Privacy Policy

Ultimo aggiornamento: April 27, 2026 · CKM Finance

1. Data Controller

The Data Controller for personal data collected through the CKM Finance Personal mobile application is:

CKM Software S.R.L.
Registered office: Via Postumia 9, 76125 Trani (BT), Italy
VAT: [registration pending]
Italian fiscal code: [registration pending]
Privacy email: [email protected]

CKM Software S.R.L. is the dedicated newco for the CKM Finance Personal application and is currently in the incorporation pipeline. Registration data (VAT, fiscal code, REA, share capital) will be published as soon as the notarial deed is filed. To exercise rights under Reg. EU 2016/679 (GDPR) please contact the legal representative pro tempore of CKM Software S.R.L. at the email address above. We will respond within 30 days as required by law.

2. Data Collected

2.1 Data provided directly by you

• Email address and password (for registration and authentication)
• First and last name (optional, for profile personalisation)
• Financial data entered voluntarily: income/expense transactions, current account and card balances, property data, investment portfolio, mortgages
• Usage preferences and app configuration
• Content of conversations with the AI Assistant (processed by Anthropic Claude)
• Images of receipts and documents uploaded for the scanner feature (processed by Anthropic Claude)

2.2 Data collected automatically

• Crash and performance data (only with explicit consent, via Firebase Crashlytics)
• Anonymous usage analytics (only with explicit consent, via Firebase Analytics)
• Device identifier for push notifications (Firebase Cloud Messaging)
• Bank connection data via Open Banking PSD2 (only if activated by you, via finAPI)

2.3 Data NOT collected

• Advertising ID — we do not use behavioural advertising
• Precise geolocation data
• Biometric data
• Data from third-party sources not authorised by you

3. Purposes of Processing

• Service delivery: account management, authentication, data sync across devices, core app features
• Tax and financial calculations: local and cloud processing of entered data to provide tax estimates, budget forecasts and asset analysis
• AI Assistant: processing questions asked to the assistant to provide contextualised answers based on your financial data
• Document scanner: analysing images of receipts and documents for automatic data extraction
• Service improvement: aggregate and anonymous analysis to improve user experience (only with consent)
• Service communications: technical notifications, important security updates, tax deadlines
• Marketing communications: newsletters and promotions (only with separate explicit consent)
• Legal obligations: data retention as required by applicable law

4. Legal Basis for Processing

• Contractual performance (Art. 6.1.b GDPR): for service delivery and all app features
• Consent (Art. 6.1.a GDPR): for analytics, marketing, crash reporting and Open Banking
• Legitimate interest (Art. 6.1.f GDPR): for application security, fraud prevention and technical service improvement
• Legal obligation (Art. 6.1.c GDPR): for mandatory tax and legal compliance

5. Sub-Processors and Data Recipients

Your data may be processed by the following sub-processors, each subject to appropriate contractual safeguards:

We do not sell, rent or transfer your personal data to third parties for marketing purposes.

6. Data Retention

• Account data: for the duration of the contractual relationship and up to 5 years after termination
• Financial data entered: for the duration of service use; deletable upon request at any time
• AI conversations: not permanently stored; processed in real time and not archived on our servers
• Consent records: for 5 years from the date of consent
• Security logs: for 12 months
• Analytics data: in anonymous/aggregated form, without time limit

You can request deletion of all your data at any time by writing to [email protected] or using the "Delete account" feature in the app settings.

7. International Data Transfers

Some sub-processors are based in the United States. Data transfers to non-EU countries take place on the basis of:

• Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914)
• EU-US Data Privacy Framework (where applicable)
• Adequate technical and organisational safeguards (encryption in transit and at rest)

8. Your Rights

As a data subject, you have the following rights under the GDPR (Arts. 15–22):

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to restriction (Art. 18): restrict processing in certain circumstances
• Withdrawal of consent: withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, write to [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

9. Cookies and Tracking Technologies

The mobile app does not use cookies. The website ckmapp.com uses only:

• Strictly necessary technical cookies: for website operation (session, language preferences)
• Anonymous analytics cookies: only with explicit consent, via Cloudflare Analytics (privacy-first, no fingerprinting)

We do not use profiling cookies, behavioural advertising or third-party tracking pixels.

10. Minors

The service is intended for users who are at least:

• 16 years old in the European Union and United Kingdom (under GDPR and UK GDPR)
• 13 years old in the United States (under COPPA)
• 18 years old in the United Arab Emirates (under UAE PDPL)

We do not knowingly collect personal data from minors below the thresholds above. If you believe a minor has provided data without consent, contact us at [email protected].

11. Non-EU Jurisdiction Provisions

United Kingdom (UK GDPR)

For users in the UK, processing is carried out in accordance with the UK Data Protection Act 2018 and UK GDPR. The Information Commissioner's Office (ICO) is the competent supervisory authority.

United Arab Emirates (UAE PDPL)

For users in the UAE, processing is carried out in accordance with Federal Decree-Law No. 45/2021 on Personal Data Protection (UAE PDPL). The minimum age to use the service is 18 years.

California, USA (CCPA/CPRA)

For California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• We do not sell personal data to third parties
• You have the right to know what data we collect, request its deletion, and not face discrimination for exercising these rights
• To exercise CCPA/CPRA rights: [email protected]

12. Changes to This Policy

We reserve the right to modify this Policy at any time. In case of material changes, we will notify you via:

• In-app notification requesting acknowledgement
• Email to your registered address (for significant changes)

The "Last updated" date at the top of the page indicates the current version. Continued use of the app after notification constitutes acceptance of the changes.

13. Contacts

For any request related to the processing of your personal data:

CKM Software S.R.L.
Via Postumia 9, 76125 Trani (BT), Italy
VAT: [registration pending]
Italian fiscal code: [registration pending]
Please address any request to the legal representative pro tempore.
Privacy email: [email protected]
General email: [email protected]

We will respond within 30 working days of receiving your request.