What this policy covers
This Privacy Policy describes how 2120 (“2120”, “we”, “us”) collects, uses, stores, and protects information when you use the 2120 web application and related services (the “Service”). 2120 is currently operated by its founding team in Bangalore, India; a formal legal entity will be designated before commercial general availability, after which this policy will be reissued under the operating entity’s name without weakening any of the protections below.
We are the controller of the personal information described in this policy. We act as the processor only for the financial content you choose to upload (transactions, statements, receipts, goals, reflections), which remains yours.
What we collect
We collect only the information needed to operate and improve the Service:
- Account information: your name, email address, and authentication identifiers (Supabase Auth).
- Profile information you choose to provide: country, base currency, onboarding answers, household / partner details (Summit), and product preferences.
- Financial information you enter or upload: transactions, accounts, goals, recurring entries, statements, receipts, net-worth holdings, and reflections.
- Usage information: anonymised events about how the Service is used (which pages load, which features are clicked, broad device class) so we can improve quality.
- Device information: IP address, browser type, and approximate country derived from IP, used for geo-pricing, fraud prevention, and abuse limits.
- Billing information (when you subscribe): payment data is handled by our payment processors (Razorpay for INR; Stripe for USD when enabled). We do not store full card numbers on our servers.
How we use your information
We use the information above to:
- Provide and personalise the Service, dashboards, insights, reflections, projections, financial-independence tracking.
- Generate AI-assisted summaries, categorisation, and parsing of your data (see “AI processing” below).
- Bill you for paid plans and prevent fraud or abuse.
- Communicate with you about your account: security alerts, trial reminders, billing notices, important product changes.
- Comply with legal obligations and resolve disputes.
AI processing
Some features (statement parsing, monthly reflections, receipt scanning, insights) use third-party AI providers. We send only the minimum content needed to produce a result. We use these providers under terms that prohibit them from training their general-purpose models on your data:
- Anthropic (Claude), reflections and qualitative insights.
- Google (Gemini), PDF statement parsing.
- OpenAI, selected text and image tasks where applicable.
AI processing (continued)
We may add, remove, or change AI providers as the landscape evolves. We will keep the list above current and will not introduce a provider that allows training on user data without first updating this policy and notifying active users.
Sharing your information
We do not sell your personal information and we do not run third-party advertising. We share information only with trusted sub-processors who help us run the Service, under contracts that require them to protect it. Our current sub-processors are:
- Supabase, database, authentication, and file storage.
- Razorpay (INR) and Stripe (USD, when enabled), payment processing.
- Anthropic, Google, and OpenAI, AI processing as described above.
- Resend, transactional email delivery (security, billing, trial reminders).
- Our application hosting partner, compute and CDN infrastructure for the web application.
- PostHog and Cloudflare Insights, product analytics and aggregated performance metrics on the public website (subject to your cookie choices).
Security
Your data is encrypted in transit (TLS 1.2+) and at rest by our infrastructure providers. Every row in our database is protected by row-level security (RLS), so one user can never read another user’s data. We restrict team access to production data to the minimum necessary, and we log privileged actions. Workspace sharing (Summit) is opt-in only, a partner sees your transactions only after you explicitly invite them and they accept.
Data retention
We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal information within 90 days, subject to any legal obligation to retain records longer (for example, tax invoices that we are required by Indian law to retain for a defined period).
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Indian users have rights under the Digital Personal Data Protection Act, 2023 (DPDP). EU/UK users have rights under the GDPR / UK GDPR. To exercise any of these rights, email privacy@2120.money from the email on your account. We will respond within 30 days. EU/UK users may also lodge a complaint with their local data-protection authority.
International transfers
We operate globally. Your information may be stored or processed in countries other than your country of residence, including India, the United States, and the European Union. Where required, we put appropriate safeguards in place (such as Standard Contractual Clauses, or equivalent under the DPDP Act once notified) to protect international transfers.
Cookies
We use a minimal set of cookies and similar technologies to keep you signed in, remember your preferences, and (on the public website) understand aggregate usage. Details, including how to decline non-essential cookies, are in our Cookie Policy.
Children
2120 is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please email privacy@2120.money and we will delete it.
Changes to this policy
If we change this policy in a material way, we will notify you (for example, by email or in-app banner) before the change takes effect. The “Last updated” date at the top of this page always reflects the most recent revision.
Contact
Questions, requests, or concerns? Email privacy@2120.money. We aim to respond within two business days.