Privacy Policy
Last updated: April 2026
Your data is locked down
We use enterprise-grade security. Every file and record is encrypted with 256-bit AES. Every connection uses TLS. We're hosted on ISO 27001 and SOC 2 Type II-certified cloud infrastructure. Only people you invite to your household can see your data.
- Bank-grade encryption — 256-bit AES at rest. TLS 1.3 in transit. Every file, every field.
- Certified infrastructure — ISO 27001 · SOC 2 Type II · GDPR-compliant cloud.
- Household-only access — Only members you invite can read your data through the app.
- Permanent delete — One click and every trace is gone — profile, expenses, files, forever.
What we collect
We collect only what is necessary to provide the service:
- Account info — your name and email address
- Expense data — amounts, categories, dates, and descriptions you enter
- File attachments — receipts, contracts, and photos you upload
- Mortgage data — loan details and rate history you configure
Why we collect it
Your data is used solely to provide the CasaTab service. We do not use your data for advertising, profiling, or any other purpose.
Where your data is stored
Your data is stored on Google Cloud infrastructure (Firebase) with industry-standard security:
- Encryption at rest — all data is encrypted using AES-256
- Encryption in transit — all connections use TLS/HTTPS
- Access control — only household members you invite can see your data
- File protection — attachments are access-controlled and not publicly accessible
Who can see your data
Only members of your household can see your expenses and attachments through the app. Household membership is controlled by you through invite links. No one outside your household can read your data through the app.
How long we keep it
Your data is stored for as long as your account exists. When you delete your account, all your personal data — profile, expenses, and attachments — is permanently removed.
Your rights
Under applicable data protection laws (including GDPR, CCPA, and PIPEDA), you have the right to:
- Access your data — view all your data in the app at any time
- Export your data — download all your data from Settings
- Delete your data — permanently delete your account from Settings
- Withdraw consent — delete your account at any time
Third-party services
We use Google Cloud (Firebase) to operate the app:
- Firebase Authentication — for secure sign-in
- Firebase Cloud Firestore — for data storage
- Firebase Cloud Storage — for file attachments
Firebase is part of Google Cloud Platform (Alphabet Inc.) and complies with GDPR through standard contractual clauses.
We never sell your data and never share it with anyone for marketing or advertising.
Payments
When you upgrade to CasaTab Pro or add another house, we use Polar to handle the payment on our behalf. Polar is a specialist payments provider and our official Merchant of Record — they run the secure checkout page, collect your payment, send your invoice, and apply the correct VAT rate for every EU country, so you always receive a valid receipt. We never see or store your card number.
- Email and name — so Polar can send you the receipt and invoice
- Billing country — required to apply the correct VAT rate
- Card details — entered directly on Polar's secure page, never on our servers
Polar Software, Inc. is PCI-DSS certified — the highest industry standard for card-data security — and GDPR-compliant through standard contractual clauses for international data transfers. You can read their privacy policy at polar.sh/legal/privacy.
Analytics & cookies
On our public pages — the pages you can see before logging in — we use a small cookieless analytics tool we run on our own server to count aggregate visits. It sets no cookies, never identifies you, never stores your IP address, and never shares data with Google, Meta, or any ad network. Inside the app, once you log in, we run no analytics at all.
Contact
For any questions about your data or this privacy policy, contact us at david@nualsolutions.com