QuarterdayPrivacy Policy
How Quarterday collects, uses, stores, and protects personal information.
Last updated: 28 August 2026
At a glance
- We use personal information to provide, bill for, secure, and support Quarterday.
- Bank sync is optional. We identify the bank-connectivity provider before you begin a connection.
- We do not sell personal information or use it for third-party advertising.
- We do not use non-essential cookies or behavioural analytics.
1. Who we are and scope
Eigen Software Services Ltd, trading as quarterday.io ("Quarterday", "we", "us", or "our"), provides the Quarterday website and personal-finance service. Eigen Software Services Ltd is the controller of the personal information described in this notice where we decide why and how that information is used.
This notice applies when you visit quarterday.io, create or use a Quarterday account, use the hosted budgeting service, subscribe to a paid plan, contact us, or choose to connect a financial institution. It applies wherever you use the service. Depending on where you live, local law may give you additional rights.
2. Information we process and why
| Information | Source and purpose | Lawful basis |
|---|---|---|
| Website and technical information IP address, request and response information, timestamps, and browser or device information made available when you connect. | Collected from your device and our service providers to deliver the website and application, maintain reliability, investigate errors, and prevent abuse. | Our legitimate interests in operating and securing the service. |
| Account and security information Email address, password hash, email-confirmation status, account and login timestamps, verification and recovery attempts, and essential session information. | Provided by you or generated when you use the service. We use it to create and authenticate your account, send essential account messages, recover access, and protect accounts. | Performance of our contract with you; our legitimate interests in account and service security. |
| Subscription information Stripe customer and subscription identifiers, plan, price, billing interval, currency, subscription status, renewal status, and relevant dates. | Provided by you and Stripe. We use it to offer trials, administer paid plans, manage access and cancellations, and keep financial records. Stripe collects payment-card details directly; Quarterday does not receive full card numbers. | Performance of our contract with you; compliance with accounting, tax, and other legal obligations. |
| Hosted budget information Budget files, filenames, file sizes, encryption metadata, identifiers, timestamps, storage, and synchronisation metadata. | Provided by you and the Actual client. We use it to host, synchronise, restore, and secure your budgets. | Performance of our contract with you. |
| Bank-sync information The selected provider and institution, connection and consent status, protected connection credentials, account identifiers and names, balances, transaction amounts, currencies, dates, descriptions and counterparties, and sync status. | Obtained from you, your financial institution, and the bank-connectivity provider you select. We use it only to establish and maintain the optional connection and provide bank sync. | Performance of our contract with you when you request bank sync. |
| Communications Messages, attachments, and contact details you provide when requesting support or exercising a legal right. | Provided by you. We use it to answer questions, resolve problems, maintain records of requests, and protect our legal rights. | Performance of our contract with you; our legitimate interests in supporting the service and handling disputes; compliance with legal obligations. |
You must provide an email address and authentication information to create an account. Paid plans also require the information needed to establish a subscription through Stripe. Bank sync is optional: you can use other Quarterday features without connecting a financial institution.
3. Bank connections
Quarterday supports more than one bank-connectivity provider. The provider available to you depends on your country, financial institution, and the integrations enabled at that time. Before you start a connection, we identify the provider and give you access to its privacy information. The provider handles information collected during its authorisation flow under its own privacy notice.
Connecting a bank authorises us to obtain the accounts and transaction information you select. You can disconnect a connection to stop future collection. Disconnecting does not necessarily remove information already imported into Quarterday or an Actual budget; you can request deletion as described below.
4. Budget files and encryption
Quarterday protects hosted budget files using encryption in transit and at rest. We also use access controls, protected credentials, monitoring, and restricted administrative access to safeguard the service. These protections allow our systems to operate the service and are different from Actual's optional end-to-end encryption.
If you enable Actual's end-to-end encryption for a particular budget, that budget's contents are encrypted and decrypted on your device. For those contents, Quarterday receives and stores only ciphertext. End-to-end encryption is configured separately for each budget and does not cover your account details, subscription information, separately stored bank-sync records, or the operational metadata needed to store and synchronise the file.
5. Who receives information
We disclose only the information reasonably needed for the relevant purpose to:
- Stripe, to create checkout and account-management sessions and administer subscriptions;
- the bank-connectivity provider shown during connection, to connect the financial institution and retrieve the information you request;
- hosting, database, and encrypted object-storage providers in the European Economic Area;
- a transactional email provider, to deliver verification, recovery, billing, and service messages;
- an observability provider in the European Economic Area, to monitor reliability and security; and
- professional advisers, insurers, auditors, and authorities where reasonably necessary to obtain advice, establish or defend legal claims, or comply with law.
We do not sell or rent personal information or share it with third parties for their advertising. Payment and bank-connectivity providers also process information under their own privacy notices.
6. International transfers
Eigen Software Services Ltd is established in the United Kingdom, and Quarterday's core production services are located in the European Economic Area. Some payment, bank-connectivity, and email providers may process information elsewhere. Where data-protection law requires a transfer safeguard, we rely on an adequacy decision or approved contractual safeguards. Contact privacy@quarterday.io for more information about a particular transfer.
7. Retention and deletion
We keep personal information only for as long as it is needed for the purposes described above.
| Information | Typical retention |
|---|---|
| Account information and hosted budgets | While the account remains open. We may delete an account that has no active paid or plan-member access and has not been used for more than 12 months, after giving at least 60 days' notice by email. |
| Email verification, password recovery, and abuse-prevention records | Only while needed to complete the relevant workflow, secure accounts, and investigate suspected abuse. |
| Billing and accounting records | Up to six years from the end of the financial year to which they relate, or longer where law or an active dispute requires it. |
| Encrypted disaster-recovery backups | Retained for 90 days. |
When you delete your account, when we delete an inactive account after notice, or after the export period following termination, we delete its account information, hosted budgets, and bank-connection data from active systems. We may retain limited billing or account information where required by law or needed to prevent fraud or resolve a dispute.
Deleted information may remain in encrypted disaster-recovery backups until those backups expire, no later than 90 days after deletion.
8. Cookies and analytics
The Quarterday website does not currently use non-essential cookies. The application uses essential cookies and similar storage to authenticate you, protect requests, and maintain short-lived workflows such as setting up a bank connection. These are necessary to provide the service you request.
We do not use advertising cookies or behavioural analytics.
9. Your rights, complaints, and contact
Depending on your location and the circumstances, you may have rights to obtain a copy of your personal information, correct inaccurate information, request deletion, restrict processing, receive portable information, and object to processing. Some rights are limited where we must keep information by law or have another lawful reason to continue processing it.
You have the right to object to processing based on our legitimate interests. Tell us why you object and we will stop unless we have compelling legitimate grounds to continue or need the information for legal claims.
To exercise a right or ask a privacy question, email privacy@quarterday.io. We may need to verify your identity. We normally respond to UK and EU requests within one month, although the law permits extensions in some circumstances.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. If EU data-protection law applies, you may also complain to the supervisory authority where you live or work, or where you believe an infringement occurred.
We will update this notice and the date at the top when our processing changes. We will tell you about material changes where required.