Privacy Policy — ATHE: Sổ Thu Chi AI

1. Introduction

Athelab ("we," "us," or "our"), the operator of ATHE: Sổ Thu Chi AI (formerly "ATHE Money"), is the data controller responsible for your personal information when you use the App (the "App"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information.

We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and United Kingdom, the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) for California residents, and Vietnam's Cybersecurity Law and related regulations.

By using the App, you acknowledge that you have read and understood this Privacy Policy. If you have any questions, please contact us at customer-service@athelabs.com.

2. Information We Collect

We collect the following categories of information:

Category	Examples	Source
Account Information	Email address, display name, profile photo or avatar photo you upload	You provide directly
Financial Records	Transaction amounts, categories, descriptions, payment methods, dates	You create within the App
Photos & Receipt Images	Images you capture or select from your device (e.g., receipts, profile and group avatar photos)	You provide via camera or photo library
Audio Recordings	Voice recordings you create to describe expenses	You provide via microphone
Group Data	Group memberships, split details, shared expense records, member activity	You create or are added to groups
Device & Technical Data	Device type, operating system, App version, IP address, and diagnostic logs that our infrastructure providers may generate when you use the App	Automatically collected by us and our service providers
Authentication Data	Firebase Authentication tokens, Google Sign-In credentials	Third-party authentication providers

We do not collect bank account numbers, credit card numbers, or government ID numbers through the App.

      Permissions: The App may request access to your camera, photo library, and microphone only when you choose features that need them (e.g., receipt capture, voice expense entry). You can deny permissions, but those features will not work.
    

3. How We Use Your Information

We use your information for the following purposes:

Provide and maintain the App: To enable expense tracking, reporting, group management, and recurring fee reminders;
Authentication: To verify your identity and secure your account;
Communication: To send you service-related notifications, updates, and support responses;
AI-assisted features: To transcribe voice input, extract expense details from text or images, and suggest categories or amounts (you can review and edit results before saving);
Improvement: To diagnose technical issues, maintain security, and enhance App features;
Security: To detect and prevent fraud, abuse, or unauthorized access;
Legal compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

If you are in the EEA or UK, we process your personal data based on the following legal grounds:

Contractual necessity: Processing necessary to provide the App services you requested;
Consent: Where you have explicitly consented (e.g., optional profile photo upload);
Legitimate interests: For app improvement, security, and fraud prevention, balanced against your rights;
Legal obligation: Where required by applicable law.

You have the right to withdraw consent at any time, though this may affect your ability to use certain features.

5. AI-Assisted Processing

When you use optional AI features (such as receipt scanning, voice transcription, or automatic expense extraction), we send the relevant content to our servers and to OpenAI for processing. Depending on the feature, this may include:

Photos or receipt images you upload;
Audio recordings you create;
Transcribed text or descriptions you provide.

AI-generated suggestions (such as amount, category, or payment method) are not guaranteed to be accurate. You are responsible for reviewing and confirming information before saving a record. We do not use your data to train public AI models; processing is performed to provide the App's features under our agreements with service providers.

6. Data Storage & Security

Your account and financial data are stored using Google Firebase (Firebase Authentication and Cloud Firestore). Profile photos, receipt images, and audio files are stored in Cloudflare R2 object storage, accessed through our secure upload service (Cloudflare Worker). These providers use industry-standard measures including encryption in transit and access controls.

We implement additional safeguards such as:

Firebase Security Rules to restrict data access to authenticated users;
Authenticated uploads so media is scoped to your account;
Regular review of access permissions and data handling practices.

Despite our efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Third-Party Services

We use the following third-party service providers to operate the App:

Google Firebase — Authentication, Cloud Firestore database, and Firebase Cloud Functions;
Google Sign-In — Optional social authentication (if you choose to sign in with Google);
Sign in with Apple — Optional authentication on iOS (if you choose to sign in with Apple);
Google AdMob — In-app advertising (app-open ads shown by default);
Cloudflare — Secure media upload and storage (R2) for profile photos, receipt images, and audio files;
OpenAI — AI transcription, image understanding, and text extraction for optional smart-entry features.

These providers process data on our behalf under contractual terms and have their own privacy policies. We encourage you to review:

Google / Firebase Privacy
Google Privacy Policy (Sign-In, AdMob)
Apple Privacy Policy (Sign in with Apple)
Cloudflare Privacy Policy
OpenAI Privacy Policy

8. Data Sharing & Group Features

When you create or join a group within the App:

Other group members can see your display name, profile photo, and shared financial contributions;
Group expense records, split calculations, and settlement statuses are visible to all group members;
Group owners have administrative privileges including the ability to remove members;
You are responsible for ensuring you have the right to share any information you post within a group.

Beyond group functionality, we do not sell, rent, or trade your personal information to third parties for marketing purposes.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 For All Users

Access: Request a copy of the personal data we hold about you;
Correction: Update or correct inaccurate or incomplete data;
Deletion: Request deletion of your personal data (subject to legal retention requirements);
Account deletion: Delete your account entirely through the App's profile settings.

9.2 For EEA / UK Users (GDPR)

Right to object: Object to processing based on legitimate interests;
Right to restrict processing: Request limitation on how we use your data;
Right to data portability: Receive your data in a structured, machine-readable format;
Right to withdraw consent: Withdraw consent at any time;
Right to lodge a complaint: File a complaint with your local data protection authority.

9.3 For California Residents (CCPA/CPRA)

Right to know: Request disclosure of the categories and specific pieces of personal information collected;
Right to delete: Request deletion of personal information subject to certain exceptions;
Right to opt-out: Opt-out of the sale or sharing of personal information (we do not sell your data);
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at customer-service@athelabs.com. We will respond within 30 days (or the period required by applicable law, such as 45 days for certain California requests).

10. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the App's services. When you delete your account:

Your authentication data is removed from Firebase Authentication;
Your personal profile data is deleted or anonymized;
Financial records within groups may be retained in anonymized form where necessary for the legitimate interests of other group members (e.g., completed splits), unless all members request deletion.

We may retain certain information as required by law or for legitimate business purposes such as fraud prevention, security, and legal compliance.

11. Children's Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at customer-service@athelabs.com and we will take steps to delete such information.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States, Singapore, and Vietnam, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission;
Adequacy decisions where applicable;
Data processing agreements with our service providers.

13. Advertising, Analytics & Tracking Technologies

The App is a native mobile application and does not use browser cookies directly. The App displays ads using Google AdMob (currently app-open ads). AdMob and its partners may use device identifiers, IP address, and similar technologies to deliver and measure ads, subject to your choices.

Consent (EEA/UK and similar regions): We use Google's User Messaging Platform (UMP) to collect or record your advertising consent where required. You can change choices later via Profile → Legal → Ad privacy choices in the App.
App Tracking Transparency (iOS): On iOS, we may ask permission to track activity across other companies' apps and websites for personalized advertising. You can deny this and still use the App; ads may be less personalized.
Non-personalized ads: If you do not consent to personalized advertising or deny tracking, we request non-personalized ads where supported.

Our other providers (such as Google Firebase) may use device identifiers for authentication, security, and service operation. You can limit certain device-level tracking in your operating system settings (e.g., iOS Settings → Privacy & Security).

This Privacy Policy is available in English and Vietnamese. In case of any discrepancy, the English version prevails.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. Material changes will be communicated to you via the App or email at least 15 days before they take effect. We encourage you to review this policy periodically. Your continued use of the App after changes constitutes acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Athelab
Email: customer-service@athelabs.com

For users in the EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.