Privacy Policy

1. Who we are

The data controller for the processing described in this Privacy Policy is Charlie Ikai, who runs Cindrus. Cindrus is a trading name, not a separate legal person.

• Charlie Ikai
• Trading name: Cindrus
• Address: Deltavej 369, 9000 Aalborg, Denmark
• Privacy contact: privacy@cindrus.com

This means that the data controller decides why and how your personal data is processed.

2. The short version

When you use Cindrus:

• we collect the information needed to create and operate your account;
• we process the financial information you choose to add to Cindrus;
• we use that information to provide calculations, monitoring and financial insights;
• we process limited technical and security information to keep Cindrus secure;
• we use service providers where necessary to operate Cindrus;
• we do not sell your personal data;
• we do not share your financial information with banks or commercial partners simply because you use Cindrus;
• when you import a loan statement, the file stays on your device — its text is read on our server, and nothing is saved;
• we use no analytics or advertising trackers in the app — our website cindrus.com uses Google Analytics only with your consent;
• you can export your data and delete your account in Settings; and
• you retain all rights provided to you under the GDPR.

The sections below explain this in more detail.

3. Information you give us

Account information

When you create and maintain a Cindrus account, we process:

• your name;
• your email address;
• your preferred language;
• your tax residence;
• your preferred currency;
• your birth year, if you provide it;
• a profile image, if you add one;
• account preferences, such as hiding amounts and your interest-deduction rate; and
• your subscription status, once paid plans exist.

Financial information

When you use Cindrus, you may choose to add information about your financial position. Depending on the features you use, this includes:

• mortgages and other loans;
• outstanding balances, interest rates, repayments and loan terms;
• properties and vehicles;
• savings, shares, crypto and pension;
• other debt; and
• calculations you save.

We process this information because it is necessary to provide the Cindrus features you request. Our legal basis is GDPR Article 6(1)(b): processing necessary to perform our agreement with you or take steps at your request before entering into an agreement.

4. What we use your financial information for

We use the financial information you add to Cindrus to provide the service. This includes:

• showing your financial position;
• performing calculations;
• comparing financial scenarios;
• calculating estimated costs or savings;
• monitoring interest rates for your loans;
• identifying possible refinancing opportunities; and
• notifying you about them in the bell inside Cindrus.

We do not use your financial information for unrelated purposes simply because we have access to it.

5. Importing a loan statement

You can import figures from a loan statement — a PDF, a Word document or an image.

The file itself never leaves your device. Your browser opens it and reads its text. For scanned documents and images, text recognition (OCR) also runs in your browser.

The text is then sent to our server, which finds the figures in it — such as the outstanding balance and the interest rate — in memory and sends them back to you. Neither the file nor the text is saved: not in our database and not in a log. This is enforced by automated tests.

Only the figures you then choose to save are stored in your account.

If reading fails, the error we record says where it failed — not what was being read.

Text recognition uses Cindrus' own copy of the recognition program: nothing is fetched from anyone else while your document is read.

If we later introduce document processing that works differently, we will explain it before the feature is used and update this Privacy Policy.

6. Technical information

When you use Cindrus, we process limited technical information necessary to operate and secure the service.

Session records

When you visit Cindrus — also before you sign in — our server creates a session. The session record holds a session identifier, which account is signed in, and when you were last active. It does not hold your IP address or your browser identification.

A session expires after 120 minutes without activity and is then deleted automatically, normally within a few hours. When you delete your account, your sessions are deleted at once.

Limiting repeated attempts

To limit repeated attempts — for example at sign-in — we keep a short-lived code derived from your IP address for a few minutes.

Error lines

If a request to our web server fails, it writes an error line: the time, the address that was requested, your browser's identification and other technical details your browser sends — and your IP address, shortened so that only its beginning remains (for example 87.60.0.0). If the request was a password-reset link, the code and the e-mail address in it are replaced before the line is written. We keep no log of ordinary visits. The error lines are deleted by amount, not by date: each part of our server keeps at most 30 MB of log, and the oldest lines are deleted first. Very few error lines are written, so that can take a long time — there is not yet a fixed deletion period in days; we are setting one, and this section will state it.

The app's error log

If something goes wrong inside Cindrus itself, the app writes an error message to its own log: what went wrong, and where in the code it happened. If a query to our database fails, the log says which query it was — not the values it was meant to store or find, such as your amounts or your e-mail address. This is enforced by automated tests against real database errors. The app's error log is deleted after 14 days. It is cleaned up once a day, so nothing in it is older than 16 days.

Company logos

Next to securities you have added yourself, we show the company's logo. Your browser fetches it directly from Logo.dev (img.logo.dev), as their service is designed. Logo.dev therefore receives your IP address and the security's identifier (the ISIN, or the stock ticker for US shares) — not your name, your holdings, amounts or which page you are on. Logos are fetched only for securities you own in Cindrus, never for suggestions in a search list. We send them nothing else, and we do not store their images.

Our legal basis is performance of our agreement with you (GDPR Article 6(1)(b)) or our legitimate interest in operating and securing Cindrus (Article 6(1)(f)).

7. Security log

We keep a security log of security-relevant activity, such as:

• successful and failed sign-ins;
• password changes;
• creation, modification or deletion of loans, assets and calculations;
• data exports; and
• account deletion.

The security log contains no amounts. It records that a field was changed, not what it was changed to. For example, it may record that a mortgage was changed without recording the old or new balance.

Your IP address is not stored in the security log as an address, but as a code that can only be compared with itself — so repeated failed sign-ins can be recognised without keeping where they came from.

The purpose is to detect and investigate misuse, protect accounts, investigate security incidents and help answer questions about activity on an account. Our legal basis is GDPR Article 6(1)(f): our legitimate interest in maintaining the security and integrity of Cindrus and protecting our users.

Security log entries are kept for 24 months and then deleted automatically. When you delete your account, everything in them that points to you is removed. The log cannot be edited, not even by us.

You can see your own entries in the file you download under Settings.

8. Cookies and local preferences

Cindrus uses these six cookies. All of them are our own:

• cindrus-session — keeps you signed in.
• XSRF-TOKEN — protects against forged requests.
• NEXT_LOCALE — remembers the language you chose. It is set only when you choose a language yourself.
• cindrus_theme — remembers the theme you chose.
• cindrus_hide_amounts — remembers whether you hide amounts. The same choice is also kept in your browser's local storage, under the same name.
• cindrus_lang_suggest_dismissed — remembers that you dismissed a language suggestion.

None of them is used to build advertising profiles, and none is shared with anyone.

Where a cookie is technically necessary for the service you requested, or only remembers a choice you made, it is our assessment that the applicable cookie rules do not require consent — which is why we do not ask. If we ever add analytics, advertising or other non-essential tracking, we will ask for consent first.

9. Analytics and advertising tracking

The Cindrus app uses no third-party analytics, advertising trackers or error-monitoring services. No Google Analytics, no Meta Pixel. Our website cindrus.com uses Google Analytics only if you allow it in the site's cookie choices; without that consent, nothing is loaded from Google. You can withdraw your consent at any time via the cookie settings at the bottom of cindrus.com.

Our pages load no scripts, fonts or images from other companies' servers — the text-recognition program included.

If this changes, we will update this Privacy Policy and obtain consent where required before using non-essential tracking.

10. Payments

Payment for a subscription is processed by our payment provider, Stripe.

Payment-card details are entered with Stripe and are not stored on Cindrus servers. We will store information such as your subscription, payment status, amount, currency, payment date, Stripe's reference to the payment, and what is needed for subscription administration and accounting.

We will process subscription and payment information to perform our agreement with you (GDPR Article 6(1)(b)), and accounting information we are legally required to keep under Article 6(1)(c).

Accounting records will be kept for the period required by Danish accounting legislation — 5 years from the end of the financial year — also if you delete your account. Information kept only because of a legal obligation is not used as part of your financial profile.

11. Emails

Cindrus sends the password-reset email when you ask for it, and emails about your subscription: the order confirmation when you start one, and a notice before your trial ends.

If we add other emails — such as security alerts or notifications you have switched on — we will describe them here first.

Our email delivery provider is Resend. It receives your email address, your name and the content of the message, so that it can deliver it. The legal basis is performance of our agreement with you (GDPR Article 6(1)(b)).

12. Marketing

We do not send marketing today. Creating a Cindrus account is not consent to receive marketing.

Where consent is required before we send marketing, we will ask for it separately, and you can unsubscribe at any time. If we process marketing information based on consent, the legal basis is GDPR Article 6(1)(a). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

13. Our service providers

We use these providers to operate Cindrus:

• Hetzner — hosting, database and backups. Our servers are in Nuremberg and Falkenstein, Germany.
• Resend — sending email.
• Stripe — payment processing, once paid plans exist.
• Logo.dev — company logos for securities you own; your browser fetches them directly (IP address and the security's identifier).

Where a provider acts as our data processor, it may process personal data only on our instructions and under a data-processing agreement. Some providers, including payment providers, may also act as independent data controllers for processing they carry out for their own legal and operational purposes.

14. Sharing your information

We do not sell your personal data. We do not provide your personal financial information to banks, lenders or other commercial partners simply because you have a Cindrus account.

We may disclose personal data:

• to processors that help us operate Cindrus;
• where you specifically ask us to share information with another provider;
• where necessary to provide a feature you request;
• where required by law;
• in response to a binding order from a competent authority;
• where necessary to establish, exercise or defend legal claims; or
• in connection with a corporate transaction, subject to applicable data-protection requirements.

If Cindrus introduces functionality that sends your financial information to banks, lenders, brokers or other financial providers at your request, we will clearly explain what will be shared before it is sent.

15. International data transfers

Our servers and our database are in Germany.

Our email provider Resend is set to process sending for cindrus.com in the EU (Ireland).

That setting covers the sending itself — not necessarily every access to the data. Resend is a US company, and support, troubleshooting and backups may still involve the United States. Where personal data is transferred outside the EU/EEA, an appropriate transfer mechanism under the GDPR must be in place — such as an adequacy decision by the European Commission (including the EU-U.S. Data Privacy Framework, where the recipient is certified) or the Commission's Standard Contractual Clauses with any additional measures required.

The data processing agreement with Resend is not yet in place, and it is what has to describe exactly that. We will state the mechanism here once it is.

You can contact privacy@cindrus.com for more information about the safeguards for a particular transfer.

16. Where your financial data is stored

Cindrus' production database is hosted in Germany, at Hetzner in Nuremberg. It is not accessible from the internet.

Access is restricted and limited to what is required to operate, maintain and secure Cindrus. We use technical and organisational measures designed to protect the confidentiality, integrity and availability of your information.

17. Backups

We back up the database every six hours so that Cindrus can recover from technical failures and serious incidents. A backup contains the whole database — including the session records described in section 6.

Since 6 September 2026, every backup is encrypted before it leaves the server, and the server itself cannot decrypt it.

Backups taken before 11 September 2026 also contain the IP addresses and browser identification that session records held until then.

Copies on the server are deleted after about 30 days. An encrypted copy is also kept in an archive with Hetzner in the EU, away from the server. That archive does not yet delete copies automatically. We are setting a maximum retention period, and this section will state it.

Unencrypted backups from 9 August to 6 September 2026, made before encryption was introduced, were removed from the archive on 11 September 2026. They still exist in the archive's snapshots until 21 September 2026. Some of them are also still on the server; the last one is removed on 8 October 2026.

Deleting your account removes your data from the live system at once. It remains in backups until they are deleted. Backups are for disaster recovery: we never restore a single deleted account from a backup.

18. How long we keep your information

We do not keep personal data indefinitely simply because it may be useful one day. Today:

• Account and financial data — while your account exists; deleted when you delete it.
• Imported statement text — not stored at all.
• Session records — until they expire, normally deleted within a few hours; at once when you delete your account.
• Security log — 24 months.
• Error lines in the web server's log — deleted when the log reaches its size limit, oldest first; no fixed period in days yet; being set.
• The app's error log — 14 days; cleaned up once a day, so nothing in it is older than 16 days.
• Backups — about 30 days on the server. The off-site archive: no automatic deletion yet; being set.
• Payment and accounting information, once paid plans exist — as required by Danish accounting legislation.

Where information must be kept because of a legal dispute, a security incident or a legal obligation, it may be kept for as long as reasonably necessary for that purpose.

19. Deleting your Cindrus account

You can delete your account under Settings. Deletion happens at once and cannot be undone.

It removes your account and your financial information from the live service — your loans, assets, calculations, preferences, the wishes you have sent us and your sessions — except information we must keep by law.

A wish is free text and can contain anything — names, amounts, addresses. We therefore do not keep it in an anonymised form: it is deleted with your account.

Your data remains in backups until they are deleted (section 17). We never restore a single deleted account from a backup.

20. Anonymous information

Cindrus keeps some information in a form that can no longer be linked to you:

• a count of questions our assistant could not answer; and
• aggregate figures, such as the number of accounts.

Once information has been genuinely and irreversibly anonymised, it is no longer personal data under the GDPR. We do not describe pseudonymised information as anonymous if we still have a realistic way of linking it back to you.

21. Automated calculations and insights

Cindrus uses software to perform financial calculations, comparisons and monitoring. This can result in automated insights such as “New loans are below your rate” — “The rate on new loans of the same kind was [x] percentage points below the rate on [your loan] in [month].”

These are information, meant to help you understand your financial situation. Cindrus does not, through these calculations, make a legally binding decision about you, such as approving or rejecting a loan — banks, lenders and other third parties make their own decisions under their own processes.

If Cindrus later introduces automated processing that produces legal or similarly significant effects within the meaning of the GDPR, we will provide the additional information and safeguards required by law.

22. Your GDPR rights

Depending on the circumstances, you have these rights:

• Access — to ask what personal data we process about you and receive a copy.
• Rectification — to have inaccurate personal data corrected.
• Erasure — to have personal data deleted where the GDPR gives you that right.
• Restriction — to have certain processing restricted where the GDPR provides for it.
• Objection — to object to processing based on our legitimate interests, and always to direct marketing.
• Data portability — to receive personal data you gave us in a structured, commonly used, machine-readable format, where the GDPR requirements are met.
• Withdrawal of consent — where processing is based on consent, at any time, without affecting processing carried out before.

Some of these rights are subject to conditions and exceptions under the GDPR.

23. Exporting your data

Under Settings, you can download a file with the information associated with your account.

This self-service export supplements — and does not replace — your rights under the GDPR. You can always write to privacy@cindrus.com to exercise any of them.

24. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, unlawful disclosure, alteration and destruction. They include, where appropriate:

• access controls and controlled administrative access;
• network restrictions;
• encryption in transit and of backups;
• secure authentication;
• backups;
• security logging;
• monitoring; and
• software updates.

No online system can guarantee absolute security, but protecting Cindrus and the information entrusted to us is a core part of how we operate.

25. Data breaches

If we become aware of a personal-data breach, we assess it under the GDPR. Where legally required, we notify the supervisory authority, and where a breach is likely to result in a high risk to the people affected, we notify them too.

26. Children

Paid Cindrus subscriptions are intended for adults aged 18 or over. Cindrus is not designed as a financial service for children. If we become aware that we have collected personal data from a child where we should not have, we will take appropriate steps.

27. Changes to this Privacy Policy

Cindrus will evolve, and this Privacy Policy may change with it. We will update the date at the top when we make changes, and if a change materially affects how we process your personal data, we will give appropriate notice before it takes effect where required.

28. Complaints

If you have concerns about how we process your personal data, please contact us first at privacy@cindrus.com, so we can investigate.

You also have the right to complain to the Danish Data Protection Agency (Datatilsynet) or another competent supervisory authority.

29. Contact

Questions about privacy or your personal data can be sent to privacy@cindrus.com.

• Charlie Ikai
• Trading name: Cindrus

Our privacy principles

We want the way Cindrus handles data to be as understandable as the financial information we present.

• Collect what we need.
• Explain why we need it.
• Protect it.
• Don't sell it.
• Don't share financial data just because we can.
• Give users meaningful control.
• Delete personal data when we no longer have a reason to keep it.

Financial intelligence requires trust. We intend to earn it.