Privacy Policy

SaveMyBudget is a service operated by IK Ventures Ltd, a company registered in England and Wales, Company Number 09477473, with a trading address at 843 Finchley Road, London, NW11 8NA (“we”, “us”, “our”).

This policy explains what personal data we handle, why, and what rights you have. We handle personal data in accordance with the UK GDPR and the Data Protection Act 2018. You can get in touch about anything in this policy via our contact form.

We do not sell, rent or trade any data. This covers all personal data we handle, whether we are acting as controller or processor, and all data received from Google APIs or Shopify. We do not exchange data for money or any other benefit. We do not share it for cross-context behavioural advertising. We do not pass it to data brokers, advertising networks or anyone building marketing profiles.

Click and Ads data is used only to identify and report invalid clicks. The click telemetry our tag collects and the Google Ads data you connect are processed only to:

• detect and score invalid or fraudulent ad clicks;
• help you block the sources of invalid clicks, where you have given that permission;
• prepare and file refund claims with Google on your behalf; and
• report findings and results back to you.

We do not use this data for advertising, audience building, analytics products, retargeting, or training generalised or third-party models. The only data shared across customers is the pooled abuse signals described in section 8, and those serve the same purpose.

The sub-processors listed in section 9 receive data only to run this service for us, under contract.

We act in two different capacities, and it matters which one applies to you:

• Controller. For visitors to savemybudget.io, waitlist signups and people who email us, we decide why and how the data is used. This policy governs that processing. This also covers merchants who install our Shopify app: the store details Shopify shares with us at install and the SaveMyBudget account we create from them.
• Processor. For click telemetry collected by our tag on our customers' own websites, our customer is the controller and we act on their documented instructions under a data processing agreement. If you visited a customer's website, their privacy notice governs that data; we process it only to detect invalid clicks and support refund claims for that customer.

This is a deliberate, auditable guarantee about the design of our tag:

• It never reads page content.
• It never reads the values typed into form fields.
• It never records which keys are pressed — only that a keydown occurred, and when.
• It never reads passwords, card numbers or payment details.
• It cannot modify the host website; it is asynchronous, error-contained and read-only with respect to the page.

Where a customer connects their Google Ads account to SaveMyBudget via OAuth, the data we access is used solely to detect invalid clicks, prepare and file refund claims, and report results back to that same customer. We never sell Google user data, never use it for advertising, and never use it to train generalised or third-party models.

SaveMyBudget's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Legitimate interests — for fraud prevention, detection and network security. UK GDPR expressly recognises processing strictly necessary for fraud prevention as a legitimate interest. You have the right to object to processing based on legitimate interests (see section 12).
• Consent — for marketing emails and waitlist updates. You can withdraw consent at any time, without affecting processing carried out before withdrawal.
• Contract — where processing is necessary to deliver the service a customer has signed up for.

Threat signals derived from traffic we observe — offending IP addresses, subnets, device fingerprints and ASNs — are pooled in aggregated, pseudonymised form so that a fraudster caught in one account can be blocked for every account.

Client business data never crosses customer boundaries. Campaign names, keywords, spend, conversions, claim outcomes and any other commercial information stay with the customer they belong to. Only abuse signals are shared, and they are not attributed to the customer whose traffic revealed them.

We do not sell personal data (see section 2). We share it only with:

• Cloudflare — edge network, request handling and DDoS protection.
• Neon — managed Postgres database hosting.
• Fly.io — application and worker hosting.
• MaxMind — IP intelligence and geolocation lookups.
• Resend — transactional and waitlist emails.
• Google — when we submit and correspond about invalid-click refund claims on a customer's behalf. Each claim includes the evidence for its clicks: Google's click ID, IP address, time, network, country and browser.
• Shopify — for merchants who install our Shopify app: app installation, the theme app embed that delivers our tag, and any billing for the app, which Shopify handles under its own terms and privacy policy. We do not receive your payment card details.
• Professional advisers and authorities, where we are legally required to disclose.

Our database and application servers are in London, UK. Cloudflare handles each request at its nearest edge location, which can be outside the UK, and keeps our raw click archive in its EU jurisdiction. Resend, our email provider, stores the emails we send and their delivery records in the United States.

Where a sub-processor requires a transfer outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework for certified US providers such as Resend. Where none applies, we rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures.

• Raw click telemetry including IP address and user-agent: 90 days. This aligns with Google's 60-day claim window plus a buffer for adjudication.
• IP addresses of clicks in a claim we file with Google: kept with the claim's evidence until 12 months after Google's decision, then deleted. If the claim is never filed, they are deleted 90 days after we confirmed it; if Google has not decided 12 months after filing, they are deleted then. We send them to Google with the claim, as Google asks for them when it reviews invalid clicks.
• Per-device visit history on each site (a pseudonymous device key with daily counts of ad clicks and visits, but no IP address or page content), used to tell returning visitors from repeat clickers: 31 days.
• IP addresses in IP blocks you choose: kept while the block is active in your Google Ads account, and for 90 days after it ends.
• Deleted data can stay in our database host's restore history for up to 7 days.
• Aggregates, detection outputs and threat signals: retained longer in pseudonymised form to keep detection effective.
• Waitlist data: retained until you withdraw or ask us to delete it.
• Records we must keep for accounting or legal reasons: retained for the statutory period.

Under UK GDPR you have the right to:

• Be informed about how your data is used.
• Access a copy of the personal data we hold about you.
• Have inaccurate data rectified.
• Have your data erased, where the conditions are met.
• Restrict processing in certain circumstances.
• Data portability for data you provided to us.
• Object to processing based on legitimate interests, including profiling.
• Withdraw consent at any time, where consent is the legal basis.
• Not be subject to solely automated decisions producing legal or similarly significant effects.

To exercise any right, get in touch via our contact form, selecting “Privacy / data request”. If your data was collected on a customer's website, we will pass your request to that customer as controller and support them in responding.

We use encryption in transit, access controls scoped to least privilege, isolated per-customer data boundaries, audit logging and regular dependency review. No system is perfectly secure, but we design for containment: our tag cannot alter the host page, and our services fail safe rather than fail open.

Support access. To investigate a question or problem you raise, or to check that detection is working correctly, a small number of authorised SaveMyBudget staff can view your account read-only. Each access is limited to one account, is time-limited, must record a reason, and is logged. Staff cannot change your settings, connect or disconnect services, or file anything on your behalf while viewing.

Our landing page uses only essential cookies needed to serve and secure the site. We do not run advertising or cross-site tracking cookies on savemybudget.io.

The fraud detection tag itself relies on server-side logging and stores nothing on the visitor's device — no cookies, no local storage, no persistent identifiers written to the browser.

What the app does. The SaveMyBudget Shopify app adds our tag to your online store as a theme app embed. You switch it on or off in your theme editor; nothing is edited in your theme code. The embed loads the same tag described in section 4(b) and section 5, so the same limits apply: it stores nothing on your shoppers' devices, never reads page content or form values, and is used only to distinguish genuine ad clicks from invalid ones.

Who is responsible for what. For click telemetry collected on your store, you are the controller and we are your processor, as set out in section 3; our data processing agreement applies. For your store details and your SaveMyBudget account, we are the controller.

Shopper consent and device access. The embed does not read any consent signal: not Shopify's customer privacy settings, not your consent tool, and not Do Not Track or Global Privacy Control. While the embed is switched on, the tag runs on every page load. It stores nothing on your shoppers' devices, but it does read device characteristics (canvas, WebGL, fonts, screen size, time zone and browser properties) to compute the device fingerprint described in section 4(b).

Whether the tag runs before or after consent is your decision as the controller. UK GDPR recognises fraud prevention as a legitimate interest (Article 6(1)(f) and Recital 47; see section 7). The rules on accessing information on a device apply separately (regulation 6 of PECR in the UK, Article 5(3) of the ePrivacy Directive in the EU) and may require your shoppers' consent. Meeting them is your responsibility as the site owner. This section is not legal advice.

Shopify privacy requests. We implement Shopify's mandatory privacy webhooks. Our tag never receives a Shopify customer ID, email or name, so we hold no data keyed to an individual shopper: a customer data request or customer redaction request forwarded by Shopify is acknowledged and answered with “no records held”. A shop redaction request, which Shopify sends 48 hours after you uninstall, deletes your store's click telemetry, detection outputs and Ads reconciliation data on receipt and anonymises the account record.

Uninstalling. Uninstalling the app switches monitoring off. Data already collected is retained under section 11 and then deleted, or earlier when Shopify sends the shop redaction request. Reinstalling restores the same account.

Billing. If fees apply to the Shopify app, they are billed by Shopify as charges on your Shopify invoice, under Shopify's payment terms. We never see or store your payment card. Our Terms of Service, section 7, sets out when a fee is payable.

We may update this policy as the product develops. The “last updated” date at the top of this page always reflects the current version, and we will notify customers of material changes.

IK Ventures Ltd, 843 Finchley Road, London, NW11 8NA. The quickest way to reach us is our contact form.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve it with you first.