Privacy policy
Effective from 13 October 2026
This policy explains what personal data AdActa processes, why, for how long and what rights you have. AdActa is designed to know as little about you as possible: the content of events (names, participants, amounts) is encrypted in your browser and reaches the server only in encrypted form.
Who processes your data?
The controller of personal data is: P.M., aa bb.
Contact for data protection matters: info (at) adacta.sk.
What is good to know first
- The content of an event (title, participants, expenses, deposits) is stored on the server only in encrypted form. The key is derived from the event password in your browser and is never sent to the server.
- The controller therefore cannot read the content of events, not even at the request of an authority or a user. It also means that we cannot recover a lost event password.
- The server only sees technical data: which user accounts (e-mail addresses) are members of an event and in what role, when the event was changed, how many records it has and its optional unencrypted label, if you enter one. The participant names written in an event, that is, who owes whom how much, are not visible to the server.
- We use no advertising, no analytics and no tracking cookies.
What data do we process, why and on what basis?
Account
e-mail, password, language, registration date and last sign-in date
- Purpose and legal basis
- Running the account and providing the service (contract, Art. 6(1)(b) GDPR)
- Note
- The e-mail is stored encoded on the server and decoded only to send a message, to show it in your account, in invitations to members of your events and in the administration for the service administrator. We store the password only in irreversible form.
Two-factor authentication
(if you turn it on)
- Purpose and legal basis
- Securing the account (contract)
- Note
- The secret is stored encoded, backup codes in irreversible form. It is mandatory for the service administrator.
Signing in
session (cookie), a shortened fingerprint of the IP address and a shortened browser name
- Purpose and legal basis
- Keeping you signed in and protecting the account (contract, legitimate interest in security, Art. 6(1)(f))
- Note
- We do not store the IP address in readable form, only as an irreversible shortened fingerprint. A session expires after 30 days of inactivity.
Events
encrypted records, members and their roles, optional event label
- Purpose and legal basis
- Providing the service (contract)
- Note
- The event label is the only piece of information about an event that the server sees unencrypted. Do not put anything sensitive in it.
Participant e-mail
(optional, entered by the event organiser)
- Purpose and legal basis
- Inviting a person who has an AdActa account to the event (legitimate interest of the organiser and the participant, Art. 6(1)(f))
- Note
- The server stores only an encoded fingerprint for matching with accounts. The readable copy is in the encrypted event record, which can be read only by someone who knows the event password. AdActa sends no messages to this address.
Invitations
- Purpose and legal basis
- Giving the invited person access to the event (legitimate interest)
- Note
- The invited person sees the organiser's e-mail and the event label. They see the content of the event only after entering the password that the organiser sends them.
System e-mails
(address confirmation, password reset, inactive account notice)
- Purpose and legal basis
- Providing the service (contract)
- Note
- We send them through the mail server of our hosting provider.
Event logs and attempt limits
(sign-ins, password changes, abuse attempts)
- Purpose and legal basis
- Security and protection against abuse (legitimate interest)
- Note
- Type of event, time and a shortened IP fingerprint. No event content.
Attachments
photos and PDFs (receipts, invoices) attached to expenses
- Purpose and legal basis
- Providing the service (contract)
- Note
- The file and its name are encrypted in your browser with the event password; the server sees only encrypted bytes and their size. Photos are shrunk and stripped of metadata (such as location) before upload. Only event members who know the password can open attachments.
AdActa Plus
expiry date, administrator's note, Plus request, payment record (PayPal order number, amount, date)
- Purpose and legal basis
- Providing a paid feature (contract), meeting accounting obligations
- Note
- The payment is processed by PayPal, which only tells us the result and the transaction number. We neither see nor store your card or PayPal account details. We keep the payment record for as long as accounting rules require; it is disconnected from you when the account is deleted.
If you enter another person's e-mail in an event, you are responsible for having a reason to do so (for example, they are a co-participant to whom you want to give access to the settlement).
Do we use cookies?
We use only what the service strictly needs, so we do not ask for cookie consent.
- Cookie
ads: sign-in (HttpOnly, 30 days of inactivity). - Browser storage (
adacta-keys): keys of events you unlocked, so that you do not have to enter the password every time you open them. They stay only on your device and are deleted when you sign out or press “Forget on this device”. ad_theme: your choice of light or dark appearance.- App cache (service worker): stored app files so that the app loads faster.
Fonts are hosted by us; we load nothing from advertising or analytics services.
Who do we share data with?
- Payments: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), or the bank or service (PayPal, Revolut) you use to pay by transfer or link, only if you buy AdActa Plus. You pay with them and we only receive the payment confirmation, and for a bank transfer the payer's name and IBAN as provided by the bank.
- Hosting and e-mail provider: Websupport, s. r. o. (Slovakia). It runs the server and the mail server. It has no access to the content of events because it is encrypted.
- Exchange rates: if you use a currency other than the euro in an event, your browser downloads the rate from frankfurter.dev (European Central Bank data). This hands your IP address and the currency code to that service; AdActa sends nothing else.
- Members of your event: they see the content of the event according to their role and the event password.
We do not sell personal data or share it for advertising.
How long do we keep data?
- Account and events: until you delete them or as long as you keep signing in. Deleting the account also deletes the events you own.
- Inactive account: if you do not sign in for 12 months, the account and the events you own are deleted automatically. About 30 days before, we send you a notice by e-mail and signing in is enough. If an event also has another member with an active account, the event is not deleted and passes to that member. Accounts with valid AdActa Plus are not deleted.
- Unconfirmed registration: 7 days.
- Sessions: 30 days of inactivity.
- Event logs: 12 months. They are anonymised when the account is deleted.
- Attempt limits: a few days.
- Handled invitations: 90 days.
- Attachments (photos and PDFs attached to expenses): deleted automatically 12 months after upload (the period is shown when the event is created) and immediately when the expense, event or account is deleted.
Hosting backups are deleted according to the provider's rules.
AdActa is a small service and we cannot guarantee that it will run forever. If we ever shut it down, we will announce it in advance and give you time to save or print your settlements (PDF). Please keep important settlements outside the service as well. When the service ends, all data is deleted.
What are your rights?
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object. Contact us at info (at) adacta.sk. You can delete your account yourself in Settings.
You do not need to send us the content of your events or request it: you can see it yourself. We cannot read it, so we cannot hand it over either. You can print a settlement or save it as a PDF.
You can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk).
How do we protect data?
We encrypt the content of events in the browser (AES-256-GCM, key derived from the event password). Communication uses HTTPS. Passwords are stored in irreversible form and you can turn on two-factor authentication. Sensitive data on the server (e-mail, secrets) is encoded with a key that is not in the database. No system is perfect, so use strong passwords and do not share an event password publicly.
Children
AdActa is not intended for people under 16.
What if this policy changes?
We may update this policy. The current version will always be on this page with its effective date.