Legal · Privacy

Privacy Policy

What yamma collects about you, why, who it's shared with, and the rights you have to control it.

Last updated 13 Aug 2026 · v0.1.0-draftDraft — pending legal review

In short

We read the financial data you connect (currently a Google Sheet you pick) so yamma can show budgets, forecasts and insights — we never sell it or use it for advertising.
Your Google login is separate from your financial data connection, and we only ever see the one file you explicitly pick — not your wider Drive.
Your data is stored encrypted, scoped to your account only, hosted with Supabase (database) and Vercel (app hosting), both under a data processing agreement.
You can delete your account instantly at any time, correct most data directly in the app, and request a full export by email — see "Your rights" below for how.
We don't use tracking or advertising cookies. See the Cookie Policy for the full, short list of what we do use.
This document covers today's Google Sheets-only version. Once bank connections via Fena launch, the Open Banking Disclosure adds the details specific to that.

1. Who we are

yamma is built and operated by Yamma Money Ltd, a company registered in England and Wales — this policy applies wherever you use yamma.

For the purposes of the UK GDPR and the Data Protection Act 2018, the "data controller" for the personal data described in this policy is:

Yamma Money Ltd
Company number 17397219 (registered in England and Wales)
Registered office: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom
Contact: help@yamma.money

2. What we collect

Account details from Google sign-in, the financial transaction data you connect, and basic usage information — nothing more than the app needs to work.

Account data: your name and email address, provided by Google when you sign in. This is a separate authorisation from your financial data connection — signing in with Google never grants us access to your wider Google account.

Financial data: today, this means the contents of the Google Sheet you explicitly pick via Google Picker (transaction dates, amounts, counterparties, and categories, as exported by your bank via Emma) — we request the narrowest available Google permission (drive.file), which limits our access to only the file you select, nothing else in your Drive. From Phase 2 onward this will also include account and transaction data from banks you connect via Fena — see the Open Banking Disclosure for that flow specifically.

Settings and preferences: the budgets, categories, savings goals, notes, and preferences you create in the app.

Usage data: page views and a small, fixed set of key actions (sign-in, sync, connecting an account, budget/subscription changes), recorded for our own product analytics only — never shared with or sold to third parties, and never used for advertising. We also log basic technical information (IP address, browser/device type, approximate location derived from IP) for security and abuse-prevention purposes.

Support and feedback: anything you send us directly, e.g. through the in-app feedback form.

Billing data: if you subscribe to Pro, Stripe (our payment processor) holds your payment details directly. We only ever store a reference to your Stripe customer and subscription record and its status — never your card number or other payment details.

3. Why we process it, and on what legal basis

Mostly because we need it to run the service you signed up for; a smaller amount to keep the product working well and secure.

Performance of a contract— reading your connected financial data, computing budgets/forecasts/insights, and storing your settings is the core service you sign up for and can't work without this data.
Legitimate interests— product analytics (understanding which features are used, diagnosing errors), fraud/abuse prevention, and rate-limiting. We've weighed this against your privacy and kept it to the minimum needed; you can object at any time (see "Your rights").
Consent — connecting a Google Sheet or (from Phase 2) a bank account is always something you actively choose and can revoke; we never connect a data source without your explicit action.
Legal obligation— where we're required to retain or disclose information by law.

4. No automated decisions with legal or similarly significant effect

Yamma's suggestions (budgets, affordability checks, debt payoff plans) are informational — nothing yamma calculates is used to make a decision about you that has a legal or similarly significant effect.

Features like the budget/payday auto-suggestions, the "Can I afford this?" wizard, and the debt payoff planner are deterministic, rules-based calculations over your own data — not profiling, and not automated decision-making in the UK GDPR Article 22 sense. You always choose whether to accept a suggestion.

5. Who we share it with

Only the infrastructure providers that run yamma on our behalf, under contract — we don't sell data, and we don't share it for advertising.

The service providers ("subprocessors") that handle data on our behalf, each bound by their own data protection terms, are currently:

Supabase — database, authentication, and encrypted secret storage.
Vercel — application hosting and (cookieless) product analytics.
Google — sign-in, and read-only access to the one Sheet you pick.
Frankfurter — a public currency-exchange-rate API; we send it no personal data, only currency codes.
Stripe — payment processing for Pro subscriptions. Stripe receives your billing name, email, and payment details directly; yamma never sees or stores your card details, only a reference to your Stripe customer/subscription record.

From Phase 2, Fena is added as the regulated open banking provider connecting your bank accounts — see the Open Banking Disclosure. We do not otherwise sell, rent, or share your personal data with third parties, and we never use your financial data to serve you advertising.

6. Where your data is stored

Primarily within the UK/EU via our hosting providers; where a provider processes data outside the UK/EU, it does so under a recognised legal safeguard.

Where any of our providers transfer data outside the UK or European Economic Area, that transfer is covered by a recognised safeguard such as the UK International Data Transfer Agreement or an adequacy decision.

7. How long we keep it

For as long as your account is active, plus a limited period after deletion for backups and legal/security purposes — then it's gone.

We retain your data for as long as you have an active yamma account. If you delete your account, your personal data is deleted from primary storage; residual copies in backups are purged on our normal backup rotation (currently within 30 days). We may retain minimal records for longer where required by law (e.g. certain financial or security logs).

8. How we protect it

Encryption at rest, encrypted secret storage for connection tokens, and database-level access control so no one else can see your data.

Financial data is encrypted at rest. OAuth tokens for connected data sources are held in a dedicated encrypted vault, never as plaintext. Every database query is scoped to your account at the database layer (row-level security), so no other user — and no part of the app itself — can read across accounts. Full detail: our Security page.

9. Your rights

Under UK GDPR you can ask to see, correct, export, or delete your data, object to or restrict how we use it, and complain to the ICO if you're unhappy with how we've handled a request.

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data (most of this you can already edit directly in the app).
Eraseyour data ("right to be forgotten").
Exportyour data in a portable format ("data portability").
Restrict or object to certain processing, including analytics processed under legitimate interests.
Withdraw consent at any time for anything we process on that basis — for example, disconnecting a Google Sheet or bank connection in Settings.

You can already handle some of this yourself in Settings → Your data: disconnect any data connection at any time, or use the Delete account button for an immediate, permanent deletion of your account and everything in it. Exporting your data is handled as a request rather than an instant download — use the Request export link in that same section, or email help@yamma.money directly, and we'll send you a complete copy. For anything else on this list, email us the same way — we'll respond within one month, as UK GDPR requires.

If you're unhappy with how we've handled your data or a request, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

10. Children

Yamma isn't intended for anyone under 18.

yamma is not directed at, and should not be used by, anyone under the age of 18.

11. Changes to this policy

We'll update the date and version at the top of this page whenever this policy changes, and flag material changes more prominently.

We may update this policy as the app changes — most notably when Phase 2 open banking launches. Material changes will be highlighted in-app, not just silently dated.

Questions about any of this, or want to exercise one of your data rights? Contact help@yamma.money.

yamma