Travel Companion
Privacy Policy
Last updated 24 August 2026
This policy covers the Travel Companion mobile application. Our studio website is covered separately at kynstudio.com/privacy.
[01] Data controller
Florian Lepage, sole trader (entrepreneur individuel) trading as FLORIAN LEPAGE KYN STUDIO, SIREN 902 557 503, established in France.
For any privacy matter, including the rights described below, write to contact@kynstudio.com.
[02] Data we collect
Account
Your email address and, if you provide it, your name.
Your budget
The trips, budgets, categories and expenses you create, including anything you type in by hand.
Bank transactions — only if you connect an account
For each payment: the merchant or description, the amount, the currency, the booking date, and the bank's own reference for it.
We retrieve only transactions dated within the trip you have defined, and we keep only debits — money coming in is discarded on retrieval. We never see or receive your banking credentials; you authenticate directly with your bank. We do not store your IBAN, your account number, or your account balances.
Apple Pay captures — only if you set up the optional automation
The merchant name and amount your iPhone reports for a Wallet payment. This is read on your device by an automation you create yourself in the Shortcuts app, and sent to us so it can appear in your inbox.
Subscription
If you subscribe, confirmation of the purchase from Apple. We never receive your card details.
[03] Purpose and legal basis
| Purpose | Basis |
|---|---|
| Running your budget and showing your daily allowances | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Connecting a bank account | Your explicit consent, which you may withdraw at any time (Art. 6(1)(a)) |
| Suggesting a category for a payment | Performance of our contract |
| Managing a subscription | Performance of our contract |
| Keeping the service secure | Our legitimate interest (Art. 6(1)(f)) |
The application is not intended for anyone under 16.
[04] Recipients and processors
| Who | What for | Where |
|---|---|---|
| Convex, Inc. | Database | United States |
| Clerk, Inc. | Sign-in | United States |
| Amazon Web Services | Application servers | France (Paris) |
| Amazon Web Services (Bedrock) | Category suggestions | Ireland |
| Enable Banking Oy | Bank connection, under its own PSD2 authorisation | Finland |
| Apple | Subscriptions | — |
Clerk also processes account information — such as your email address — as an independent controller under its own privacy policy, in addition to acting as our processor.
We never sell or rent your personal data, and we never use it for advertising, profiling, credit scoring or resale.
[05] Automatic category suggestions
When you ask the app to sort your inbox, the merchant description and the amount are sent to Amazon Bedrock in Ireland to suggest a budget category. Amazon does not retain these prompts and does not use them to train models.
The suggestion is only ever a suggestion: you can change any category, and nothing here produces a legal or similarly significant effect on you within the meaning of Article 22 GDPR.
[06] Data retention
Your trips and expenses are kept until you delete them or close your account. A bank connection is authorised for at most 90 days, after which it stops unless you re-authorise it. You may disconnect a bank at any time in the app, which ends all further access immediately.
Closing your account deletes your data, save for backup copies removed on our providers' ordinary schedules.
[07] Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to portability, and to withdraw your consent at any time. Write to contact@kynstudio.com.
You may also lodge a complaint with the CNIL, cnil.fr, the supervisory authority for France.
[08] Security and transfers
All traffic is encrypted in transit. Banking credentials never reach us.
Two of our processors store data in the United States:
- Clerk, Inc. transfers under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision and under which Clerk is self-certified. Its Data Processing Agreement additionally incorporates the Standard Contractual Clauses, which apply should that framework cease to be available.
- Convex, Inc. transfers under the Standard Contractual Clauses (Module Two, Commission Implementing Decision (EU) 2021/914), incorporated into its Data Processing Addendum.