Privacy Policy
DueSave — Privacy Policy
Effective date: 16 August 2026 Last updated: 16 August 2026
1. Who we are
DueSave ("DueSave", "we", "us", "our") is a savings-planning and reminder application that helps individuals and families prepare for recurring obligations (such as visa and Emirates ID renewals, insurance, car registration, school fees, rent and traffic fines) by planning monthly savings toward each one and receiving reminders before due dates.
DueSave is operated by Tarek M Talal Alkurdi, an individual based in Dubai, United Arab Emirates, operating under the name "DueSave" ("the operator"). The operator is the data controller responsible for the personal data described in this policy.
Contact for privacy matters: info@duesave.com
2. The most important thing to understand about DueSave
DueSave is a manual-entry planning tool. It is not a bank, a payment service, or a regulated financial service, and it does not:
- connect to your real bank accounts or use open-banking;
- move, hold, or have access to any of your actual money;
- store your bank credentials, card numbers, national ID numbers, passport numbers, or driving-licence numbers.
Every amount in DueSave is a number you type in yourself to plan with. The "accounts" and "balances" in the app are labels and planning figures you create — not live financial data. This design means we collect far less sensitive data than a typical finance app.
3. The personal data we collect
3.1 Data you provide directly
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Email address; password (stored only as a secure hash, never in plain text) | To create and secure your account and to sign you in |
| Family member data | Names, relationship (self / spouse / child / other / employee), and optional dates you choose to add (date of birth, ID expiry, passport expiry, driving-licence expiry, insurance renewal). No document or ID numbers are stored. | So you can organise obligations by person and receive relevant reminders |
| Obligation & planning data | Obligation names, categories, target amounts, due dates, monthly plans, and free-text notes you write | The core function of the app — planning your savings and reminders |
| Manual ledger data | Account labels you create, deposit/withdrawal entries, amounts, dates and notes you record | To let you track planned savings against self-defined "accounts" |
| Preferences | Currency, timezone, reminder settings, whether email reminders are on or off | To deliver the service the way you configure it |
| Support communications | Anything you send us by email | To respond to and resolve your query |
3.2 Data collected automatically
- Technical and usage data — such as pages visited, device/browser type, approximate region (derived from an anonymised/truncated IP address), and basic in-app events, collected through Google Analytics 4 (via Google Tag Manager) and our hosting providers to keep the service running, secure and improving. See §9 for how analytics consent works.
- Device push token — when you use the DueSave mobile app and opt in to push notifications, your operating system issues the app an anonymous device token (via Firebase Cloud Messaging on Android). This token is stored only so we can send you reminder and account notifications. It is not linked to advertising identifiers, is not used for tracking, and is removed from our systems when it becomes invalid or when you sign out or uninstall the app as applicable.
- Cookies and similar technologies — strictly necessary cookies to run the app (for example, to keep you signed in) and limited analytics. See §9.
3.3 Data we deliberately do not collect
We do not collect national ID, passport, or licence numbers; real bank account numbers or balances; full payment card numbers; or precise location tracking. Payment card details are handled entirely by our payment processor, Paddle (see §5) — we never see or store your full card number.
4. Data about other people (including children)
DueSave is intended for users aged 18 and over. It is not directed at children, and we do not knowingly allow anyone under 18 to create an account.
DueSave does let you add family members — who may include children — as people you are planning obligations for. When you do this, you enter that limited information (a name, a relationship, and optionally some dates). You are responsible for having the right to provide it and for its accuracy. We only ever store the details you choose to add, and never any ID or passport numbers. If you believe a child's data has been entered without authority, contact info@duesave.com and we will help remove it.
5. Payments
Paid subscriptions are sold and processed by Paddle.com Market Limited ("Paddle"), acting as our merchant of record. This means:
- Paddle is the seller of record for your subscription and processes your payment directly. Your card and billing details are collected and handled by Paddle under their privacy policy and security standards — DueSave never receives or stores your full payment card details.
- We receive only limited billing-related information from Paddle, such as your subscription status, plan, billing country, and a partial card reference (for example, the last four digits) — enough to give you the right access and support, not to process payments ourselves.
- Paddle calculates and collects any applicable VAT or sales tax globally as part of the merchant-of-record arrangement.
For details of how Paddle handles your data, see Paddle's privacy policy at https://www.paddle.com/legal/privacy.
6. How we use your data and our legal bases
We use your data to:
- provide the app and its core features (planning, tracking, reminders);
- create, secure and manage your account, and authenticate you;
- send you service and reminder emails (for example, reminders before your obligations are due, and account/security emails);
- provide customer support;
- keep the service secure, prevent abuse, and debug problems;
- comply with legal obligations; and
- improve the app.
Where the EU/UK GDPR applies, our legal bases are: performance of a contract, legitimate interests (security, fraud prevention, improving the service), consent (where required, e.g. non-essential analytics), and legal obligation. Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, we process on equivalent lawful bases, principally performance of our agreement with you and your consent. You can withdraw consent at any time where processing relies on it.
We do not sell your personal data, and we do not use it for third-party advertising.
7. Who we share your data with (our processors)
We do not sell your data. We share it only with service providers ("processors") who help us run DueSave, under contracts requiring them to protect it and use it only on our instructions:
| Provider | Purpose |
|---|---|
| Lovable / Lovable Cloud | Application hosting and backend orchestration |
| Supabase | Database, authentication and secure storage |
| Google (Google Analytics 4 & Google Tag Manager) | Website analytics and tag management to understand usage and improve the service |
| Resend | Sending reminder and transactional emails |
| Mailgun (via Lovable) | Sending account/authentication emails |
| Cloudflare | DNS and network delivery |
| Google Firebase (Firebase Cloud Messaging) | Delivering push notifications to the mobile app |
| Paddle | Payment processing (merchant of record — see §5) |
| Apple App Store / Google Play (when native apps launch) | App distribution and, if used, in-app purchases |
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety or property of DueSave, our users, or others.
8. Where your data is processed (international transfers)
DueSave is offered worldwide, and our infrastructure providers operate in multiple regions, including the European Union and elsewhere. Your data may be transferred to and processed in countries outside your own, including outside the UAE and the EEA. This includes push-notification delivery, which is handled by Google Firebase and may process device tokens outside your country.
Where we transfer personal data internationally, we rely on appropriate safeguards — such as processing in jurisdictions recognised as adequate, or contractual protections such as the EU Standard Contractual Clauses.
9. Cookies and analytics
We use:
- Strictly necessary cookies — required to run the app and keep you securely signed in. These cannot be switched off.
- Analytics cookies — we use Google Analytics 4 (GA4), managed through Google Tag Manager, to understand how visitors use our website and to improve the service. These set cookies and collect usage data such as pages visited, approximate location (derived from IP, which Google truncates/anonymises), device and browser type, and in-app events.
- Consent — for visitors in the EU, EEA and UK, we ask for your consent before setting analytics cookies: analytics are disabled by default and only activated if you click "Accept" on our cookie banner. You can decline, and you can change your choice at any time via the cookie settings link in the footer. For visitors outside these regions, analytics cookies may be set by default, in accordance with applicable local law.
We do not use advertising or cross-site tracking cookies. Google Tag Manager is used solely to manage our own analytics; it does not, by itself, collect personal data.
10. How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account, we delete the personal data associated with it — including your family members, obligations, ledger entries and notes — and this cannot be undone. We may retain limited records where the law requires it (for example, tax or billing records held by Paddle), and short-lived technical logs for security, which are then deleted or anonymised.
11. How we protect your data
We apply measures including: encryption of data in transit; passwords stored only as secure hashes; row-level security enforced at the database level, so each account can only access its own data; restricted, server-side-only access to administrative credentials; and rate-limiting of sensitive actions. No system can be guaranteed perfectly secure, but we work to protect your data with appropriate technical and organisational measures.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, export/receive a copy of, object to or restrict processing of your data, to withdraw consent, and to complain to your local data protection authority.
To exercise any of these, email info@duesave.com; we will respond within the time required by law. Many rights can be exercised directly in the app: you can edit your data at any time and permanently delete your account and all associated data from account settings.
13. Changes to this policy
We may update this policy from time to time. For material changes we will update the "Last updated" date and, where appropriate, notify you by email or in the app. Continued use after an update means you accept the revised policy.
14. Contact us
Email: info@duesave.com Operator: Tarek M Talal Alkurdi, Dubai, United Arab Emirates, operating as "DueSave"