Privacy Policy

Ciste (“Ciste”, “we”, “us”) is the Data Controller of the personal data processed through this application. Ciste is an independent Irish student product; contact us at privacy@cisteapp.com with any privacy request.

• Account: name, email address, hashed password.
• Profile: university selection.
• Financial inputs you type in yourself: cash-flow labels, income, expenses, savings goals, custom calendar events.
• Product analytics limited to logs of when you tap on the Credit Union Vault section, so we can measure interest in that feature.
• Technical: session tokens, minimal request metadata required to run the service.

Ciste does not pull data from your bank accounts. Any figures you see are ones you entered.

We process the data above strictly to deliver personal budgeting insights that you asked for (Art. 6(1)(b) GDPR — performance of a contract), and to keep the service secure (Art. 6(1)(f) — legitimate interests). We do not sell or share your personal financial data with third parties, and we do not use it for advertising profiling.

We keep your account data for as long as your account exists. When you delete your account from Profile → Danger zone, your personal rows in our database and your authentication record are removed. Immutable consent-agreement records are cascaded and deleted with the user record.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased (“right to be forgotten”);
• restrict or object to certain processing;
• data portability;
• lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

Access, rectification and erasure are available directly in the app; for anything else email privacy@cisteapp.com.

We use Supabase (EU region) for authentication and database hosting, and Lovable Cloud infrastructure for application hosting. These providers process data on our behalf under their own security controls.

Privacy requests: privacy@cisteapp.com.