Privacy Policy — Ultimate Finance Bot

Effective date: 29 August 2026

Data controller: PE Dudochkin Viktor — a sole proprietor (ФОП) registered in Ukraine.

Contact for privacy: contact@ultimateminiapps.com

This policy explains what personal data the Ultimate Finance Bot Telegram bot ("the Bot") processes, why, and your rights.

1. Data we process

Telegram identifiers: your Telegram user id, and language — used to identify your account (we do not receive your phone number or password).
Content you send: the text, voice messages and photos you send to log or ask about transactions. Voice is transcribed and photos are read to extract transaction details.
Financial data you create or connect: transactions, amounts, categories, accounts, balances, budgets, goals, debts — either entered by you or imported from banks and crypto wallets you connect. A bank is connected either with a personal, read-only API token that you create yourself in your bank's app or website (e.g. Monobank), or — for EU banks, where available — through the licensed Open Banking / PSD2 aggregator Enable Banking, with consent given on your bank's own secure screen. Crypto wallets are connected by their public address only, which is read-only by nature. In every case bank and wallet access is read-only.
Access credentials for connected providers (such as a bank API token) — stored encrypted; used only to fetch your transactions and balances.
Usage/technical data: message timestamps and basic activity needed to run features (reminders, tips, anti-abuse) and, in aggregate, to understand product usage.
Payment data: we receive confirmation of a purchase and the amount, but not your full card number — card data is handled by Telegram and the payment provider.

2. Why we process it, and the legal basis

To provide the Service you asked for (record and show your finances, answer questions) — legal basis: performance of a contract.
To connect and sync your bank/wallet — legal basis: your explicit consent, given when you provide the token you created (or a public wallet address) or approve access on your bank's secure consent screen; revocable at any time (/connections).
To send reminders, tips and lifecycle messages and to improve and secure the Bot — legal basis: legitimate interests (and consent where required); you can opt out of non-essential messages in the Bot.
To process payments and meet legal/accounting obligations — legal basis: contract + legal obligation.

3. AI processing

To understand your messages and generate answers, content you send is processed by our AI provider, OpenAI. Prompts are in English and contain the data needed for the task (e.g. a transaction description, or aggregated figures for a question). Do not send data you do not want processed this way.

4. Who we share data with (processors / third parties)

We do not sell your data. We share the minimum necessary with service providers acting on our behalf:

Telegram — message delivery and Stars payments (per Telegram's own privacy policy).
OpenAI — AI understanding and answers (see §3).
Enable Banking — the licensed Open Banking / PSD2 aggregator through which EU banks can be connected, where available. Banks connected with their own personal API token (e.g. Monobank) are accessed directly through the bank's API, with no aggregator in between.
Our card payment provider (named in the payment flow once card payments are available) — card payment processing, if you pay by card.
Hosting/infrastructure (Railway) — running the Service.
FX rates come from a public rates API using no personal data.

Some providers (e.g. OpenAI) may process data outside the EU/EEA; where required, such transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses).

5. How long we keep it

Raw incoming messages and unconfirmed parse suggestions: deleted after about 90 days.
Your account, transactions and settings: kept until you delete them (/clear, /forget) or your account is closed.
Minimal payment/accounting records: kept as required by law.

6. Your rights

Under the GDPR (and similar laws) you can: access your data; correct it; delete it (in the Bot via /clear / /forget, or by contacting us); restrict or object to certain processing; request portability; and withdraw consent for bank and wallet connections at any time (/connections). You may also complain to a data-protection authority. To exercise a right, use the in-Bot commands or email contact@ultimateminiapps.com.

7. Security

We use encryption for stored access tokens and apply reasonable technical and organisational measures. No system is perfectly secure; connect only accounts you are comfortable sharing read-only.

8. Children

The Bot is not intended for anyone under 18.

9. Cookies

The Bot itself uses no cookies. Our website's admin area (staff only) uses a single session cookie; the public legal pages set no tracking cookies.

10. Changes and contact

We may update this policy; the current version, with its effective date, is always available at /legal/privacy on ultimateminiapps.com. Questions or requests: contact@ultimateminiapps.com.