Skip to content
Penge

Privacy Policy

Introduction

At Penge AS we value your privacy and are committed to protecting your personal data. Penge AS (org. no. and registered address: [org. no. and registered address]) is the data controller for the processing of personal data described in this privacy policy.

This privacy policy explains what personal data we collect, why we collect it, how we process it, and what rights you have as a user of our services.

By using our services, such as the Penge app or the website https://www.penge.app, you accept our processing of your personal data in line with this policy.

We collect and process personal data so that we can deliver our services securely and efficiently. This includes, among other things:

  • Obtaining your explicit consent to process your personal data when you register for the service or when it is needed for specific purposes.
  • Informing you clearly about which types of personal data we process and the purposes of the processing.
  • Giving you the option to withdraw your consent to the processing of personal data at any time.

If you have questions or concerns about how we process your personal data, you can contact us at privacy@penge.app.

Why and how we process your personal data

We collect the following types of personal data:

Information you give us

  • Personal information: email address
  • Financial information: Bank transactions and balances for your bank accounts, retrieved via GoCardless.
  • User data: All data you create in the app, such as categories, tags, budgets and transactions.
  • Usage data: Your interactions with the app, including views, time spent and clicks.
  • Technical data: internal IDs, IP addresses, device information, operating system and app settings, among others.
  • Payment information: Payment details such as account number and payment methods like Apple Pay, so that purchases and payments can be made in the app.

Information from third parties

This is a list of third parties that receive and process personal data on behalf of Penge AS.

Supabase and AWS

Purpose: Storing and processing data in connection with running the service (data is encrypted in transit and at rest). Data is stored in data centres in London, United Kingdom.

GoCardless

Penge uses GoCardless Bank Account Data to retrieve balance and transaction data from your banks via Open Banking. You can read more about their privacy practices here: https://gocardless.com/privacy/.

Google Workspace

Purpose: Services for sending email to customers, along with applications such as Google Sheets and Google Forms (data is encrypted in transit and at rest).

Mixpanel

Purpose: Analytics tool for analysing usage data and technical data.

Sentry

Purpose: Analytics tool for analysing usage data and technical data. Data is processed and stored by Sentry in the USA.

Firebase Cloud Messages

Purpose: Push notifications.

Apple

Purpose: App distribution, push notifications (APNs), in-app purchases and App Store analytics.

AI providers (OpenAI, Google and others)

Purpose: (1) Extracting transactions from PDF account statements you upload in the app yourself, and (2) automatic category suggestions for transactions, only with active consent in the app. Data is transferred to one or more AI providers (currently OpenAI and Google) and processed in the USA. Consent to category suggestions can be withdrawn at any time under Settings.

Customer data will also be disclosed to public authorities where this is necessary for Penge to comply with its legal obligations, for example under a disclosure order from the police.

Transfers outside the EEA

Some of our processors (Sentry, Mixpanel, Firebase and the AI providers) process data in the United States. Where personal data is transferred outside the EEA, we rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework to safeguard it.

How we use your information

  • Managing user data: To manage the data you create in the app, such as categories, tags, budgets and transactions.
  • Personal financial guidance: To give you tailored guidance and suggestions based on your financial data.
  • Troubleshooting and support: To help you with technical issues and provide customer support.
  • Marketing and communication: To send you relevant information, offers and updates about the service.
  • Security: To detect and prevent security threats.
  • Personalisation: To tailor the app experience based on your preferences and usage patterns.
  • Analytics and improvements: We use Mixpanel, App Store Connect and Apple Developer Console to understand how you use the app and to improve our services.
  • Compliance with legal obligations: We may use your information to meet our legal obligations.

Legal basis for processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

  • Contract (Art. 6(1)(b)): Delivering the app and retrieving your bank data via Open Banking.
  • Consent (Art. 6(1)(a)): AI category suggestions and sharing data with AI providers, and marketing.
  • Legitimate interest (Art. 6(1)(f)): Analytics, product improvement and security.
  • Legal obligation (Art. 6(1)(c)): Bookkeeping and responding to lawful requests from authorities.

Marketing and communication

  • Push notifications: We use Firebase Cloud Messages to send you push notifications about important updates and features in the app, as well as reminders.
  • Marketing: You have the right to opt out of marketing communication at any time by following the unsubscribe instructions in the app, in the emails we send, or by contacting us directly at privacy@penge.app.

Compliance with legal obligations

Legal requirements: We may use your information to meet our legal obligations.

Personal data security

We take data security seriously and put measures in place to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes the use of encryption, firewalls, secure servers and secure cloud storage.

This includes, among others, the following measures:

  • Access and identity management: We control who has access to your information and ensure that only authorised personnel can gain access.
  • Secure software development and testing: We develop and test our software with security in focus to prevent vulnerabilities.
  • Encryption: We use encryption to protect your data both in transit and at rest.
  • Network security: We protect our networks against unauthorised access and threats.
  • Security monitoring and incident handling: We continuously monitor our systems for security incidents and have established procedures to handle them effectively.
  • Supplier follow-up: We set requirements for and follow up on information security at our suppliers.

Cookies and the website

The website uses one strictly necessary cookie to remember your language choice (penge_lang). We use Mixpanel for analytics. We do not use advertising cookies.

Children's privacy

Our services are not aimed at children under the age of 18, and we do not knowingly collect personal data from children below this age. If we become aware that we have collected personal data from a child under 18, we will delete that information.

Retention period

We store personal data for as long as your customer relationship lasts. This lets you keep an overview of your finances, which you can see in the app yourself.

We keep account and financial data while your account is active. If you delete your account, we delete your data immediately, except for records we must keep to meet legal obligations, such as bookkeeping, which we keep only for the period required by law.

Your rights

You have the right to:

  • Access: To access the personal data we process about you.
  • Rectification: To ask us to correct inaccurate or incomplete information.
  • Erasure: To ask us to delete your personal data under certain circumstances.
  • Data portability: To receive your personal data in a structured, commonly used and machine-readable format. You can request this under Settings in the app, and we will send it to your email. Delivery may take a few business days.
  • Restriction: To request that we restrict the processing of your personal data.
  • Objection: To object to our processing of your personal data.
  • Complaint: To lodge a complaint about our processing of your personal data with a supervisory authority, such as your local data protection authority in the EEA.
  • Right to be forgotten: You can always delete your user data or your account with us. This can be done directly under Settings in the app. In that case your personal data is deleted immediately, except for data we are required to keep for other reasons.

To exercise your rights, contact us by email at privacy@penge.app.

Right to withdraw consent

You can withdraw your consents in the app at any time. This can be done under Settings.

Changes in ownership

In the event of a merger, acquisition, restructuring or sale of all or part of Penge AS, your personal data may be transferred to the new entity or party taking over the business.

We will inform you of any such transfer and any choices you may have in connection with it. You can always ask for your data to be deleted.

Contact us

If you have questions about this privacy policy or how we process your personal data, please contact us at privacy@penge.app.

Changes to this privacy policy

Penge works continuously to improve and develop our services. We may update this privacy policy from time to time.

For major changes that may affect your privacy or your rights, we will notify you in the app or by email.

The latest version will always be available on our website at https://www.penge.app/privacy.

Version 1.2. Updated 16 July 2026.