Gemma
Privacy Policy
Last updated 28 October 2026
This policy explains what personal data Gemma holds, why we hold it, who we share it with, how long we keep it, and the rights you have under UK data protection law. Gemma is a personal household budget app.
Who we are
Gemma is provided by GEMMA TECHNOLOGIES LTD ("Gemma", "we", "us"), company number 17497886. For the personal data described in this policy, we are the controller.
- Privacy contact: support@gemma-finance.com
- ICO registration: we are registered with the Information Commissioner's Office (ICO) as a data controller, reference ZC265420.
Please send any privacy questions or requests to the contact above.
This policy is written for the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
The personal data we hold
Depending on how you use Gemma, we may hold the following.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Username, email address, hashed password (Argon2), date joined, last sign-in, whether your email is verified | You |
| Profile and security | First and last name if you add them in Settings, default currency, colour theme, and optional authenticator-app (MFA) settings. The MFA secret is encrypted at rest. | You |
| Email verification and resets | A hashed 6-digit verification code with its expiry time and attempt count, plus password-reset and MFA-reset tokens | Generated by Gemma |
| Bank connection | Encrypted access and refresh tokens, connection status, bank or provider name, linked account labels, masked account identifiers, balances | Finexer, which gets it from your bank once you authorise access |
| Transactions | Imported payments: date, amount, currency, merchant name, description, merchant category code, provider category | Finexer and your bank |
| Household money data | Categories, learned categorisation rules, budgets, spend-kind tags, recurring payment series, one-off payments, savings goals, notifications, weekly digest summaries | You, and what Gemma derives from your transactions |
| Agent (Premium) | Your questions to the spending Agent, the Agent's replies and charts, and a monthly usage (token) count | You, and Gemma |
| Billing (Premium) | Subscription status, period end, cancellation status, and Stripe customer and subscription identifiers. Card details are held by Stripe, not Gemma. | You, and Stripe |
| Technical | IP address used for security and sign-in rate limiting, server-side session records, CSRF tokens, flash messages, server logs | Your device |
| Support | Emails you send us and our replies | You |
Sensitive information. Payment descriptions can sometimes reveal sensitive details about you, for example payments to a medical provider, a place of worship, a political party or a trade union. We use transaction data only to provide the budgeting features you ask for. We do not try to infer special category data from it, and we do not use it to make decisions about you.
We do not use your data for advertising, and we do not sell it.
Why we use it and our lawful basis
UK GDPR requires a lawful basis for each use of personal data. Our core service does not rely on consent under UK GDPR. When you authorise your bank to share data, that authorisation is the explicit consent the open banking rules (Payment Services Regulations 2017) require. It is separate from the lawful basis described here.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, signing you in, email verification, password and MFA resets | Account, profile and security, technical | Contract (Art 6(1)(b)) |
| Connecting your banks, and importing and showing accounts, balances and transactions | Bank connection, transactions | Contract |
| Categorising transactions, including automated category suggestions from Jev (TypeSafe) when merchant details are weak | Transactions (merchant name, description, amount, currency, merchant category code, provider category) | Contract |
| Budgets, alerts, recurring payments, what's-left-to-spend, savings goals, cashflow look-ahead | Household money data, transactions | Contract |
| Weekly digest write-ups and the spending Agent (Premium), using Google Cloud Vertex AI (Gemini models) in London (europe-west2) | Your Agent questions, and the transactions, budgets, goals and categories needed to answer them | Contract |
| Taking payment for Premium and keeping your plan in sync | Billing | Contract |
| Sending service emails (verification codes, password and MFA resets) | Email address | Contract |
| Converting amounts between currencies using published exchange rates | Currency codes and dates only. Rate requests do not include your personal data. | Contract |
| Keeping Gemma secure: rate limiting, fraud and abuse prevention, logs, backups, investigating incidents | Technical, account | Legitimate interests (Art 6(1)(f)): protecting you, other users and the service |
| Answering support requests and requests to exercise your rights | Support, account | Contract, and legal obligation (Art 6(1)(c)) for rights requests |
| Keeping billing and accounting records | Billing | Legal obligation (UK tax and company law) |
| Responding to lawful requests from regulators, courts or law enforcement | Any relevant data | Legal obligation, or legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see "Your rights"). We use email only for service messages such as verification codes and account resets, not marketing. If that changes, we will ask for your consent where PECR requires it, and you will be able to opt out at any time.
You do not have to give us your personal data. Some of it, such as an email address, is needed to create an account, and Gemma's features do not work without access to the data they rely on.
Automated processing
Gemma uses automated processing to suggest transaction categories, spot recurring payments, track budgets, project cashflow and write digest summaries. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art 22 UK GDPR). Categories and insights are suggestions that you can change at any time. Your own category rules take priority over Jev's suggestions. The Agent and digest write-ups are generated text, not regulated financial advice, and they can be wrong.
Who we share data with
We use the following service providers. Where a provider acts on our behalf, it may use the data only to provide its service to us.
| Provider | Role | What they do | Data | Location |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Service provider (processor) | Application hosting, database, backups, logs, and service email (Amazon SES) | All data held by Gemma | London, UK (eu-west-2) |
| Cloudflare | Service provider (processor) | Content delivery, DNS and security for gemma-finance.com and the Gemma app | IP address and request metadata. Traffic to the site and app passes through Cloudflare. | Global network, including the USA |
| Finexer | Independent controller for its own open-banking service | Gets account, balance and transaction data from your bank once you authorise it, then passes it to Gemma. See Finexer's privacy notice. | Bank data, and the details you give Finexer and your bank | See Finexer's privacy notice |
TypeSafe (Jev, model jev-latest) | Service provider (processor) | Suggests transaction categories during sync when merchant details are weak | Merchant name, description, amount, currency, merchant category code, provider category, transaction type, account type, and our list of category names. We do not send your name or email address. | See "International transfers" |
| Google Cloud Vertex AI (Gemini models) | Service provider (processor) | Writes the spending Agent's replies and the weekly digest narrative | Your Agent questions, and the transactions, budgets, goals and categories needed to answer them | London, UK (europe-west2) |
| Stripe | Processor for payment processing. Independent controller for its own fraud prevention and legal compliance. | Checkout, card payments, invoices, Customer Portal, subscription updates | Name, email, card details (entered directly with Stripe), billing details, subscription and payment history | See "International transfers" |
We also fetch published exchange rates from Frankfurter (European Central Bank reference rates). Our servers send only currency codes and dates, not personal data.
We may also share data with professional advisers (such as accountants and lawyers) under a duty of confidentiality, with regulators or law enforcement where the law requires it, or with a buyer or successor if our business is sold. In a sale, we would tell you first.
AI providers and training. We do not use your Gemma data to train a public AI model. Google Cloud Vertex AI (Gemini models) and Jev process data only to provide the features described above. Requests to Google Cloud Vertex AI (Gemini models) are processed in the London (europe-west2) region. Google may keep prompts and responses for a limited time for abuse monitoring, as set out in its terms.
International transfers
We aim to keep your data in the UK. Some providers process data outside the UK. Where they do, we rely on the provider's contractual safeguards, such as:
- UK adequacy regulations, for example for the EEA, or for US organisations certified to the UK Extension to the EU-US Data Privacy Framework
- the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
| Provider | Where data may be processed outside the UK |
|---|---|
| Cloudflare | Global edge locations, including the USA |
| Stripe | The USA |
| Google Cloud Vertex AI (Gemini models) | London, UK (europe-west2) |
| TypeSafe (Jev) | Where it processes data outside the UK, the safeguards above apply |
| AWS | We use London (eu-west-2) |
You can ask us for more information about these safeguards using the contact details above.
How long we keep data
| Data | How long |
|---|---|
| Account, profile, bank connection, transactions and household money data | While your account is open. Deleted when you delete your account. |
| Agent conversations | Stored in Gemma's database so you can see your chat history, until you delete a conversation or delete your account. |
| Monthly Agent usage counts | While your account is open. Deleted when you delete your account. |
| Email verification codes | Short-lived: about 20 minutes. |
| Password and MFA reset tokens | Short-lived. They stop working once used or expired. |
| Sign-in sessions | Until you sign out or they expire (Django's default session lifetime is two weeks). |
| Server logs | 30 days |
| Database backups | 7 days on a rolling basis. Backups are an encrypted copy of the database, so data you delete can remain in backups for up to 7 days before it is overwritten. We do not restore deleted data from backups except to recover the service, and if we do, we delete it again. |
| Stripe customer and invoice records | Kept by Stripe so invoice history is not destroyed, under Stripe's own retention and legal obligations. We do not delete the Stripe Customer when you delete your account. |
| Stripe webhook event IDs | May remain as technical idempotency records. They are not a copy of your household data. |
| Support emails | Kept for as long as we need them to deal with your request and any follow-up. |
Your rights
Under UK GDPR you have the right to:
- Access. Ask for a copy of the personal data we hold about you.
- Rectification. Have inaccurate or incomplete data corrected.
- Erasure. Ask us to delete your data.
- Restriction. Ask us to limit how we use your data.
- Data portability. Receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
- Objection. Object to processing based on our legitimate interests.
- Withdraw consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing already done.
- Automated decisions. Not to be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
In Gemma you can:
- Edit your name and currency in Settings.
- Download a JSON file from Settings → Your data ("Export personal data"). It includes your username, email, profile name, dates, whether MFA is enabled, default currency, a subscription status summary, linked bank labels, account names, and counts of household data. It does not include password hashes, MFA secrets, Finexer connection tokens, account numbers, sort codes or Stripe IDs.
- Download your full payment history as a CSV from the Transactions page. The JSON export points at that download rather than listing every transaction.
- Disconnect individual bank accounts from the Accounts tab without deleting your Gemma login.
- Delete your account permanently from Settings → Your data → Delete account. This removes your Gemma user and cascaded household data: bank connections (including encrypted tokens for the Finexer connection), transactions, categories, budgets, goals, digests, Agent conversations and usage counts, notifications and the local billing record. Stored sessions for your user are flushed, so you are signed out and an old login cookie cannot stay signed in. If a Stripe subscription is on file and Stripe is configured, we ask Stripe to cancel it immediately so billing does not continue. If Stripe is unreachable, local deletion still goes ahead.
For anything the product screens do not cover, including a full copy of everything we hold about you, email support@gemma-finance.com. We will reply within one month. For complex requests we may extend that by up to two more months and will tell you why. We may need to verify that the request comes from the account holder. Exercising your rights is normally free.
Complaints. Please contact us first so we can try to help. You also have the right to complain to the ICO, the UK data protection regulator: ico.org.uk/make-a-complaint, or phone 0303 123 1113.
Security
We protect your data with measures including:
- encryption in transit (HTTPS with HSTS)
- encryption at rest for the database, cache and backups
- additional encryption for bank connection tokens and MFA secrets
- Argon2 password hashing and optional authenticator-app sign-in
- sign-in rate limiting
- a database that is not reachable from the internet
- separation of each user's data
If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the ICO within 72 hours of becoming aware of it. If the risk to you is high, we will tell you without undue delay.
Cookies
Gemma uses only cookies that are strictly necessary for the service: a consent cookie, the session cookie, a security (CSRF) cookie and a short-lived message cookie. We do not use advertising or analytics cookies. See our cookie notice for details.
Children
Gemma is a household finance product. It is not aimed at children. Do not create an account for someone who cannot lawfully use Open Banking or enter a contract for this service. If you think a child has created an account, contact us and we will delete it.
Changes to this policy
We may update this policy when the product or the law changes, and the date at the top will change. If we make a material change, such as a new purpose, a new category of provider, or a change to where data is processed, we will tell you by email or in the app before it takes effect, unless the law or an urgent security reason requires a faster change. If we ever need your consent for a change, we will ask for it.