Privacy Policy

We collect information you provide directly to us, including:

• Account information (name, email address, and optional phone number when you provide it)
• Identity verification documents submitted through Stripe Connect (government-issued ID, date of birth, address) for Know Your Customer (KYC) and anti-money laundering (AML) compliance
• Payment information (bank account details, card information — processed securely through Stripe; we never store full card numbers)
• Group participation data (contributions, payout history, group membership)
• Profile information (profile photo, display name)
• In-app communications, including group chat messages and support requests
• Community safety data when you report content or block another user

We also automatically collect:

• Device identifiers and operating system information
• App usage statistics and performance data (via Firebase Analytics and Crashlytics)
• Product analytics events (via PostHog) recording how you move through the app — for example account creation, group creation, joining a group, and starting or completing a contribution or payout. These events are linked to your account identifier and include the group identifier, contribution or payout amount and currency, and your country. They do not include your name, email address, group names, card or bank details, or identity documents.
• Device attestation data (via Firebase App Check) to verify app authenticity
• Push notification tokens (via Firebase Cloud Messaging)
• Trust score data derived from your payment history and group participation
• Terms acceptance records (date and policy version accepted)
• Biometric authentication usage (Face ID / Touch ID — biometric data itself is stored only on your device by Apple, not by us)

We use your information to:

• Provide and operate the SuSu rotating savings platform
• Verify your identity through Stripe Connect (required for receiving payouts)
• Process contributions and distribute payouts through your linked bank account
• Calculate and display your trust score to group administrators
• Send notifications about contributions, payouts, group activity, and account security
• Enforce single-device session policy to protect your account
• Detect and prevent fraud, unauthorized access, and abuse
• Review reports, enforce community guidelines, and remove objectionable content
• Filter, investigate, and act on user-generated content reports within 24 hours
• Provide customer support and resolve disputes
• Improve app performance, stability, and user experience
• Comply with financial regulations and legal obligations

We will never sell your personal information to third parties.

The SuSu App includes user-generated content such as group chat messages and member profiles. When you use these features:

• Your messages and profile information may be visible to other members of your groups
• When you report content, we collect the report details, relevant message or profile context, and your user ID to investigate the issue
• When you block a user, we store the block relationship so that user is removed from your feed
• We may retain reported messages and moderation records for safety, compliance, and dispute resolution
• Automated filters may scan message text for prohibited language before or after posting

We share your information only in these limited circumstances:

• With other group members: your name, profile photo, contribution status, and trust score are visible to members of groups you join
• With Stripe: payment details and identity documents for payment processing, identity verification, and payout delivery via Stripe Connect
• With Firebase / Google Cloud: app analytics, crash reports, and infrastructure services
• With PostHog: product analytics events describing how the app is used, linked to your account identifier, processed on PostHog's United States infrastructure
• When required by law, regulation, or legal process
• To protect the rights, safety, or property of our users or the public
• In connection with a business transfer, merger, or acquisition

All third-party providers are bound by their own privacy policies and data processing agreements.

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS) and at rest
• Payment information is processed through PCI-DSS compliant Stripe — we never store full card or bank account numbers
• Identity verification documents are handled entirely by Stripe and not stored on our servers
• Sensitive configuration (API keys, tokens) is stored in the iOS Keychain
• Firebase App Check verifies that requests come from authentic app installations
• Single-device session enforcement prevents unauthorized access from multiple devices
• Firebase Security Rules restrict database and storage access to authorized users
• Regular security audits, dependency updates, and code reviews

While we strive to protect your information, no system is 100% secure. We encourage you to use strong passwords, enable biometric authentication, and keep your device software up to date.

You have the right to:

• Access your personal information stored by us
• Update or correct your profile and account data
• Delete your account and associated data
• Opt out of non-essential push notifications
• Request a portable copy of your data
• Restrict or object to certain data processing activities
• Withdraw consent for optional data collection
• Block other users and report objectionable content through the app

To exercise these rights, contact us at support@thesusu.app or use the account settings in the app.

We retain your information for as long as necessary to:

• Provide our services to you
• Comply with financial record-keeping and regulatory obligations
• Resolve disputes and enforce our agreements
• Investigate safety reports and enforce community guidelines

When you delete your account, we will delete your personal information within 30 days, except for:

• Transaction records we are legally required to retain (typically 5–7 years for financial records)
• Anonymized or aggregated data that cannot identify you
• Information needed for ongoing legal proceedings, safety investigations, or disputes

The SuSu App is a financial service intended for adults. You must be at least 18 years old to create an account or participate in savings groups. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18, we will promptly delete it.

The SuSu App is available in 42 countries through Stripe Connect. Your information may be transferred to and processed in the United States and other countries where our service providers operate.

• For users in the European Union / EEA: we comply with GDPR requirements. You have additional rights under EU law, including the right to lodge a complaint with your local data protection authority.
• For users in the United Kingdom: we comply with UK GDPR and the Data Protection Act 2018.
• For users in California, USA: we comply with the California Consumer Privacy Act (CCPA). You have the right to know what data we collect, request deletion, and opt out of data sales (we do not sell personal data).

By using our service, you consent to the transfer and processing of your data as described in this policy.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy in the app and on our website
• Sending you a push notification or email
• Displaying a prominent in-app notice

Your continued use of The SuSu App after changes become effective constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, please contact us:

BigE Solutions LLC
Email: support@thesusu.app
Phone: (774) 209-SUSU