Last updated 18 August 2026
Applies to the QuitBank service delivered over WhatsApp and the website at quitbank.net.
Plain-language summary. QuitBank is a private WhatsApp companion for leaving one habit behind. You never tell us the habit; we store your dream, your chosen daily score, your completed days, and our conversation. You are chatting with an AI system — it writes the replies. QuitBank is not a medical, therapy, or crisis service, and it does not monitor for emergencies. You can stop any time by replying STOP, and you can ask us to delete your data.
QuitBank is operated by Realty Investments SRL ("QuitBank", "we", "us"), a company registered in Romania under VAT/registration number RO785167, registered office Str. Arad nr. 42, Sibiu, 550131, Sibiu County, Romania.
We are the data controller for the personal data described here. For anything about your data, contact support@quitbank.net (general enquiries: contact@quitbank.net).
UK users: because our establishment is in Romania, if you are in the United Kingdom a UK GDPR Article 27 representative is being appointed; until then, please contact support@quitbank.net.
When you message QuitBank, you are interacting with an AI system: companion replies are AI-generated (disclosed when you start, in the first message you receive). They are motivational conversation, not medical, financial, legal, or psychological advice. The AI is a tool inside the service — the service itself is the savings jar and the companionship around it. If you ask, the assistant will always confirm it is an AI and never claim to be a human.
We practise data minimisation: we collect only what is needed to run your jar.
| What | Why we use it | Legal basis (EU/UK GDPR) |
|---|---|---|
| Your WhatsApp phone number | To message you and run your account | Performance of our contract with you (Art. 6(1)(b)) |
| Your consent record (version + date) | To prove you agreed and to honour withdrawal | Legal obligation / contract |
| Your check-ins (e.g. DONE, SLIP, CRAVING) and our chat messages | To track your streak and coach you | Performance of our contract |
| Your jar and payment records (deposits, subscription, Stripe customer reference) | To run the savings ledger and your subscription | Performance of our contract |
| Slip triggers you tell us (e.g. "stress") | To make the coaching more helpful | Performance of our contract |
| How you found us (e.g. an ad reference) | To understand which campaigns work | Our legitimate interest in measuring our own marketing (Art. 6(1)(f)) |
| Billing details you enter on Stripe's secure page (email, name, billing address; for companies, an optional VAT ID) | To send your receipt/invoice and calculate the right VAT | Performance of our contract + legal obligation (tax law) |
When you pay, Stripe (our payment processor) collects your email, name and billing address — and, for business customers, an optional VAT ID — on its own secure page. This billing information lives with Stripe, never in our chat database, which only stores a stripe_customer_id reference.
We never collect what your habit is — there is nowhere to type it and we never ask — or any health details. We never ask you to share full payment-card numbers, bank-account numbers, or ID-card numbers — payment happens on Stripe's secure page, not in the chat.
Your messages are not used to train AI models. Our AI provider processes your message only to generate the immediate reply, under a configuration that does not retain your content for training.
We use a small number of trusted service providers ("sub-processors") to run QuitBank. Each processes your data only on our instructions under a data-processing agreement:
| Provider | Role | Location |
|---|---|---|
| WhatsApp Ireland Ltd / Meta | Delivers our messages (WhatsApp is our messaging processor for your phone number) | EU / global |
| 360dialog | WhatsApp Business Solution Provider (message routing) | EU |
| Stripe | Payment processing for your subscription | EU / US |
| Anthropic | Generates the AI reply text (no-training configuration) | US |
| Neon | Database hosting (EU / Frankfurt) | EU |
We do not forward or share your chat with any other customer, and we do not sell your data. Some providers (e.g. Stripe, Anthropic) may process data in the United States; where they do, the transfer is covered by appropriate safeguards such as Standard Contractual Clauses.
| Data | Retention |
|---|---|
| Chat message content (bodies) | Deleted (nulled) 18 months after it is created |
| Content around a crisis flag | Sensitive message bodies nulled 30 days after the flag; the fact we responded is kept as an audit record |
| If you never complete sign-up | Deleted 30 days after an abandoned, never-consented start |
| Jar / deposit history after you leave | Anonymised 3 years after your account lapses; anonymised deposit totals may be kept as statistics |
| Marketing attribution reference | Purged 90 days after sign-up |
Under the EU/UK GDPR you can ask us to: access a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. You can also withdraw consent at any time — reply STOP to stop messages, or CANCEL to end your subscription (you keep everything in your jar).
To exercise any right, email support@quitbank.net. We will respond within one month. For a single view of every option — pausing, cancelling, refunds, data export, deletion, and complaints — see the "Your options" table in our Terms & Conditions (§6.2). You also have the right to complain to your data-protection authority — our lead authority is the ANSPDCP (Romania); if you are in the UK you may also complain to the ICO.
We follow recognised industry practices: encrypted connections, least-privilege database access, and an append-only financial ledger (deposits cannot be altered or deleted by the application). If we ever suspect a data breach affecting you, we will act and notify as the law requires.
QuitBank does not connect to emergency services and does not monitor your messages for emergencies. If you or someone else is in danger, call your local emergency number, or see the crisis lines at quitbank.net/safety.
QuitBank is for adults 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has used QuitBank, contact support@quitbank.net and we will delete the data.
We may update this policy. We will post the new version here with a new "last updated" date and, where the law requires, tell you in advance.
Questions or requests: support@quitbank.net · Realty Investments SRL, Str. Arad nr. 42, Sibiu, 550131, Sibiu County, Romania.