Privacy Policy

1. Introduction

Welcome to Bríq (“we,” “our,” or “us”). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

Bríq is designed and built in Ireland, by Irish, for an Irish audience. We comply with the General Data Protection Regulation (GDPR) and Irish data protection laws.

2. Data Controller

Patrick Carroll is the data controller responsible for your personal data, and operates the Bríq app.

3. Information We Collect

3.1 Information You Give Us

Your name and email address, to create your account
Profile information you choose to provide
Financial information you enter: income and tax details, budgets, transactions, savings goals and bills
A first name and an age band for each child profile you set up in Kids Zone

3.2 Information We Record When You Use the App

Security and activity records: the action taken, the time, your IP address and your device’s browser identification string
Diagnostic reports when the app hits an error or crashes
A device token, if you turn on notifications, so a reminder can reach your device

We do not measure how you use features, and we do not build usage profiles or audience reports. The app contains no measurement or advertising software of any kind.

3.3 Consent Records

Your consent choices
The IP address and time at which you gave or changed them
The version of the wording you agreed to, and your language

3.4 Bank Account Information

If you connect a bank account, we hold the connection itself — which bank, when you consented and when that consent runs out. Your account names and balances are read from your bank each time you open the screen and shown to you. We do not store your balances, and we do not store or receive your transaction history. We never see your bank login details.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract: to provide the app — your account, tax calculations, budgets, bills and Kids Zone
Consent: for connecting a bank account, for notifications, for marketing emails, and for setting up a child profile
Legitimate Interest: to keep the app secure, to investigate suspected misuse of accounts, and to find and fix faults
Legal Obligation: to keep the records data protection law requires us to keep

Where we rely on your consent, you can withdraw it at any time. Withdrawing it does not undo anything we did while it was in force.

5. How We Use Your Information

Provide and maintain app functionality
Process tax calculations and financial insights
Track Kids Zone progress and achievements
Send you reminders you have asked for, such as a bill falling due
Send important updates about the app
Find and fix faults, using diagnostic reports
Respond to your requests and support enquiries
Send marketing communications (with consent)
Keep the app and your account secure
Comply with legal obligations

6. Data Sharing and Disclosure

We do not sell your personal data, and we do not share it for advertising.

Service providers. We use the processors below, each under a data processing agreement, and share only the data each one needs to do its job. This is the complete list.

Supabase — our database, sign-in system and backend. Holds your account details, all of your app data, and your audit and consent records. Stored in the EU region.
Postmark — sends our authentication emails, such as confirming your address and resetting your password. Receives your email address and the content of that email.
Apple — provides Sign in with Apple. If you use it, Apple handles the sign-in and tells us only what you release to us, which may be a private relay email address rather than your own.
Google — provides Sign in with Google. If you use it, Google handles the sign-in and gives us your Google account name and email address.
Yapily — our regulated open banking provider, used only if you choose to connect a bank account. Yapily carries the connection between us and your bank. See section 6.1.
RevenueCat — manages subscriptions and purchases. Receives your account identifier and your purchase and entitlement data.
Expo — builds and releases the app, and delivers push notifications. Receives your device’s notification token if you turn notifications on.
Sentry — crash and error monitoring. Receives diagnostic error reports; configured not to attach personal identifiers, IP addresses, or device identifiers, with additional server-side scrubbing of personal data before events are stored.
Resend — delivers the emails you choose to send through the app: broker enquiries, parental consent requests, and partner applications. Receives the recipient’s address, the content you compose (which may include financial figures you have entered), and your own email address.
ElevenLabs — text-to-speech narration for Kids Zone lessons. Receives the lesson text to be converted to audio, and no personal data.
ipify — a lookup service that tells us the public IP address your device is using, so that we can record it in the security and activity records described in section 3.2. Receives your IP address.

We also disclose personal data in these situations:

Legal Requirements: When required by law or to protect our rights
Business Transfers: In connection with a merger or acquisition
With Your Consent: When you explicitly agree to share data

6.1 Connecting a Bank Account

Connecting a bank account is optional and happens only when you ask for it. It works through Yapily, a regulated open banking provider.

The connection is read-only. Nothing in the app can move money, and no payment can be initiated.
You give consent at your own bank, not to us. Your bank login details are never seen by us or by the app.
Open banking consent lasts 90 days. After that the connection stops working until you renew it, and the app will ask you to reconnect.
The access token for the connection is held in your device’s secure storage and on our server in encrypted form. It is never sent back to the app.
Account names and balances are read live and shown to you. We do not store your balances, and we do not store your transactions.
You can disconnect a bank at any time in the app. Disconnecting withdraws the consent and deletes the stored token.

7. Data Retention and Deletion

While your account is open, we keep your data for as long as you have an account, so that the app can show it back to you.

When you ask us to delete your account, we schedule the deletion for 30 days later. You can cancel it in the app at any point during those 30 days. When the 30 days are up, your sign-in account is deleted and everything attached to it is deleted with it, including your profile, your budgets, transactions, savings goals, bills and reminders, your calculator history, your child profiles and all Kids Zone progress, your subscription record, and your consent records. None of it is recoverable, and nothing is held back for a later date.

Full instructions, including how to ask us if you can no longer sign in, are at https://briq.ie/delete-account/

Records we keep after deletion. Three kinds of record are not attached to your account and so are not deleted with it: security records, activity and audit records, and app performance records. Your user identifier is removed from them when your account goes.

⚠ You should know that removing the identifier does not make these records anonymous. They still contain the IP address and the device browser identification string recorded at the time, and a free-text description of what happened, and those can point back to a person. We are telling you this rather than describing the records as anonymous, because they are not. We keep them for 12 months from the day each record is created and then delete them. We keep them that long to investigate security incidents and to show a regulator how data in the app has been handled.

Parental consent requests. When you ask for parental consent for Kids Zone, we record the request — the parent’s email address, the child’s age, the time, and the IP address it came from — so that we can show the consent was given. This record is kept for 12 months and then deleted. It is not attached to your account, so it is not removed by deleting your account; email us if you want it erased sooner.

Two things we cannot delete for you. A subscription bought through the App Store or Google Play is cancelled there, not here — deleting your Bríq account does not cancel it. A bank connection should be disconnected in the app before you delete your account.

8. Your Rights Under GDPR

You have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate data
Right to Erasure: Request deletion of your data
Right to Data Portability: Receive your data in a structured format
Right to Restriction: Limit how we process your data
Right to Object: Object to certain processing activities
Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, go to Settings → Your Data Rights, where you can see, export and delete your data yourself. You can also email privacy@briq.ie. We answer within one month.

Deleting your account: you can delete your account in the app at any time via Settings → Your Data Rights. Instructions are also published at https://briq.ie/delete-account/, including how to request deletion if you can no longer sign in.

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

HTTPS/TLS encryption for data in transit
Encryption at rest for stored data
Secure token storage using platform-specific secure storage
Row Level Security (RLS) on database tables, so one account cannot read another’s data
Optional multi-factor authentication and biometric unlock on your account
Regular security audits and updates
Your account and app data held on EU-based servers (Supabase EU region) — see section 10 for how other processors are handled

10. International Data Transfers

Your primary personal data — your account, your app data, and your audit and consent records — is stored in the EU region of our backend provider, Supabase.

Some of the other processors listed in section 6 may process limited data outside the European Economic Area (EEA). Where that occurs, the transfer is governed by appropriate safeguards — such as Standard Contractual Clauses — under our data processing agreements with those providers.

11. Children’s Privacy and Kids Zone

Kids Zone teaches children about money. A child does not have their own account: a parent or guardian sets up a child profile inside their own account, and the parent stays in control of it.

Parental consent. Under GDPR Article 8 a child cannot give valid consent on their own, and Ireland sets the digital age of consent at 16. So for anyone under 16, a parent or guardian must consent before we create a child profile or handle any of the child’s information. We ask for that consent by email to the parent, and we record that it was given — see section 7.

What we hold about a child. Only what Kids Zone needs:

A first name or nickname, whatever the parent types in
An age band — 6–8, 9–11 or 12–14 — not a date of birth
A chosen avatar picture
Progress: points, level, streak, lessons finished, badges earned, quiz and challenge counts, and the pretend money balance used in the lessons

We do not ask for a child’s surname, date of birth, address, photograph, school or contact details. A child profile cannot sign in, cannot send a message, and cannot be contacted through the app. Lesson narration audio is generated from the lesson text only, and no child’s information is sent to produce it.

Who can delete it. The parent or guardian whose account holds the profile can delete a child profile at any time in Kids Zone, which erases that child’s progress with it. Deleting the parent’s account deletes every child profile in it. A parent can also email privacy@briq.ie to have a child’s data erased, and can withdraw their consent at any time.

12. Local Storage and Tracking

Bríq is a mobile app, not a website. It does not set browser cookies. This section explains what is stored on your device, what diagnostic data we collect, and how you control it.

12.1 Storage on Your Device

The app stores some information locally on your device so that it can work at all:

Login session: your authentication tokens, held in your device’s secure storage (iOS Keychain / Android Keystore), so you stay signed in between app launches
Bank connection token: if you connect a bank, the access token is held in the same secure storage
App settings: your preferences, including language and accessibility options
App data: information needed for the app to display your budgets, calculations and progress

This storage is required for the app to function. It stays on your device, it is not used to track you, and it is not shared with advertisers.

12.2 Diagnostics

When the app encounters an error or crashes, a diagnostic report is sent to Sentry, our error-monitoring processor described in section 6. Sentry is configured not to attach personal identifiers, IP addresses or device identifiers, and reports are additionally scrubbed of personal data before they are stored. Diagnostic data is kept only as long as needed to investigate and fix the fault.

12.3 No Advertising or Cross-App Tracking

Bríq contains no advertising. We do not use advertising identifiers, we do not track you across other apps or websites, and the app contains no third-party advertising, measurement or tracking software. We do not profile you, and no decision about you is made automatically.

12.4 Managing Your Consent and Your Data

You control how your data is used, and you can change your choices at any time:

Consent: go to Settings → Privacy & Security → Consent Preferences to review or change the consents you have given
Your data: go to Settings → Your Data Rights to access, export or delete your data
Notifications: go to Settings → Notifications, or turn them off for Bríq in your phone’s own settings
Bank connection: disconnect it on the Bank Accounts screen

Withdrawing a consent does not affect the parts of the app that need your data to work, such as staying signed in or saving your budgets.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices:

General enquiries: support@briq.ie
Privacy and data requests: privacy@briq.ie

15. Supervisory Authority

You have the right to lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: www.dataprotection.ie