Privacy policy

Version of 4 November 2026 (2026-11-04)

Omnikonto is an online service that brings together the statements of your bank accounts to show your balances, spending by category, subscriptions and budgets. This policy explains what data we process, why, who it is shared with and what your rights are.

1. Data controller

ALCHEM SOLUTIONS SAS (SIREN 942 011 800), establishment in France: 3 promenade Georges Méliès, 74960 Annecy, France. Contact for any question about your data: contact@omnikonto.com.

2. Data we process

• Account: email address, password (stored only as a cryptographic hash), two-factor authentication secret and backup codes, your name as it appears on bank statements, country of tax residence, language.
• Financial data you import: statement files, account numbers (IBAN), transactions (date, amount, currency, counterparty, description), categories, rules, budgets, valuations you enter.
• Technical data: IP address, date and page requested (server logs), log of actions taken in your account.

We do not seek sensitive data. However, statements may reveal it indirectly (for example a payment to a trade union or a health professional). Such information is only used to show you your own accounts.

3. Purposes and legal bases

• Providing the service: creating your account, importing and analysing statements, sending service emails (address confirmation, password reset) — performance of a contract (Art. 6(1)(b) GDPR).
• Securing the service: two-factor authentication, login attempt limits, logs, backups — legitimate interest (Art. 6(1)(f) GDPR).
• Artificial-intelligence recognition (statements from banks without a built-in format, sorting of “other expenses”) — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in “Settings”. Without consent, no data is sent to any AI service.

We do not sell your data, show ads, send marketing messages or use audience-measurement tools.

4. Recipients and processors

• OVH SAS (Roubaix, France) — hosting of the service (Gravelines data centre) and storage of backups (Strasbourg).
• Brevo / Sendinblue SAS (Paris, France) — sending service emails: only your email address and the content of those emails are shared.
• Anthropic PBC (United States) — only if you have given consent: the content of the statement to be recognised, or merchant names with a short excerpt of the description (without card numbers) to suggest a category. The transfer is covered by the European Commission's standard contractual clauses. Under its commercial terms, Anthropic does not use this data to train its models.

No one else has access to your data unless required by law.

5. Retention

• Account and financial data: for as long as your account exists. When you request deletion, they are erased from the service within 30 days and disappear from backups no later than 12 months afterwards, as backups are rotated.
• Technical server logs: 12 months at most.

6. Security

Encrypted connection (HTTPS), mandatory two-factor authentication, passwords stored as hashes. Statement files and account numbers are encrypted with a key specific to each user. Backups are password-encrypted before being copied off the server. Each user's data is strictly separated.

7. Your rights

You may request access to your data, rectification, erasure, restriction of processing and portability (a copy in a common format), and object to processing based on legitimate interest. You may withdraw your AI consent at any time, without affecting processing already carried out. Write to contact@omnikonto.com; we reply within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.

8. Cookies

We only use cookies that are strictly necessary: the session cookie (to keep you signed in) and the form-protection cookie (CSRF) and the cookie that remembers your chosen language. They do not require consent. No advertising or analytics cookies.

9. Minimum age

The service is for adults only (18 and over).

10. Changes

If we make a significant change to this policy, we will notify you by email before it takes effect. In case of discrepancy between language versions, the French version prevails.