Privacy Policy

Last updated: 30 July 2026

This policy explains what personal data Sabyl Ltd (England and Wales) collects when you use sabyl.com and our apps, why, and what rights you have. We are the data controller; you can reach us at privacy@sabyl.com.

The short version: we collect what is needed to run a money app for your family and nothing more. We do not sell your data, we do not run advertising, and we never will inside your financial life.

1. What we collect

• Account data — your email address, username, display name, and avatar if you add one.
• Wallet data — the public address of your wallet. Your private keys are managed through Privy under your control; Sabyl never sees or stores your keys.
• Verification references — when you activate money features, identity verification is performed by Bridge (a Stripe group company) and its verification provider. Your identity documents and selfie go to them, not to us: we store only references — your Bridge customer ID, verification status, and, where verification fails, the reason category.
• Transaction data — records of deposits, withdrawals, sends, and pot activity: amounts, timestamps, counterparties, references, and daily balance snapshots that power your charts.
• Communications — notifications we have sent you and your notification preferences; messages you send to support.
• Technical data — logs necessary to operate and secure the Service (IP address, device and browser type, timestamps).

2. The blockchain is public — this matters

Your balance and transactions exist as EURC on the Base blockchain, a public network. Blockchain records are public, permanent, and outside the ability of anyone to edit or erase — including ours. They show wallet addresses, not names; the link between your address and your identity is held in our systems and those of our providers, and is protected as described here. Anyone you transact with can see the on-chain history of the addresses involved. This is inherent to how the technology — and your ownership of your money — works.

3. Why we process your data

• To provide the Service (contract): accounts, wallets, pots, transfers, notifications.
• To meet legal obligations: anti-money-laundering law requires us and Bridge to verify identity, screen transactions, and keep records of financial activity — typically for 5 years after your relationship with us ends. We cannot delete these earlier, even on request.
• Legitimate interests: securing the Service, preventing fraud and abuse, understanding usage in aggregate to improve the product. We do not profile you for marketing.
• Consent, where we ask for it (for example optional communications) — withdrawable anytime.

4. Who receives your data

We use a small set of processors, each for one job: Bridge (identity verification and payments — also an independent controller for its regulated services), Privy (sign-in and wallet infrastructure), Supabase (our database, hosted in Paris, France), Vercel (application hosting and avatar storage), Resend (email delivery), Alchemy (blockchain connectivity — sees wallet addresses, not identities), and Upstash (rate limiting). We share data with authorities where the law requires, and we may share it in a corporate transaction (merger, acquisition) under equivalent protections.

Some providers process data in the United States; where they do, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

5. How long we keep it

Account data: while your account exists, then deleted or anonymised within 90 days of closure — except financial and verification records we must keep for anti-money-laundering law (5 years), and except what the public blockchain itself permanently contains (see section 2).

6. Your rights

Under the GDPR (and UK GDPR) you can ask us to: access the data we hold about you, correct it, delete it (within the legal-retention limits above), restrict or object to processing based on legitimate interests, and export your data in a portable format. Write to privacy@sabyl.com; we respond within one month. You may also complain to your local data-protection authority — for most of our users, the CNIL in France, or the ICO in the United Kingdom for Sabyl Ltd itself.

7. Cookies and tracking

Sabyl uses only what is necessary to keep you signed in and the Service secure (authentication session storage via Privy). No advertising trackers, no third-party analytics cookies. If that ever changes for product analytics, we will update this policy and ask where consent is required.

8. Children

Sabyl is for adults. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.

9. Changes

We will update this policy as the Service evolves and give you notice of meaningful changes by email. The current version always lives at sabyl.com/privacy.

Sabyl Ltd — privacy@sabyl.com