Privacy Policy

1. Who is the data controller

The data controller is:

RevOps Labs s.r.o.
Company ID (IČO): 21705534
VAT ID (DIČ): CZ21705534
Registered office: Hlaváčkova 1334/19, Košíře, 150 00 Prague, Czech Republic
Registered with the Municipal Court in Prague, file no. C 405326
(the “Provider”, “we”, “us”)

The Provider operates an online personal finance tracking service available at meethugo.co (the “Service” or “Hugo”).

For any questions regarding the processing of your personal data, including cookies, contact us at: support@meethugo.co.

Given the scope and nature of processing, the Provider is not required to appoint a Data Protection Officer under Art. 37 GDPR. The contact above serves as the point of contact for all privacy-related requests.

2. What data we process

2.1 Account and registration data

• first and last name;
• email address;
• sign-in history (sign-in count, last sign-in time);
• IP address and the country derived from it, recorded at account signup;
• internal user and account identifiers.

This data is managed through our authentication provider Clerk (see Section 5).

2.2 Financial data you enter

The Service is a manual personal finance tracking tool — we do not connect to your bank accounts. You enter yourself:

• names of financial institutions and products (accounts, investments);
• balances, deposits and withdrawals for each product over time;
• physical assets (e.g. real estate) and their valuations over time;
• liabilities (debts, loans) and their balances;
• recurring income and expenses;
• the financial goal you set in the Service;
• the currency and country selected in settings.

We treat this data as sensitive by nature (although it does not constitute a “special category of data” under Art. 9 GDPR) and handle it with corresponding care.

2.3 Data generated by using the Service

• interactions with in-app offers and banners (impressions, clicks) — used to target content by country, language and financial goal;
• subscription data (tier, status, and possibly a Paddle identifier — see Section 8);
• technical logs necessary for operating and securing the Service.

2.4 Data processed by the AI insights feature (“Hugo”)

If you use this feature, we send aggregated financial metrics of your account (e.g. net worth, cash and investment totals, currency exposure %, savings rate, financial goal) to the AI provider selected for that insight. Requests are routed through Requesty Ltd, our AI gateway, which forwards them to the selected model. Depending on the feature configuration, the underlying model may be OpenAI — accessed through Requesty’s Azure OpenAI Service routing hosted in an EU Azure region, so the request and response stay within the EU — or Google (Gemini). We do not send your name, email, bank credentials, or the identity of specific financial institutions. The context is stripped of direct identifiers, but because a financial profile may still be distinctive, we do not describe it as legally anonymous.

2.5 Cookies and similar tracking technologies

A full list of the cookies we use, their purpose and duration, is set out in our Cookie Policy. We group cookies into three categories: necessary, analytics, and marketing.

3. Why and on what legal basis we process your data

4. Customer support access to your account

For troubleshooting and support purposes, a limited group of authorized Provider staff may temporarily access your account interface through an internal support tool. Sensitive financial figures (specific balances, amounts, and similar values) are anonymized/masked during this access, and support staff do not see them in unmasked form. Access is time-limited, logged, and used solely for support and security purposes.

5. Who we share data with

An up-to-date list of processors is kept in the Provider’s internal records and will be provided on request.

We never sell your data to third parties or use it for advertising outside the scope described in this document.

6. International data transfers

Some processors listed above are located outside the EEA or may process data there. Where required, transfers are secured through the European Commission’s Standard Contractual Clauses, an adequacy decision such as the EU-US Data Privacy Framework, or another valid safeguard under Chapter V GDPR. AI providers for which an appropriate transfer mechanism has not been completed must not be enabled for production personal-data processing. A copy of the relevant safeguards is available on request.

7. How long we keep your data

8. Subscriptions and payments

Paid subscriptions are processed through Paddle, which acts as merchant of record — Paddle is the seller of record for your subscription, handles payment processing, tax/VAT collection and remittance, and provides payment recovery (Paddle Retain) for failed or expiring payment methods. Paddle’s entities are listed in Section 5. Paddle.js is used as described in the Cookie Policy to support checkout and Retain.

9. Your rights

As a data subject, you have the right to:

• access the personal data we process about you;
• rectify inaccurate data;
• erasure (“right to be forgotten”), except for data we must retain due to a legal obligation;
• restrict processing;
• data portability — a CSV export of your data is available in the Service under Settings;
• object to processing based on legitimate interest;
• object at any time and unconditionally to processing for direct marketing purposes (Art. 21(2) GDPR), including profiling connected to marketing cookies — in that case we will stop processing your data for that purpose;
• withdraw consent to analytics and marketing cookies at any time via the “Cookie settings” tool;
• lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (www.uoou.cz); if you reside in another EU member state, you may also contact your local supervisory authority.

You can exercise your rights through our Privacy Request form or by emailing support@meethugo.co. Analytics and marketing consent can be changed through the “Cookie settings” tool. For marketing, you can also opt out directly with the providers: Google Ads settings and Meta ad preferences.

Additional notice for California residents (CCPA/CPRA)

If you are a California resident, you have the right under the CCPA/CPRA to know what personal information we collect, to request its deletion, and to opt out of its “sale” or “sharing” with third parties, including sharing for targeted advertising purposes (Google Ads, Meta Pixel), which may constitute “sharing” under the CPRA. You can opt out via the “Cookie settings” tool or by emailing support@meethugo.co.

10. Age restriction

The Service is intended for individuals aged 18 and older. We do not knowingly collect data from individuals under 18, including via analytics or marketing tools. If we learn that we have collected such data, we will delete it.

11. Data security

We take reasonable technical and organizational measures to protect your data (encryption in transit, access controls, limited support access as described in Section 4). However, no method of transmission or storage is 100% secure.

12. Changes to this policy

We may update this policy from time to time, for example when adding new tracking tools or processors. We will notify you of material changes by email or an in-Service notice, and may ask you to renew your cookie consent. The current version is always available at meethugo.co.

13. Contact

RevOps Labs s.r.o.
Hlaváčkova 1334/19, Košíře
150 00 Prague, Czech Republic
Email: support@meethugo.co