Privacy Policy

Who we are

Azno (azno.app) is built and operated by Zdravevski Professionals, established in Skopje, Republic of North Macedonia, the studio of Jane Zdravevski. We are the controller of the personal data described here. For anything in this policy, write to hello@azno.app.

The principle

We keep only what the service needs to work for you: the account that signs you in, the books you keep, the conversations you have with the Advisor, and the settings you choose. We do not collect anything about you beyond what you type or photograph into Azno. In particular, we do not read your contacts, your location, your other apps or your device, we do not build a profile of you for anyone, and we do not sell or rent personal data. What we hold, we hold to show it back to you and to keep the service running, secure and paid for.

What we store, and why

• Your account — email address, a bcrypt hash of your password (never the password), your plan, your Azno Coin balance, the date you joined, the time you were last active, and the settings you choose (base currency, exchange rates, preferences). Why: to sign you in and run your plan.
• Your books — the accounts, ledger entries, categories, budgets, goals, debts, recurring bills and payroll contracts you create, in the currencies you enter them. Why: this is the product; it is stored so it can be shown back to you.
• Advisor conversations — the messages you send the Azno Advisor, its replies, the proposals it staged and what you did with them, and the facts it remembers about your preferences (visible and deletable under Settings → AI memory). A photo of a receipt is read once to stage entries and is not kept beyond the reply. Why: so a conversation can continue and the Advisor can remember what you told it.
• Usage — which screens are opened and which buttons are pressed, the tokens and coins each Advisor reply used, sign-in events, and errors. Why:to see what works, what breaks, and what the Advisor costs. Visitors who are not signed in are counted with a random id that lives only in the browser tab's memory — no cookie, no device fingerprint.
• Payments — Stripe processes card payments. Azno keeps the Stripe customer and subscription ids and a record of what was bought, when, and for how much; it never sees or stores card numbers. Why: to deliver what you paid for and to keep the books the law requires.
• Email delivery — a log of the verification, password-reset and billing emails we sent you and whether they were delivered. Why: to help when one does not arrive.

Cookies

Signing in sets one HttpOnly session cookie that identifies you to the API; it is not readable by scripts and is not used for tracking. The public website loads Google Analyticsto understand how people find and read it; it sets its own analytics cookies, and Azno configures it with advertising storage and personalisation turned off. The product's own analytics use no cookies at all. Every cookie and storage entry is listed on the Cookie Policy page, which is part of this policy. A notice tells you on your first visit; by continuing to use Azno you accept them.

Why we are allowed to process this

Your account, books, conversations, payments and emails are processed because they are needed to provide the service you asked for (the contract between us). Usage data, security logs and website analytics are processed in our legitimate interest in running, improving and protecting Azno, weighed against your privacy — which is why they are minimal, first-party where possible, and never used for advertising. Where a law requires us to keep records, for example of payments, that legal obligation applies. Where we ever need your consent for something else, we will ask for it separately and you can withdraw it.

Who processes data on our behalf

• Hosting — the web app is served by Vercel and the API and database run on managed cloud infrastructure (Railway and a managed MongoDB service). Data is encrypted in transit; secrets and any provider API keys you add are encrypted at rest with a key the application holds.
• AI providers — when you ask the Advisor a question, the text you typed and the rows of your ledger it needs to answer are sent to the language-model provider configured for your account (for example OpenAI, Anthropic or Google), or to a provider key you supplied yourself. Providers process this to generate the reply under their API terms, which exclude use for model training.
• Email — SendGrid delivers verification links, password resets, receipts and, if you are an operator, alerts.
• Payments — Stripe.
• Website analytics — Google Analytics, as described above.

These providers may run outside the country you live in, including in the United States and the European Union. Each is bound by its own data-processing terms and, where required, standard contractual clauses. We do not share your books with anyone for advertising, and we do not sell personal data.

Integrations you connect

You can let another tool read or write parts of your Azno account through scoped, revocable tokens (OAuth or personal access tokens). Every token shows what it can reach, and you can revoke it under Settings at any time. Nothing is shared with an integration you did not connect.

Security

Every account's data is isolated from every other account's. Passwords are hashed with bcrypt; sessions use a signed, HttpOnly cookie; API keys and secrets are encrypted at rest; traffic is encrypted in transit; administrative actions are logged. The Advisor can never move money — it has no access to any bank, card or payment method, and every change it proposes to your books happens only after you confirm it. No system is perfectly secure; if we ever learn of a breach affecting your data we will tell you without undue delay.

How long we keep things

• Your account, books, conversations and settings: for as long as your account exists.
• Detailed usage events: 365 days; aggregated daily counts are kept without any personal detail.
• Email delivery logs and one-time tokens (verification, password reset): they expire on their own short schedule.
• Payment records: as long as accounting and tax law requires, after which they are deleted or reduced to what those laws need.
• Backups: rolling copies of the database exist so we can recover from a failure; deleted data leaves them as those copies rotate, and backups are never used to restore an account you asked us to delete.

Your rights

You can see and edit everything you entered inside the product. Beyond that you can ask us, at any time, to give you a copy of your data, to correct something you cannot edit yourself, to restrict or object to a particular processing, or to delete your account and everything it owns. Email hello@azno.app from the address on the account. Deletion is completed within 30 days and removes your books, conversations, memory, settings, tokens and coins; payment records required for accounting are kept without the personal details that are not needed for them. If you believe we have handled your data unlawfully you can also complain to the data-protection authority where you live.

Children

Azno is not directed at children and must not be used by anyone under 16. We delete accounts we learn belong to one.

Changes

When this policy changes, the date at the top changes with it, and the blog or a notice inside the product will say what moved. Continuing to use Azno after a change means you accept the new version. Questions are welcome at hello@azno.app.