Privacy Policy

1. Introduction

Welcome to the Privacy Policy for My AI Wallet ("the App"). The App is operated by Yair Zaks, an individual residing in Israel ("Operator", "we", "us", or "our"). Our website is located at myaiwallet.app.

We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our App.

BETA NOTICE: The App is currently in beta testing. While we implement security measures to protect your data, beta software may have vulnerabilities. By using the beta version, you acknowledge and accept this risk.

By using the App, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the App.

2. Information We Collect

We collect the following categories of information:

Account Information: When you create an account, we collect your email address, display name, and authentication credentials. If you sign in using Google or Apple, we receive basic profile information from those services.

Transaction Data: When you scan receipts or manually enter items, we collect and store details such as merchant names, dates, amounts, item descriptions, expiry dates, barcode/QR code data, and card numbers (for gift cards and loyalty cards).

Uploaded Content: We collect images and documents you upload for AI processing, including receipt photos, card images, and coupon images.

Device Information: We collect device identifiers, operating system version, app version, and device model for troubleshooting and analytics purposes.

Usage Analytics: We collect anonymous, aggregated data about how you use the App, including feature usage, session duration, and navigation patterns. This helps us improve the App experience.

Communication Data: If you contact us for support, we collect your correspondence, including email content and any attachments you provide.

3. How We Use Your Information

We use your information for the following purposes:

Service Provision: To provide the core functionality of the App, including storing your wallet items, processing scanned documents with AI, syncing data across your devices, and sending expiry reminders.

Service Improvement: To analyze usage patterns and improve the App's features, performance, and user experience.

Communication: To send you important service announcements, security alerts, and respond to your support requests. We may also send optional marketing communications if you opt in.

Security: To detect and prevent fraud, abuse, and security threats to protect you and other users.

Legal Compliance: To comply with applicable laws, regulations, and legal processes.

Legal Basis for Processing (GDPR): We process your personal data under the following legal grounds: (a) Performance of Contract - to provide the App services you requested; (b) Legitimate Interests - for service improvement, security, and fraud prevention; (c) Consent - for optional features and marketing communications; (d) Legal Obligation - to comply with applicable laws.

WE DO NOT: Sell your personal data to third parties; Use your data for targeted advertising; Share your transaction history with advertisers; or Profile you for purposes unrelated to the App's functionality.

4. Third-Party Service Providers

We share your information with the following categories of third-party service providers who assist us in operating the App:

Database & Authentication (Supabase): We use Supabase to store your account data and wallet items. Your data is encrypted and protected by security policies that ensure only you can access your own records. Supabase Privacy Policy: https://supabase.com/privacy

AI Processing Services: We use external AI services (such as Google AI, OpenAI, or similar providers) to process your uploaded documents, extract information, and power the Wolly AI assistant feature. When you scan a receipt or document, or interact with Wolly, data may be transmitted to these AI providers for processing.

Authentication Providers: If you choose to sign in with Google or Apple, your authentication is handled by those providers according to their respective privacy policies.

Cloud Infrastructure: Our services are hosted on cloud infrastructure providers that may process your data in data centers worldwide.

All third-party providers are contractually obligated to protect your data and use it only for the purposes we specify.

5. Wolly AI Assistant

Wolly AI Assistant: The App includes an AI-powered chat assistant ("Wolly") that can answer questions about your wallet, provide insights, and offer suggestions based on your stored items.

Chat Data: Your conversations with Wolly are stored securely on your device and are not synced to our servers. To generate responses, your recent messages and relevant wallet context (such as item names, balances, and expiry dates) are sent to our AI service providers (as described in Section 4) for processing.

AI-Generated Content: Wolly uses artificial intelligence to generate responses. AI-generated information may be inaccurate, incomplete, or out of date. Always verify important information independently before making financial decisions.

Context Data: To provide relevant responses, Wolly has access to your wallet items, balances, expiry dates, and usage patterns. This data is processed locally and through our AI service providers as described in Section 4.

6. Data Storage, Security & Retention

Data Storage: Your data is stored in Supabase's cloud infrastructure. Primary data storage is in secure data centers with industry-standard physical and network security.

Encryption: All data is encrypted both when stored and when transmitted between your device and our servers.

Access Control: We use security policies that ensure only you can access and modify your own data. Your information is kept separate from other users.

Authentication Security: Passwords are hashed using industry-standard algorithms. We support secure authentication through email/password and OAuth providers.

Data Retention: We retain your account data and wallet items for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it longer.

Security Records: To protect the service from abuse, we keep a limited security log of events such as blocked sign-in attempts or detected misuse. After you delete your account we retain only the minimum needed to enforce a block on re-registration (for example, the associated email and the type and severity of the event); any message content captured in those records is redacted on account deletion. Operational logs (errors, usage metrics) are automatically purged on a rolling schedule.

Inactive Accounts: Accounts that have been inactive for more than 24 months may be flagged for deletion after we provide notice to your registered email address.

Data Breach Notification: In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR. We will also notify relevant regulatory authorities where required.

7. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from the laws of your country.

Specifically, our servers and service providers may be located in the United States, European Union, or other regions. When we transfer your data internationally, we implement appropriate safeguards to protect your information.

For users in the European Economic Area (EEA): We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and other legally approved mechanisms for international data transfers.

For users in Israel: Data transfers comply with the Israeli Privacy Protection Authority regulations.

By using the App, you consent to the transfer of your data to countries outside your country of residence, including countries that may not provide the same level of data protection.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

GDPR Rights (European Economic Area): If you are in the EEA, you have the right to: Access your personal data and receive a copy; Rectify inaccurate or incomplete data; Erase your data ("right to be forgotten"); Restrict processing of your data; Data portability (receive your data in a structured format); Object to processing; Not be subject to automated decision-making; Lodge a complaint with a supervisory authority.

CCPA Rights (California): If you are a California resident, you have the right to: Know what personal information we collect, use, and disclose; Request deletion of your personal information; Opt-out of the sale of your personal information (note: we do not sell personal information); Non-discrimination for exercising your privacy rights.

Israeli Privacy Rights: If you are in Israel, you have rights under the Privacy Protection Law 5741-1981, including access to your data and the right to request corrections.

How to Exercise Your Rights: You can exercise most of these rights directly through the App settings (e.g., data export, account deletion). For other requests, contact us at yaozaks@gmail.com. We will respond to your request within 30 days (or sooner if required by law).

Identity Verification: For your protection, we may need to verify your identity before processing certain requests.

9. Children's Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are under 13, please do not use the App or provide any personal information to us.

If we learn that we have collected personal information from a child under 13, we will take steps to delete that information as quickly as possible.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at yaozaks@gmail.com so we can delete the information.

For users between 13 and 18: If you are a minor (between 13 and 18 years old in most jurisdictions), you should review these terms with your parent or guardian to ensure they understand and consent to your use of the App.

10. Cookies & Local Storage

The App uses local storage on your device for the following purposes:

Authentication: We store secure authentication tokens to keep you signed in between sessions.

Preferences: We store your app preferences locally, including theme settings (dark mode), currency preferences, notification settings, and other customizations.

Offline Data: The App may cache certain data locally to enable offline functionality and improve performance.

We do not use tracking cookies or invasive web tracking technologies. We do not participate in cross-site tracking or advertising networks.

Third-Party Cookies: If you access our website (myaiwallet.app), it may use essential cookies for functionality. We do not use third-party advertising or tracking cookies on our website.

Website (myaiwallet.app): Our website does not set cookies. It uses Vercel Web Analytics, a cookieless, privacy-friendly measurement service that collects aggregated page-view statistics only — no cookies, no cross-site tracking, and no persistent identifiers are stored on your device.

11. Changes, Contact & Complaints

Policy Updates: We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email before the changes take effect. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.

Version History: The current version of this Privacy Policy is 2.3, effective as of July 5, 2026. This version reflects the addition of Cloud Sync with an optional local-only mode.

Contact Us: If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: yaozaks@gmail.com

Website: myaiwallet.app

Filing a Complaint: If you believe your privacy rights have been violated, you have the right to lodge a complaint with your local data protection authority. For EEA residents, you can find your local authority at https://edpb.europa.eu/about-edpb/board/members_en. For Israeli residents, you can contact the Israeli Privacy Protection Authority (PPA).

We encourage you to contact us first so we can attempt to resolve your concerns directly.