Last updated 25 October 2026 / Version 2.1
MEIKE OG is the controller for the processing of personal data for which we are responsible as described in this policy. You can contact us at:
MEIKE OG
Lerchenstraße 5
5302 Henndorf, Austria
Email:
Website: https://www.mymicrobalance.com/
This policy covers our websites mymicrobalance.com and haushaltsbuch-app.com, the MyMicroBalance Windows application, and the Android and iOS apps. It covers basic use as well as PC VIP, mobile Premium and optional online and AI features. The processing relevant to you depends on the features you actually use.
This policy provides information about processing. Accepting our EULA or shop terms does not constitute blanket consent to advertising, analytics or AI processing. Where consent is required, it is obtained separately for the relevant purpose.
Personal data are information relating to an identified or identifiable person. Depending on your use, we process contact and account data, household and financial data, order, payment and entitlement information, technical usage and security data, and the content of your enquiries.
We assign the legal basis to the particular purpose:
Without the information necessary for a requested service, we may be unable to provide that service or may only be able to provide it to a limited extent. Optional information and convenience features dependent on consent are separate. Refusing analytics, advertising or AI consent does not prevent the available basic use of the budgeting software. Statutory requirements concerning minors' consent and representation remain applicable.
Where household data contain information about other people, we may also receive that information from the person entering it or sharing a household account. This comprises the relevant household or transaction details and any personal information they contain. If the individual is not our contracting party, Article 6(1)(b) GDPR does not justify processing merely on that account. Article 6(1)(f) GDPR may apply to necessary provision of the requested household features, based on the interest in that household management, unless overridden by the individual's rights; additional consent and protection requirements remain applicable. Those individuals retain their statutory rights.
We use IONOS to host our websites and provide email. IONOS SE is involved as the hosting provider. This entails processing website, communication and technical data necessary to provide, store and transmit the relevant information. The legal basis depends on the activity: Article 6(1)(b) GDPR for contractual and pre-contractual matters, and Article 6(1)(f) GDPR for secure, reliable operation and general communication. Further information: IONOS privacy information (https://www.ionos.de/terms-gtc/datenschutzerklaerung/).
Technical data arise when you access our websites and server-based software features. These may include the IP address, access time, requested resource, status messages, browser and operating system details, and referring page. We use necessary server logs to deliver content, maintain operations, and detect and investigate errors or attacks. The legal basis is Article 6(1)(f) GDPR; our interests are the functioning and security of our services and protection against abuse. Article 6(1)(b) GDPR also applies to necessary technical operations to provide an agreed service. Optional advertising and usage analytics are treated separately.
When you contact us by email, contact form or another channel, we process the contact details, messages and other information necessary to handle your enquiry. These may include your name, email address, purchase or entitlement details, and error descriptions you provide. Please send only information needed to resolve the matter.
Article 6(1)(b) GDPR applies to contractual and pre-contractual enquiries. We handle general enquiries under Article 6(1)(f) GDPR; our interest is appropriate communication and resolution. Processing through our email and hosting provider forms part of this process. Further disclosure takes place only where necessary for the relevant purpose and legally permitted.
Our websites use cookies and similar storage or access technologies for functionality, remembering your choices, analytics and advertising measurement. Cookies may contain identifiers allowing a browser to be recognised. Storage or access strictly necessary for a service is distinguished from optional analytics and advertising purposes.
Where consent is required for access to your device, the applicable rules include section 165(3) of the Austrian TKG 2021 and, where applicable, section 25 of the German TDDDG. Subsequent processing of personal data is subject to the GDPR legal bases specified for the activity. Optional analytics and advertising rely on your consent under Article 6(1)(a) GDPR. Article 6(1)(b) or (f) GDPR applies to necessary functionality, depending on its purpose.
The website cookie-choice record is configured for 365 days. Analytics cookies are intended to have a lifetime of up to two years; setting or updating a cookie again may restart its lifetime. Browser restrictions or manual deletion may shorten it. Section 11 explains the separate lifetimes for the planned OpenAI Pixel. Cookie lifetime, advertising attribution windows and server-side data retention are different periods.
You may withdraw consent at any time with effect for the future. You can also control, block or delete cookies through your browser. Deleting a cookie does not automatically erase data already transmitted to the recipient. Blocking necessary cookies may limit individual website features.
The Windows application lets you work with household-account files stored locally on your PC. These files are separate from online-feature data. When you use synchronisation, account management, licence verification, support or AI features, the data necessary for that activity are processed. Having a local file therefore does not mean that every additional feature processes data only locally.
A MyMicroBalance user account enables the designated online features. We process information provided during registration or in your profile, particularly your email address and, depending on the form, your name and address. This also includes internal account identifiers and necessary technical information such as registration time and IP address. Article 6(1)(b) GDPR applies to providing and administering the account. Necessary security and abuse checks rely on Article 6(1)(f) GDPR; our interest is to protect accounts and the service.
You can record income, expenses, categories, household accounts, entry descriptions and, where relevant, location details. For online management and synchronisation, we process the relevant content and its account and synchronisation associations. The legal basis is Article 6(1)(b) GDPR where necessary for the requested service. Our Azure SQL database data are stored in West Europe. Mobile synchronisation forms part of basic mobile use; the entitlements explained in the EULA apply to participation by the PC version.
To provide and verify PC VIP, we process necessary licence-key, term and status information and its purchase association. Each purchased key is independent and its term begins at purchase. Necessary entitlement administration is based on Article 6(1)(b) GDPR. Necessary checks against circumvention of licence terms may rely on Article 6(1)(f) GDPR; our interest is protection against unauthorised use.
The MyMicroBalance user account, household accounts within it and the Apple or Google store account are separate accounts. For mobile Premium purchases, we process purchase and status information necessary to verify and administer the entitlement in connection with the relevant platform. The legal basis is Article 6(1)(b) GDPR.
“Restore Purchase” restores an existing entitlement through the same purchasing platform and store account, independently of the MyMicroBalance user account. Transferring household data does not transfer a purchase entitlement to another platform. Apple and Google also process store and payment data for their own platform services.
If you share a household account with other people, they receive access to its data within the scope of the sharing features. The person sharing the account manages and controls the sharing arrangement. Processing necessary to provide your requested contractual service relies on Article 6(1)(b) GDPR; the additional conditions in section 2 apply to other people's data. Before sharing, check which information becomes accessible and whether you are entitled to disclose it.
The person creating a new sharing arrangement needs mobile Premium; invited people do not need their own Premium subscription merely to participate. Existing sharing arrangements remain after the Premium subscription expires. No additional household accounts can be newly shared without a renewed entitlement. Only the person sharing the account can synchronise that shared household account with the PC version.
If the person sharing the account deletes the household account or their user account, invited people lose access to that household account. If an invited person deletes their own user account instead, the entries they recorded remain available to the person sharing the account. The entries do not display who recorded them. This does not mean that all information within those entries is anonymous.
Statutory rights concerning a person's own personal data remain unaffected. Independent copies or exports on other people's devices are not automatically removed by server-side account deletion or termination of sharing.
We sell digital PC VIP keys through the webshop. We process necessary order, contact, payment and licence data to administer purchases, send keys automatically by email, and handle withdrawal, cancellation, defects and refunds. These include your name, email address, country, necessary billing details, order and payment references, and purchase and licence status. The legal basis is Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies to statutory retention. We retain order and invoice data, not a complete individual contract text.
We transmit the data necessary for payment to the payment provider you select. These may include contact and billing details, purchase amount, currency, order reference and technical payment information. This necessary processing relies on Article 6(1)(b) GDPR and does not require additional advertising consent.
The providers used are PayPal and Stripe. Their European providers include PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg and Stripe Payments Europe, Limited in Ireland. Other group companies may be involved depending on the service and your place of residence. The providers also process data as controllers in their own right, particularly for payment security, fraud prevention and legal obligations. Details of recipients, international transfers, retention and rights are explained by PayPal (https://www.paypal.com/de/legalhub/paypal/privacy-full) and Stripe (https://stripe.com/at/privacy).
Mobile Premium subscriptions are purchased through Apple or Google. The providers process data necessary for store accounts, payments and subscription management under their own information: Apple privacy information (https://www.apple.com/legal/privacy/) and Google privacy information (https://policies.google.com/privacy?hl=de).
Where we issue a refund directly or need to verify a purchase, we process the necessary purchase evidence, references, contact details and, where relevant, details of the agreed payment method for the refund. The basis is Article 6(1)(b) GDPR, supplemented by Article 6(1)(c) for statutory documentation obligations. Deleting a user account does not automatically stop store billing. To stop automatic renewal in the ordinary way, use subscription management in the relevant store. Statutory cancellation and termination rights against MEIKE OG and the additional mobile refund arrangement under clause 11.7 of the EULA remain unaffected. You may send these matters to ; clause 5.4 of the EULA also applies.
The AI features assist with usage questions, entering transactions and analysing selected household data. Processing covers your query and the information attached for the chosen feature. This may include income and expenses, entry descriptions, reporting periods, user language, and technical information such as Windows, app or program version and platform. You can review or select the content assembled for a query through the data preview.
Submit only information necessary for your query and which you are entitled to transmit. Information about other people may affect those people too; your own consent does not automatically replace any permission or consent required concerning them. Special categories of personal data, such as health data, are also subject to the requirements of Article 9 GDPR.
Where the application used offers voice input, speech is converted into text locally on the device; text is then transmitted to the AI. Answers and analyses are supporting suggestions. They do not by themselves constitute solely automated decisions producing legal or similarly significant effects within Article 22 GDPR. Check results before accepting or using them.
Optional transmission for AI processing relies on your consent under Article 6(1)(a) GDPR. Without this consent, no AI queries based on it take place; manual entry of household transactions remains available.
In the apps, you can withdraw AI consent under “User profile -> Consents”. On the PC, consent is managed in the AI feature area. You can display the data preview again there if you previously hid it. The option to stop showing a preview is separate from AI consent; showing or hiding it alone is not withdrawal. You may also withdraw consent by contacting without deleting your entire user account.
We use Microsoft Azure OpenAI for AI processing. The resource is located in West Europe. Microsoft provides the service within its Azure environment. According to the service description, queries and responses are not used to train the base models. Microsoft also describes content filters and service-side abuse monitoring; where relevant activity is flagged, this may include review by authorised Microsoft personnel. This processing is separate from our own logging.
Microsoft's privacy and processing terms explain service processing and contractual safeguards: Azure OpenAI privacy information (https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy), abuse monitoring (https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring) and Microsoft Data Protection Addendum (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
We retain technical request data relating to individual AI queries in our Azure SQL database in West Europe. These include internal transaction and user identifiers, query time, assistant used, query source, licence association and entitlement status, processing success and token consumption. These request data do not contain question or response texts.
We use necessary data to administer entitlements and allowances, count queries correctly and make subsequent allowance corrections under Article 6(1)(b) GDPR. Where necessary, the data also serve to investigate earlier technical support cases and possible circumvention of usage limits. The basis for this is Article 6(1)(f) GDPR; our interests are establishing what happened in individual cases and protection against allowance abuse.
The regular retention period is 90 days after the relevant query, insofar as the data remain necessary for that long. Deletion takes place in the daily automated run after the period expires; the data may remain stored until that run. Retention beyond the end of a month enables earlier cases to be addressed. The monthly reset of the usage counter is separate from deletion of these individual logs.
We retain the content of all AI queries and their responses to investigate technical errors and assess substantive response quality. Content logs also include the internal user association, recording time, assistant used, language and technical processing information. Necessary content logging for these purposes is based on Article 6(1)(f) GDPR. Our interests are investigating and correcting functional errors and checking response quality. Reviews are carried out manually by authorised MEIKE OG personnel.
A seven-day deletion threshold applies to content logs. A daily automated run removes records whose recording time is more than seven days earlier. In normal operation, they may therefore remain stored until the next daily run. Recording times and time comparisons use UTC. Where content is no longer necessary beforehand or a statutory erasure obligation applies, we arrange the required earlier deletion.
The request log also records the AI consent version associated with the query and the time of consent. To the extent these details are necessary to demonstrate consent, the basis is Article 6(1)(c) in conjunction with Articles 5(2) and 7(1) GDPR. The same regular 90-day period and subsequent daily deletion run apply as for the associated request log. This personal record is not retained separately for a longer period.
You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand on the basis of valid consent. No further AI queries based on that consent take place after withdrawal. The allowance already used is not reset by withdrawal.
Previously stored logs may be retained within the stated periods only insofar as this is necessary and lawful for a separately described purpose on an independent legal basis. Withdrawal does not extend any period. Where retention relies solely on consent and there is no basis for continued retention after withdrawal, we arrange the required erasure without undue delay. A change to this policy does not retrospectively change the legal basis for older data.
We handle individual enquiries, objections and erasure requests through ; necessary erasure may be carried out manually. Once consent has been validly withdrawn, no additional erasure request is needed for us to give effect to its legal consequences. You do not have to give up your entire user account to do so.
When you delete your user account, we immediately delete your associated AI content and request logs in our own systems, including the consent record they contain. Our log retention periods do not govern Microsoft's separate processing. Server-side user account deletion does not delete household-account files stored locally on your PC.
The PC application displays advertising graphics through our own server system. Loading a graphic connects to our server and entails processing technical connection data necessary for delivery. Article 6(1)(f) GDPR applies to necessary delivery and security activities, based on our interest in operating and protecting our own advertising system. This does not by itself justify additional measurement or device access requiring consent. The AdMob advertising described below concerns the mobile apps.
We use Google Analytics on our websites and in the Android and iOS apps, where it is connected with Firebase, to evaluate use, reach and feature interactions and improve our services. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland; Google group companies may be involved in processing.
Data processed include usage and session information, pages or screens viewed, times, device and operating system details, language, technical identifiers and interactions. In the apps, these include first opens, session starts, screen views, engagement, and transmitted advertising, purchase and subscription events. The IP address is also technically processed when a connection is established. Cookies, app-instance identifiers and other technical identifiers enable pseudonymous recognition. This is not equivalent to complete anonymity.
Optional analytics rely on Article 6(1)(a) GDPR and begin after appropriate consent. If you decline, available basic use remains accessible. Our Analytics properties are configured to retain event data for two months and user data for 14 months; the user period resets with new activity. These settings do not apply to all Google data or standard reports based on aggregated data.
Both mobile apps use AdMob or Google Mobile Ads to display and measure advertising. Data processed may include IP address, device and app information, technical or advertising identifiers, and information about impressions, clicks and other advertising interactions. Depending on your choices, this also serves personalised advertising and interest association. The relevant optional advertising and measurement processing relies on Article 6(1)(a) GDPR and begins after appropriate consent. Device access and its consent requirements must be considered separately.
Where your Premium offer includes ad-free use, the relevant advertisements are removed. Voluntary usage analytics are separate and continue to require appropriate consent.
We use Google Ads, including conversion measurement and remarketing, to advertise our services, evaluate advertising effectiveness and enable interest-based advertising. Cookies and identifiers may associate an advertising interaction, website visit and subsequent actions. Optional processing relies on Article 6(1)(a) GDPR. This may result in usage and interest profiles.
You may withdraw the relevant consent at any time for the future. Device and browser settings provide additional controls. On iOS, “Settings -> Privacy & Security -> Tracking -> MyMicroBalance” controls the ATT tracking permission. This permission is distinct from consent to usage analytics. Merely uninstalling the app, signing out of a Google account or deleting cookies is not a prerequisite for withdrawal and does not automatically erase previously transmitted data.
The provider terms distinguish processing for our reports from further processing for Google's own purposes. Further information: Google privacy information (https://policies.google.com/privacy?hl=de), Firebase privacy information (https://firebase.google.com/support/privacy/), Google Analytics (https://marketingplatform.google.com/about/analytics/) and AdMob (https://admob.google.com/home/). Google's information on retention and rights also applies to data for which Google is controller in its own right. We independently handle necessary enquiries about processing we initiate.
Our services contain YouTube videos. Loading an embedded YouTube component establishes a connection to Google or YouTube. This may transmit the IP address, device and browser details, and information about the page or screen accessed. If you are signed into a Google or YouTube account, the provider may associate information with that account. Technical transmission may also occur without signing in.
Article 6(1)(a) GDPR applies to embeds requiring consent and the associated data processing. Signing out of your account does not prevent all data transmission. The provider is Google Ireland Limited; further information is available in the Google privacy policy (https://policies.google.com/privacy?hl=de).
We maintain Facebook, Instagram and TikTok presences to provide information about MyMicroBalance and communicate with interested people. We process public profile information, comments, messages and interactions made available to us through the platform. The basis is Article 6(1)(f) GDPR; our interest is providing information about our services and communicating. Article 6(1)(b) GDPR applies to contractual or pre-contractual enquiries.
Platform providers also process technical data, usage and interactions for their own services, statistics and advertising. Providers involved include Meta Platforms Ireland Limited for Facebook and Instagram, and TikTok Technology Limited for TikTok. Roles and responsibilities vary by feature; the relevant joint-controller arrangements apply to jointly determined statistics processing, such as Facebook Page Insights. There is no blanket joint controllership for every platform activity.
Information about recipients, international transfers, retention and choices is available from Facebook (https://www.facebook.com/privacy/policy/), Instagram (https://privacycenter.instagram.com/policy/) and TikTok (https://www.tiktok.com/legal/page/eea/privacy-policy/en). You can contact us about our processing and the relevant provider about its platform processing.
The OpenAI Measurement Pixel is planned for the website to measure advertising through ChatGPT. The selected configuration is limited to attributing a completed PC VIP purchase to advertising. The intended data comprise the purchase event, time, technical browser and attribution information and, where relevant, purchase value, currency and a general product or term identifier. The Pixel is used only after appropriate consent; the basis is Article 6(1)(a) GDPR together with the applicable device-access rules in section 4.
Manual and automatic customer-data matching, customer lists and an additional server-side Conversions API are not planned. Names, email addresses, licence and user identifiers, and household content are not provided as customer data for this purpose. Nevertheless, technical browser and attribution identifiers mean that completely anonymous measurement is not promised. This advertising process is separate from AI processing through Microsoft Azure OpenAI.
The Pixel provides for the cookies __oppref, lasting 30 days after being set, and __obref, lasting 365 days after creation. Capturing a non-empty oppref parameter again restarts the 30-day period; merely reading it does not extend it. Cookie lifetimes do not describe server-side retention of conversion data. Withdrawal ends further consent-based measurement; statutory erasure rights remain unaffected.
Under the Ad Tools terms, OpenAI Ireland Limited processes EEA and Swiss data. The OpenAI Ad Tools data protection terms (https://openai.com/policies/ad-tools-dpa/) govern processing generally described there as independent controllership; the Pixel documentation (https://developers.openai.com/ads/measurement-pixel) explains technical processing. International onward transfers are possible. This description concerns the planned website use and does not describe use of the Pixel within household-account content or AI inputs.
Recipients include the hosting, communication, cloud, payment, store, analytics, advertising and platform providers named for each activity, and people with whom you share a household account. Necessary data may also be disclosed to staff authorised to handle the matter, advisers subject to professional confidentiality, and authorities or courts where a legal basis exists.
Providers processing data on our behalf are engaged as processors under Article 28 GDPR. This is separate from processing for which a provider is controller in its own right, such as its own payment, platform or advertising purposes. The roles and terms applicable to the particular service are relevant.
Our Azure SQL database data are stored in West Europe. This does not promise that every activity described in this policy takes place exclusively there. Google, Microsoft, OpenAI, payment and social-media services in particular may involve processing or access outside the EEA, including in the United States.
Articles 44 et seq. GDPR apply to transfers to countries outside the EEA. Depending on the service, published provider terms describe adequacy mechanisms such as the EU-US Data Privacy Framework for appropriately certified recipients, or standard contractual clauses and supplementary safeguards. A mechanism does not automatically apply to every recipient worldwide. You can obtain information about the safeguards applicable to a particular activity through the linked provider information.
Where the Swiss Federal Act on Data Protection applies, its requirements concerning information, disclosure abroad and individuals' rights remain additionally applicable.
We use technical and organisational measures to protect personal data, including encrypted SSL/TLS connections and limited access permissions. Access to AI content logs within MEIKE OG is limited to authorised personnel. Microsoft's service-side processing described in section 8 is separate. Absolute protection of every transmission and storage operation cannot be promised.
We retain personal data only for as long as necessary for the relevant purpose or required by statutory retention obligations. Relevant criteria include the duration of a requested service, handling an enquiry, existing legal obligations, and the necessary establishment, exercise or defence of legal claims. If the purpose ceases to apply and no further basis exists, the data are erased or their processing is restricted as appropriate.
Tax-relevant books, records and supporting documents are generally retained for seven years under section 132 of the Austrian Federal Fiscal Code (BAO). The period generally starts at the end of the relevant calendar year; statutory rules apply to financial years that differ from the calendar year. Relevant pending proceedings may require longer retention. The basis is Article 6(1)(c) GDPR. Account deletion does not remove this obligation.
We process online account and household data for the duration of the requested account features. When a user account is deleted, associated user data in our own systems are erased in accordance with applicable data protection requirements; necessary statutory retention is limited to its relevant purpose. Immediate deletion under section 8.9 applies to our AI logs. Section 6 explains the particular consequences for shared household accounts. Server-side deletion does not remove independent local files or exports.
Expiry of PC VIP or mobile Premium does not by itself erase your existing household data. Basic use and data access available under the EULA remain accessible. Store subscriptions must be managed separately from user account deletion.
Contact and support data are retained until the matter is fully handled and afterwards only where necessary for required evidence, legal claims or statutory obligations. Retention of technical operation and security logs depends on the period necessary to investigate errors, detect attacks and prevent abuse; this does not justify continued retention without a purpose.
Our AI content, request and consent-record data are governed by section 8; Analytics data by the settings explained in section 9. Independent processing by payment, store, advertising and platform providers is additionally governed by their own information and obligations; our account deletion does not automatically erase all such data with every provider.
The PC version provides export features. You can contact free of charge to export mobile data, including without an active PC VIP key or your own Windows PC. After checking entitlement, we either provide the necessary data directly in a suitable electronic format or enable PC synchronisation and export with a free temporary key. Access limits for shared household accounts must still be respected. Statutory access and portability rights apply under their respective conditions independently of an additional purchase.
Subject to the statutory conditions, you may exercise the following rights in particular:
Contact or the address in section 1. We check identity or entitlement only as necessary and generally inform you of the action taken within one month of receipt. We explain any legally permitted extension within that period. This does not generally postpone a necessary earlier stop or erasure that is due. Exercising statutory data rights requires neither VIP/Premium nor deletion of your entire user account; statutory fee exceptions for manifestly unfounded or excessive requests remain unaffected.
You may also lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or alleged infringement. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email , website https://www.dsb.gv.at/. Where Swiss data protection law applies, you may also contact the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch/. You do not have to complain to us first or participate in consumer dispute resolution.
We update this information when the processing described or legal requirements change. An update does not replace any necessary new consent or automatically extend existing consent. Material changes are communicated as required by law.
© Meike OG 2026
1
2
3
4