This Privacy Policy describes how Leafin ("Leafin," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the Leafin mobile application and web application (collectively, the "Service"). By creating an account or otherwise using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree with the terms of this Policy, please do not access or use the Service.
This Policy applies to all users of the Service, including the Leafin Android application, the Leafin progressive web application, and their associated backend infrastructure. It does not apply to any third-party website, application, or service that may be linked to or from the Service, including the third-party service providers described in Section 6, each of which maintains its own separate privacy policy.
If you choose to sign in using Google Sign-In, Google shares certain profile information with us as described in Section 2.1, subject to the permissions you grant during that sign-in flow and Google's own privacy policy.
We use the information described above for the following purposes:
We do not sell your personal information to any third party, and we do not use your financial data to serve you advertising.
Where applicable law requires a legal basis for processing personal data (including Indonesia's Law No. 27 of 2022 on Personal Data Protection), we process your information on the following bases: (a) performance of the contract between you and us to provide the Service you have requested; (b) your consent, such as when you opt in to push notifications or grant permission during Google Sign-In; (c) our legitimate interests in operating, securing, and improving the Service, provided those interests are not overridden by your data protection interests; and (d) compliance with legal obligations to which we are subject.
We rely on the following categories of third-party service providers to operate the Service. Each provider processes only the information necessary to perform its function and is bound by its own privacy policy and, where applicable, a data processing agreement with us.
| Provider category | Purpose |
|---|---|
| Google (Sign-In) | Authentication and identity verification |
| AI service provider | Parsing natural-language transaction entries, reading receipt images, conversational assistance, and generating financial insights |
| Midtrans | Payment processing for subscriptions purchased through our web application |
| Google Play Billing | Payment processing and subscription management for purchases made through the Android application |
| Cloud infrastructure and hosting providers | Hosting our backend servers and database |
| Push notification services (platform-provided) | Delivering notifications to your device or browser |
We do not permit these providers to use your information for their own independent marketing purposes.
We implement reasonable technical and organizational measures designed to protect your information, including encrypting data in transit using HTTPS/TLS, using token-based authentication with limited validity periods rather than storing passwords, and enforcing per-account access controls on our backend. No method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
Depending on where our infrastructure and service providers are located, your information may be processed or stored in a country other than the one in which you reside. Where this occurs, we take steps to ensure that such transfers are conducted in a manner consistent with applicable data protection law.
We retain your information for as long as your account remains active or as needed to provide the Service to you. If you delete your account, we permanently delete your associated transactions, wallets, budgets, categories, and notification history from our servers, except where retention is required to comply with a legal obligation, resolve a dispute, or enforce our agreements. Receipt images are not retained beyond the time necessary to process them. Server logs are retained for a limited period for security and diagnostic purposes and are then deleted or anonymized in the ordinary course of business.
Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information:
We will respond to verifiable requests within the time required by applicable law.
Leafin does not display third-party advertisements, does not use advertising identifiers (such as the Google Advertising ID) for ad targeting, and does not integrate third-party advertising or behavioral tracking SDKs. Any advertising-related permission declared by the application is provided solely to comply with platform requirements and is not used to serve or personalize advertising.
The Service is not directed to children, and we do not knowingly collect personal information from children under the age of 13 (or the minimum age required by applicable local law). If we become aware that we have inadvertently collected personal information from a child in violation of this Policy, we will take reasonable steps to delete such information promptly.
We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. Material changes will be communicated within the Service or by other reasonable means prior to taking effect. The "Last updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the Service after any update constitutes your acceptance of the revised Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: