The Service available at tecron.be (the “Service”) is operated by
Tecron, a business established in Belgium
(company / VAT number: BE0833267216; registered address:
Molenstraat 8, 2590 Berlaar). Tecron is the “data controller” for the personal
data described here.
For any privacy question or to exercise your rights, contact us at admin@tecron.be.
| Category | Examples |
|---|---|
| Account & authentication | Email address, hashed password, phone number, two-factor-authentication (2FA) secret (encrypted), API-key hash. |
| Bank account data (via open-banking.io) | Account identifiers (IBAN), balances, and transactions (amount, date, description, counterparty name/IBAN, merchant) — read-only, for the accounts you choose to link. |
| Imported statements | Transaction data from CSV files you upload (e.g. KBC exports). |
| Budget data | The budgets, categories and classifications you create. |
| Billing | Your billing name and address, and — for business customers — your VAT number, collected by Stripe when you subscribe so that we can issue a valid invoice and apply the correct VAT. We see the invoice and the last four digits of your card; we never receive your full card details. |
| Technical & usage | Log data needed to operate and secure the Service (e.g. timestamps, error and access logs, rate-limiting counters). |
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the budgeting features you request | Performance of a contract |
| Access your bank account information | Your explicit consent (and PSD2 account-information access) |
| Automatically categorise transactions | Performance of a contract; see “Automated classification” below |
| Authenticate you and secure the Service | Legitimate interest; legal obligation |
| Process subscription payments and issue invoices | Performance of a contract |
When you connect a bank account, you are authorising read-only access to your account information through a licensed Account Information Service Provider (AISP), under the EU’s PSD2 framework. That access runs through your own account with open-banking.io (see below); Tecron is not itself an AISP. Key points:
How the connection works. You use your own account at open-banking.io, operated by Tatic ApS (Denmark), which provides account information under the licence of Enable Banking. You give your bank consent in open-banking.io’s app, and you upload to the Service a credentials file you export from open-banking.io. That file contains a key that decrypts your account data: we store it encrypted, use it only to read your balances and transactions, and delete it when you disconnect. Your relationship with open-banking.io (including its fees and its own privacy policy) is between you and open-banking.io; to fully withdraw access, also remove the connection in open-banking.io’s app.
To suggest budget categories, the text of your transactions (such as the description, merchant and counterparty name) may be sent to Anthropic (the provider of the “Claude” AI model) for classification. This processing produces a suggested category only; it is not used to make decisions with legal or similarly significant effects about you. We do not send your name, login credentials or full account numbers for this purpose beyond what appears in the transaction text itself.
We do not sell your personal data. We share it only with service providers that process it on our behalf, under contract, to run the Service:
| Provider | Purpose |
|---|---|
| Tatic ApS (open-banking.io) | Retrieving your account information when you connect a bank account (see section 4); data processed in the EU |
| Anthropic | AI-based transaction categorisation (see section 5) |
| Stripe | Subscription billing, payment processing, invoicing and VAT determination. Stripe also acts as an independent controller for its own fraud-prevention and regulatory purposes. |
| Resend | Sending transactional emails (e.g. verification, notifications) |
| Twilio | Sending 2FA codes by SMS |
| DigitalOcean | Cloud hosting infrastructure |
Some of these providers (e.g. Anthropic, Stripe, Twilio) may process data outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
We keep your account and financial data for as long as your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period. Temporary data (such as 2FA codes) is auto-expired within minutes.
Invoices are the exception. Belgian law requires us to keep accounting records, including invoices and the billing details on them, for seven years. Those are retained for that period even after you close your account, and are not deleted on request — the legal basis is our legal obligation, not your consent. Nothing else about your account is kept under that exception: your transactions, budgets and classifications are deleted or anonymised with the rest.
Under the GDPR you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent at any time (which does not affect processing already carried out). To exercise any of these, email admin@tecron.be.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), dataprotectionauthority.be.
We use only the storage strictly necessary to operate the Service (for example, keeping you signed in and remembering your language preference). We do not use third-party advertising or tracking cookies.
The Service is not intended for children under 16, and we do not knowingly collect their data.
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying you.
Tecron — admin@tecron.be