Banking Notification Consent
How optional banking and wallet notification reading works and its privacy conditions.
B BLOCK · FOR USERS
Banking Notification Consent
Optional reading of banking / wallet notifications to generate transaction suggestions
BH-001-EN
| Data Controller | Mózer Ferenc (sole trader) |
| Registered address | 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Tax number | 41905517-1-23 |
| Contact (privacy) | privacy@cashleticsapp.com |
| Effective date | 12 October 2026 |
| Prepared by | Dr. Crespo Zsuzsanna | zsuzsanna@crespo.hu |
| Version | v1.10.2 |
| Governing language | Hungarian (BH-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. |
cashleticsapp.com/legal.php · Public user-facing document GDPR-compliant
|
1. Scope of Access — What the App Reads and What It Does NOT
1.1 What Cashletics reads
The Cashletics application reads the text of push notifications sent by your banking or financial service provider to your device. Specifically, the app processes:
the text content of the push notification (e.g. "Purchase: HUF 3,500 at XYZ Store")
the timestamp of the notification
the sender application name (e.g. "OTP Mobilbank") for categorisation purposes
1.2 What Cashletics does NOT access
|
1.3 Technical mechanism
Cashletics uses the Android Notification Listener Service (NotificationListenerService) API, which enables the app to read the text of notifications displayed on your device's notification bar. This permission must be explicitly granted by you in your device settings and can be revoked at any time.
1.4 In-app notice shown before access — verbatim
The text below is shown when the user switches on the „Automatic notification import” toggle under Profile → Settings (HJ-001-EN Section 6). Texts in quotation marks are the app's verbatim interface texts; the app displays the document version from the active legal configuration.
|
Tapping the toggle is not in itself consent. After the „Continue to settings” button — if there is no current consent — the server records the consent (bank_notification_accept event; bankNotificationConsent, bankPolicyVersion) and the import is switched on.
If Android notification access has not yet been granted, the app separately opens its settings page, where the user grants the system-level permission. A consent recorded in the app does not mean that the system-level permission has been granted.
The „Do not allow” button declines: Android's notification access setting is not opened.
To switch off: Profile → Settings → „Automatic notification import” toggle.
2. Legal Basis for Processing
The processing of banking notification data is based on your freely given, specific, informed and unambiguous consent, in accordance with:
Article 6(1)(a) of the General Data Protection Regulation (EU) 2016/679 (GDPR) — consent as the legal basis for processing
Article 7 GDPR — conditions for consent (freely given, revocable at any time without detriment)
|
3. Personal Data Processed
| Data category | Details |
| Notification text | Content of the push notification as displayed on screen (e.g. merchant name, amount, currency) |
| Timestamp | Date and time the notification was received |
| Sender app name | The name of the banking app that sent the notification (for categorisation) |
| Parsed transaction data | Amount, currency, merchant name — extracted automatically from notification text |
| Consent record | Date, time and version of consent given — stored in Cloud Firestore for GDPR Art. 7(1) demonstrability of consent |
3.1 Data minimisation
Cashletics processes only the data necessary for automatic transaction categorisation. Raw notification texts are parsed locally on your device; only the extracted structured data (amount, currency, merchant) is stored in the cloud. Original notification texts are not transmitted to our servers.
3.2 Sensitive financial data — no storage of account details
The app is designed to exclude account numbers, card numbers, and authentication credentials from any processing or storage. If a notification text contains such data, it is filtered out at the parsing stage before any data leaves your device.
4. Data Storage and Retention
| Data | Storage / Retention |
| Parsed transaction records | Cloud Firestore (Google LLC — physically stored in the eur3 European multi-region; EU-US DPF). Retained until account deletion or explicit user request. |
| Consent record | Cloud Firestore. Retained for 5 years from account deletion for GDPR accountability. |
| Raw notification texts | Processed locally on device only. Not transmitted to servers. |
Cloud Firestore is operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The data is physically stored in the eur3 European multi-region; the transfer to the USA — arising from the possibility of access by Google LLC — is based on the EU-US Data Privacy Framework (DPF). Google LLC is certified under the DPF. Further information: https://www.dataprivacyframework.gov
5. Data Processors
| Processor | Purpose | Location | Transfer basis |
| Google LLC / Cloud Firestore | Cloud storage of parsed transaction and consent data | USA (EU-US DPF) | EU-US DPF |
6. Your Rights as a Data Subject
Under the GDPR, you have the following rights in relation to your banking notification data:
| Right | How to exercise |
| Right of access (Art. 15) | Email: privacy@cashleticsapp.com |
| Right to rectification (Art. 16) | Email: privacy@cashleticsapp.com |
| Right to erasure (Art. 17) | In-app: Settings → Delete account, or email: privacy@cashleticsapp.com |
| Right to data portability (Art. 20) | Email: privacy@cashleticsapp.com — response within 30 days |
| Right to withdraw consent (Art. 7(3)) | See Section 7 below — withdrawal does not affect prior lawful processing |
| Right to lodge a complaint | Hungarian NAIH: naih.hu | ugyfelszolgalat@naih.hu | +36 1 391 1400 |
7. How to Withdraw Consent
You may withdraw your consent to banking notification processing at any time, without providing any reason, and without suffering any disadvantage. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
7.1 Withdrawing the device-level permission
Step 1: Open your Android device Settings.
Step 2: Navigate to Apps → Special app access → Notification access.
Step 3: Find Cashletics and toggle the permission off.
7.2 Withdrawing via the app
Open the Cashletics app → Profile → Settings → switch off the „Automatic notification import” toggle.
7.3 Effect of withdrawal
Upon withdrawal, the app will immediately cease reading banking notifications. Previously imported and categorised transactions stored in your account will not be automatically deleted — you may request their deletion separately by emailing privacy@cashleticsapp.com or by deleting your account.
|
8. Google Play Store Financial Data Policy Compliance
This consent statement has been prepared in accordance with Google Play's Financial Data policy and the Data Safety section requirements for applications that access financial or payment-related data.
| Play Store requirement | Cashletics compliance |
| Prominent disclosure before permission request | ✓ In-app consent dialog displayed before first notification access (see HJ-001-EN) |
| Explicit consent required | ✓ Tapping the in-app toggle is not consent in itself: the user consents with the „Continue to settings” button of the separate notice (Section 1.4), then grants Android notification access separately in the system settings |
| No sharing with third parties for advertising | ✓ Financial notification data is not shared with AdMob or any advertiser |
| Data Safety form disclosure | ✓ Declared under "Financial info → Other financial info" in Play Console Data Safety |
| Revocable permission | ✓ Revocable at device level and in-app at any time |
9. Contact and Data Controller Identity
| Data Controller | Mózer Ferenc (sole trader) |
| Registered address | 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Tax number | 41905517-1-23 |
| Privacy enquiries | privacy@cashleticsapp.com |
| General support | support@cashleticsapp.com |
| Phone | +36 30 728 4422 |
| Website | cashleticsapp.com/legal.php |
| Privacy Policy | cashleticsapp.com/legal.php?lang=en |
10. Governing Language and Version Control
|
| Version | Date | Changes | Approved by |
| v1.5 | 1 August 2026 | Initial version | Dr. Crespo Zsuzsanna |
| v1.7 | 1 August 2026 | Sybell registered address corrected (DPA-001); DPA-002 clause 3.6 breach notification narrowed + non-excludable liability categories; DPA-003 liability cap (12 months’ fees, min. HUF 500,000); publication date updated | Dr. Crespo Zsuzsanna |
| v1.8 | 1 August 2026 | Legal review approved (DPIA-001, LIA-001, PR-001; DPA-002 clause 3.6 + liability framework; DPA-003 liability cap). Signatures pending. | Dr. Crespo Zsuzsanna |
| v1.9 | 1 August 2026 | PiggyRun mini-game, Piggy Coin, entry ticket types (standard/silver/gold) and random reward packages (loot boxes) regulated; loot box gambling-law classification approved; gamification data elements extended (AT-001, ROPA-001); DPA-001 AdMob/Firebase acceptance dates; DPIA-001 I4 closed. | Dr. Crespo Zsuzsanna |
| v1.9.1 | 1 August 2026 | Sybell (DPA-002): instead of signing the draft agreement, Section 11.1 of Sybell’s GTC (20 July 2026, Art. 28(3) and (9) GDPR) governs the processing; references updated; GTC archived. | Dr. Crespo Zsuzsanna |
| v1.10 | 1 August 2026 | DPA-003 (Balázs Bánki): implementation of the developer comments — narrowing of the developer role and data categories, incident notification under Art. 33(2) GDPR, notification of unlawful instructions under Art. 28(3) GDPR, clarification of third-country transfers, deletion of the minimum liability floor. Addition of administrator feature switches and audit log (ROPA-001 row 17, 12-month retention); clarification of the admin interface access matrix (SZ-001 2.1). | [külön nem került jóváhagyásra — a v1.10.1 váltotta fel] |
| v1.10.1 | 6 August 2026 · suppl. 4 September 2026 and 5 September 2026 | EN terminology alignment (Article, Data Controller); implementation of the legal review decisions; data categories of the four undocumented collections in Section 4 of AT-001. Supplement of 4 September 2026: placeholder instead of a pre-filled signature date in unsigned copies (14 documents); GDPR Article 12(3) “without undue delay” wording implemented (AT-001 HU/EN, EJ-001); in DPIA-001 the retention of health data after withdrawal changed from 7 to 30 days, aligned with HE-001; corrected EU-US Data Privacy Framework reference in the English version of BH-001; in DPA-002 the processing relationship recorded as based on Section 11.1 of the Sybell GTC and the Controller's written instruction instead of a signature; column misalignment corrected in the Article 28 record of DPA-001. In addition: in ROPA-001 and ATJ-001 the number of recorded processing activities corrected to the actual 25 (previously 17 and 16 respectively); in the consent examples of HJ-001 the reference to the never-published AT-001 v1.8.3 corrected to the published v1.8. Implementation of the legal review decisions (4 September 2026): the assistance obligation under GDPR Article 28(3)(f) added as clause 3.7 of DPA-002 and clause 3.10 of DPA-003; in the Play Data Safety table of GPS-001, transfers to Firebase Analytics are no longer declared as sharing — consistent with the document's own conceptual distinction — and health and fitness data are no longer declared as required; Firebase Analytics (L1) and the aggregated analysis built on it (L3) removed from the scope of LIA-001, as their legal basis is consent, with the exclusion table extended accordingly; the incorrect reference to the Hungarian Infotv. removed from the age-limit reasoning of KK-001, together with the identical wording in GPS-001 and XHV-001; the response deadline in EJ-001 aligned with the public undertaking in AT-001 (60 days in total at most); an explanatory note added to the 30-day undertaking under Article 12(3); the Hungarian version of BH-001 supplemented with the description of third-country transfers; AT-001 now states the storage location of Cloud Firestore as the eur3 European multi-region, consistent with ROPA-001; the developer added to the list of processors in AT-001, and the instruction clause of DPA-003 extended with the transfer wording; in six places the term “anonymised” refined to “pseudonymised”. Based on the Controller's statement of 4 September 2026: two-factor authentication for the admin interface is recorded with its actual completion date (1 September 2026) instead of an expired deadline; the emergency shutdown access issued in the developer's name has not yet been activated, therefore the access matrix of SZ-001 and the transitional provision in clause 3.9.8 of DPA-003 record the current and the final state separately, listing the data actually accessible through that role; the revocation of the earlier project-level (Editor) permission is recorded. The data subject branch of INC-001 received the exemption grounds under GDPR Article 34(3), the retention period of ROPA item 06 was aligned with AT-001, an expired external reference was replaced, and header-row repetition was enabled for two multi-page tables in SZ-001. The duplicate logo on the first page — already present in the header — has been removed from the document body (29 documents); the header logo is unchanged and no document text was altered. Supplement of 5 September 2026: the package-level legal approval recorded in the version table. Supplement of 6 September 2026: based on the Controller's reply of 5 September 2026, the effective date of the package was changed from 1 August 2026 to 1 October 2026 (79 places; the applicability wording of DPA-003, the approval dates in D2-UGY and the dates in the version tables were deliberately left unchanged). Supplement of 6 September 2026 following the external quality review (P2), 37 confirmed findings: the Cloud Firestore storage location clarified as the eur3 European multi-region; consent record retention counted from account deletion. Supplement of 24 September 2026: the effective date of the package changed from 1 October 2026 to 12 OCTOBER 2026. Reason: under Section 14 of ASZF-001 and Section 9 of AT-001, users must be notified of changes at least 15 days before the effective date; publication and notification took place on 27 September 2026 (instead of the previously planned 25 September). The signature date of KK-001 and PR-001 is the day of publication. | Dr. Crespo Zsuzsanna |
| v1.10.2 | 3 October 2026 · suppl. 8 October 2026 | References aligned with HJ-001-EN v1.10.2 (based on the controller's technical deviation list of 2 October 2026): the banking notification import requests permission when the feature is switched on (HJ-001-EN Section 6). No change in substance in the English version. The effective date remains 12 October 2026. Supplement of 8 October 2026, before publication (based on the controller's technical answers of 3 October 2026): the in-app withdrawal path updated (Profile → Settings → Automatic notification import toggle); new Section 1.4 with the verbatim in-app notice and its sequence, aligned with Section 5 of the Hungarian version; the consent step in Section 8 clarified (the toggle alone is not consent). | Dr. Crespo Zsuzsanna |
Acknowledgement of Receipt
| Role | Name | Date | Signature |
|---|---|---|---|
| Prepared by | Dr. Crespo Zsuzsanna | ||
| Received / approved by | Mózer Ferenc |
Next scheduled review: 1 August 2027