and why.

5. Email, discovery and learning that a claim was paid

Connecting an inbox is optional and uses the scopes required for the feature you choose. On the first connection Pennny looks back up to 36 months, then reads only new mail. Our use of Google API information must follow the Google API Services User Data Policy, including Limited Use. We do not use Google data for advertising or general-purpose model training. Human access is restricted to authorised support, security, legal or other access permitted by the applicable Google policy, with an appropriate basis and access controls.

We may learn of a recovery because you report it, because a reply arrives on your approved claim, because a matching credit appears on your connected bank account, or because a relevant payment message appears in an authorised discovery scan. The last use serves our interest in administering fees, rather than the discovery purpose alone.

You may object to that legitimate-interest use through the privacy contact or the in-app control. When honoured, your objection stops automatic creation of payout confirmations from scanned mail. It does not stop discovery, hide replies, end your claim or prevent you from confirming a recovery yourself. An email is not, by itself, an instruction to move money: before Pennny collects its fee you get a notice at least 2 days ahead, and "This is wrong" pauses it.

Disconnecting an inbox or bank stops new access through that connection. Findings and claims already made stay, marked as found while connected. Data already synced is deleted after 30 days unless it is evidence on an open claim (section 8). Reconnecting inside those 30 days resumes where you left off.

6. AI and the Assistant

Pennny uses AI to read mail, extract facts, categorise spending, draft letters and answer questions in Ask. The model receives only the minimum context needed for the request, freshly filtered and redacted before each call. We do not send an entire mailbox or live financial screen to the model merely because it is accessible in your account.

You are told when you are dealing with Pennny's AI: in Ask and when Pennny drafts a letter for you. In Ask: "You're chatting with Pennny's AI. It can make mistakes, so check anything important." On a draft: "Pennny's AI wrote this draft. Read it before you approve; nothing is sent without your approval." Letters you approve are sent from your own mailbox without an AI label.

Chat cannot authorise a payment, send a claim or bypass a required confirmation. When an action needs confirmation, you see the action and its relevant details before deciding. AI answers may be incomplete or wrong. You can correct information and request human review of a material AI-supported decision. The service does not make solely automated decisions with legal or similarly significant effects.

Which model does what. Inference runs on Amazon Bedrock in EU regions. The model assigned to each purpose is configuration; a change is reflected here before it takes effect.

Purpose	Model
Reading mail, classifying replies, finding candidates, answering in Ask, categorising spending (scrubbed text, never the sensitive transactions in section 3), identifying a company, navigating a company's cancellation page, extracting policy terms, tariffs and ratings, payout notices, reading a company's offer	Claude Haiku 5.5 (Anthropic, served by Amazon Bedrock)
Drafting and refining letters, checking a letter against the claim	Claude Sonnet 5 (Anthropic, served by Amazon Bedrock)

Bedrock inference uses the EU geographic inference profile, which routes across six EU regions: Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. All six are in the EU, but inference does not only run in Frankfurt. Anthropic does not receive your data directly: the models run inside Amazon Bedrock. A fallback to Google Gemini on Vertex AI in an EU region exists but is switched off unless announced here first; if it is ever switched on, Google appears in section 7 for that purpose.

Assistant titles, messages and saved replies are encrypted in storage with access restricted to the owning account and authorised processing. Transcripts are excluded from application logs, analytics, error reports and support dashboards. Limited operational metadata is still personal data where it can be linked to you; encryption or hashing alone does not make it anonymous.

AWS processing depends on the exact model, endpoint, region and retention configuration. Some models permit provider-side retention or AWS review for abuse detection; there is no blanket promise that AWS never stores a prompt. We will not silently switch to a model with broader use of your data. AWS describes these distinctions in its data retention and abuse detection documentation.

7. Recipients, processing locations and safeguards

We share only what is necessary with hosting, security, communications, payment and AI providers; with a company or authority involved in an approved matter; and with professional advisers where needed. A lawful corporate transfer may involve disclosure under appropriate safeguards. Providers acting on our instruction have processing terms with us. Some providers are also independent controllers for their own purposes; the table says which. Roles are checked against each signed agreement.

Pennny uses EU regions wherever a provider offers them (AWS eu-central-1, Stripe Payments Europe, Tink AB). Where processing involves a transfer outside the EEA, the mechanism is Standard Contractual Clauses (or the EU-US Data Privacy Framework where the recipient is certified), with a transfer assessment and supplementary safeguards where needed. You may request information about those safeguards through the privacy contact.

Provider and entity	Role	Purposes and data	Contract version	Transfer mechanism
Stripe Payments Europe (Ireland), with Stripe, Inc. (US)	Processor for taking your subscription and fee payments. Stripe is a controller for its own purposes, for example fraud prevention and its own legal obligations.	Subscription, free-week set-up, SEPA mandate and card payments, invoices. Name, email, billing details, IBAN or card, payment status.	[ACTION REQUIRED: Stripe entity/contract version]	EU entity; transfers to Stripe, Inc. (US) under SCCs or the Data Privacy Framework.
Tink AB	Provides the regulated account-information service under its own licence and terms (controller for that service); processes on our instruction for the rest.	Read-only access to your accounts and transactions, up to 180 days per consent.	[ACTION REQUIRED: Tink entity/contract version]	EU provider; no transfer outside the EEA is intended.
Amazon Web Services	Processor.	Hosting, storage, queues, email sending and key management in eu-central-1; AI inference on Amazon Bedrock in EU regions (section 6). All categories above except what you open on a partner site.	[ACTION REQUIRED: AWS entity/contract version]	EU regions; SCCs for any access from outside the EEA.
Google	Controller for your Google sign-in and for the Gmail service it provides; Pennny reads Gmail only through the connection you authorise.	Sign-in, and Gmail access under the scopes shown to you before you connect.	[ACTION REQUIRED: Google entity/contract version]	SCCs for US entities.
Microsoft	Controller for the Outlook mailbox service; Pennny reads it only through the connection you authorise.	Outlook access under the permissions shown to you before you connect.	[ACTION REQUIRED: Microsoft entity/contract version]	SCCs for US entities.
Travelpayouts	Independent controller for what happens on its site and in its network; Pennny sends only the click-out.	Flight, train and hotel search offers (cached fares) and affiliate links.	[ACTION REQUIRED: Travelpayouts entity/contract version]	SCCs where applicable.
Stay22	Independent controller for what happens on its site and in its network.	Hotel offers and affiliate links.	[ACTION REQUIRED: Stay22 entity/contract version]	SCCs where applicable.
Daisycon	Affiliate network; independent controller for its own purposes.	Affiliate links and conversion reports for comparison offers and for the insurance comparison sites we link to.	[ACTION REQUIRED: Daisycon entity/contract version]	SCCs where it transfers outside the EEA.
Awin	Affiliate network; independent controller for its own purposes.	Affiliate links and conversion reports for comparison offers and for the insurance comparison sites we link to.	[ACTION REQUIRED: Awin entity/contract version]	SCCs where it transfers outside the EEA.
Insurance comparison sites we link to (for example Independer and Pricewise)	Independent controllers once you open their site.	Pennny sends nothing about you except that you opened the link.	Not applicable	Not applicable

8. Retention and deletion

We keep data for its stated purpose, subject to justified legal retention. The GDPR requires storage limitation and data minimisation; it does not prescribe a universal retention period. Our choices implement those principles. See the EDPB's explanation of the basic principles.

Retention schedule

Data	Retention and deletion rule
Bank and email data: bank accounts and transactions, email references, scan findings and the facts read from them	At most the last 36 months while connected. 30 days after you disconnect. Unless it is evidence on an open claim, in which case it stays while the claim is open.
Evidence on a claim	Kept while the claim is open; deleted 2 years after the claim closes. Reopening a claim stops that clock.
Claim letters, drafts, sent messages and company replies	2 years after the claim closes. The claim record itself keeps the company, kind, amounts and dates.
An opportunity you dismissed	90 days after you dismiss it.
Invoices, fee records, payout confirmations and payment records	7 years after they are issued, because Dutch tax law requires it, with only the details the law needs (including your name and address on the invoice). Never deleted earlier.
Records of what you agreed to and when	The Terms and the direct-debit mandate: 7 years after you close your account. Privacy, inbox, bank and health-data consents: 2 years after you close your account.
Click-outs to partner sites and travel searches	Your identity is removed 90 days after they are created. Affiliate conversion records are kept 7 years (fiscal).
Assistant title, messages, saved answers and associated chat metadata	Absolute 90-day lifetime from conversation creation. Later messages, viewing, retries or model work do not extend it. Earlier deletion is available.
Receipt of an accepted scan action	Separately retained for 90 days from receipt creation to prevent duplicate execution and explain the action.
Active storage after chat deletion or expiry	Access and new processing stop immediately; physical purge finishes within 24 hours.
Backups containing deleted or expired data	Restricted disaster-recovery copies only; removal from every backup copy within 35 days. Restores reapply deletions before serving users.
Your data export	The download link works for 7 days and only behind sign-in.
Sessions	See the cookie policy: 1 hour, renewed while you are active.

A rolling 36 months means that older bank and email data is deleted every day as it ages out; it does not wait for you to disconnect. Dates are counted in the Netherlands time zone and deletion happens at the next daily clean-up after the date.

Assistant chat and its usage metadata do not become seven-year financial records simply because you mention money or start a scan. Deleting chat does not undo an accepted scan, withdraw a sent claim or erase an invoice.

Erasure. You can ask to erase your mailbox data, your bank data, your claim data, or your whole account, in the app (Settings → Privacy) or through the privacy contact. We complete it within one month. What stays, and until when, is listed on screen and in your data export: invoices and fee records (7 years), evidence on a claim that is still open (2 years after it closes), and records of what you agreed to. If you have fees you owe for claims Pennny already sent, they stay owed. Full bank-account details are deleted at erasure unless an unpaid fee invoice or the 13-month SEPA challenge window requires them; the last four digits may remain. Raw payment-provider payloads follow the ordinary 90-day rule. We restrict use of retained records to their remaining lawful purpose.

A specific legal preservation duty or valid restriction request is handled individually. We tell you what remains, why and the applicable period or ending criterion, unless law prevents notice. Browser data deletion alone does not delete server records.

9. Your information and rights

You can request access, correction, erasure, restriction, or objection where the legal conditions apply. You can withdraw consent and complain to a supervisory authority.

Download your data. In Settings → Privacy you can ask for a file (pennny-data.json). It includes your profile, connections, payments and invoices, scans, claims (including the company replies we kept), money records, notifications, Ask conversations and what Pennny worked out from your data (categories, scores and other derived data, marked as such). It also lists what erasure cannot remove. It never contains passwords, tokens or your full IBAN. The link works for 7 days and only while you are signed in, and each download link is valid for 5 minutes. A locked or unpaid membership can still export.

Access is broader than portability: portability concerns eligible data you provide or that is observed under automated, contract- or consent-based processing; access can also cover personal data derived about you. Other people's rights may require targeted redaction rather than withholding your whole record. The EDPB rights guide explains these distinctions. The file does not replace your wider right of access; you may request additional information about processing separately.

Contact [ACTION REQUIRED: privacy mailbox]. We use proportionate identity checks; do not send identity documents unprompted. We respond without undue delay and normally within one month. If a lawful extension is needed, we explain the reason within that first month. If we cannot fulfil all or part of a request, we explain why and how to challenge the decision.

10. Security and incidents

Our required controls include encryption, separation of environments, least-privilege access, protected credentials, ownership checks, restricted staff access, vulnerability management and incident handling. No service can promise absolute security. Protect your sign-in methods and report suspected compromise through support. We notify authorities and affected people when the applicable breach notification conditions are met.

11. Cookies, communications and children

Essential service communications concern your account, security, claims or payments. Pennny sets only strictly necessary cookies and uses no analytics (None enabled), so there is no cookie banner. The cookie policy lists them: the session cookie (1 hour, renewed while you are active) and, on payment pages only, two Stripe cookies. Pennny is intended for adults aged 18 and over. If we learn of an account held contrary to that rule, we investigate and delete or restrict data as appropriate.

12. Complaints and changes

You may contact the privacy team and may complain directly to the Dutch Autoriteit Persoonsgegevens, or an applicable local data-protection authority. You do not have to contact us first.

We communicate material changes when required. A new processing purpose must be assessed before it starts and any necessary new consent obtained. This draft is not an activated policy version.

Appendix — Internal release notes; remove only after evidence exists

• The owner supplies the company facts, mailboxes and provider contract versions marked above; they are listed once each in docs/OPEN-QUESTIONS.md.
• The completed data protection impact assessment is docs/privacy/DPIA.md. An external privacy adviser must review it, including the residual-risk disposition, before real users.
• Counsel reviews every text (DECISIONS G5); effective dates are set after that.