sico

CheckMargin — Privacy notice

Last updated: 2026-10-03. Effective: 2026-10-03.

This notice covers data processing for checkmargin.com. The sico-wide privacy notice applies in addition.

1. What data we collect

  • Account data — email address, hashed password (via SuperTokens).
  • Connected payment processor credentials — either a read-only restricted Stripe key you create in your own Stripe dashboard (Charges, Invoices and Balance read access only) or, if you use one-click Connect with Stripe, your Stripe account ID and the access Stripe grants (broader than read-only); and/or a PayPal token, used to read your income and fee history. CheckMargin only ever reads with these credentials, and a restricted key cannot move money or change anything in your account even in principle. We store them encrypted at rest. We do not store card numbers or bank account details.
  • Income and expense entries — amounts, dates, categories, and notes for income and expense records you create or that are imported from your connected payment processors.
  • Tax and cost configuration — tax rates, platform fees, and overhead entries you enter to compute your net take-home.
  • Usage telemetry — page views and feature interactions via PostHog (EU). No financial figures are sent to PostHog.

2. Legal basis

Processing is necessary to perform the contract you entered when signing up (UK GDPR Art. 6(1)(b)). Connecting payment processor accounts is voluntary; you may disconnect at any time from Settings, which immediately revokes and deletes the stored tokens.

3. How we use the data

Solely to provide the CheckMargin features: computing your real net income after fees, taxes, and costs; displaying income trends; and generating profit reports. Your financial data is not shared with third parties and is not used to train AI models.

4. Data retention

Account data is retained while your subscription is active. On account deletion: personal data and income/expense records purged within 30 days. Billing records (Stripe invoices for your CheckMargin subscription) retained for 7 years per UK accounting requirements.

5. Sub-processors

  • Stripe — billing for your CheckMargin subscription; optionally, reading your Stripe income (charges and invoices) via a read-only restricted key you provide or a Stripe Connect link.
  • Hetzner — VPS hosting; data stored in EU.
  • Resend — transactional email.
  • PostHog (EU) — product analytics (no financial data).

6. Contact

Privacy queries: privacy@sico.software.