1. Who we are
The data controller is Suir Data Analytics Ltd. (CRO 805139), Two Mile Borris, Tipperary, Ireland. Contact: admin@cisti.ie.
2. What we collect
- Account data — your email address and a hash of your password (never the password itself).
- Financial data you enter or import — accounts, transactions, budgets, investments, pensions, property, tax-related figures. You choose what to add.
- Security events — login attempts, password changes and similar events, with IP address and browser user-agent, kept to protect your account.
- Consent records — which version of these documents you accepted, when, and from which IP address.
- Email preferences — whether you have opted in to marketing or notification emails.
We do not use third-party analytics or advertising trackers.
3. Why we process it and on what basis
- To provide the service you signed up for (performance of a contract).
- To keep your account secure and prevent abuse (our legitimate interest).
- To send marketing emails only if you opt in (consent — withdraw at any time in Settings).
- To evidence what you agreed to (our legitimate interest in defending legal claims).
4. Where it is stored and who processes it
Your data is stored on Scaleway infrastructure in the European Union (Amsterdam, Netherlands). Processors we rely on: Scaleway (hosting and database), Brevo (transactional email) and, when paid plans open, Stripe (payments — we never see your card number). We do not sell your data.
5. How long we keep it
- Account and financial data: for as long as your account exists. Deleting your account permanently deletes it.
- Accounts created for you by a partner's invitation that are never set up: deleted automatically 30 days after the invitation, together with everything created for them.
- Mailing-list and waitlist sign-ups: held separately by email address and are not removed by account deletion — use the unsubscribe link in any email, or contact us, to remove them.
- Security events: 12 months (90 days when not linked to an account).
- Consent records: retained after account deletion, with the account link removed, as evidence of what was agreed.
6. Your rights
You can access, correct, export (Settings → Data Export) and delete (Settings → Delete Account) your data yourself at any time. You also have the right to object to or restrict processing, and to lodge a complaint with the Data Protection Commission (dataprotection.ie).
7. Cookies
Cisti sets one strictly necessary session cookie to keep you signed in. No advertising or tracking cookies are set.
8. Changes
When this policy changes we will ask you to accept the new version before you continue using Cisti.