How we handle your data — plain English, real protections.
Operated by Tehseen Riaz, Founder and Writer. This policy explains what we collect, how we use it, who we share it with, and the choices and rights you have.
Savvy Broke (“we,” “us,” “our,” or “the Website”) is operated by Tehseen Riaz, Founder and Writer. We are committed to protecting your privacy and being transparent about how we handle your information.
By visiting savvybroke.com, subscribing to our email newsletter, leaving a comment, filling out a contact form, or otherwise using the Website, you agree to the practices described in this Privacy Policy. If you do not agree with these practices, please do not use the Website.
This policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) of the European Union, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable U.S. state and federal laws. We are not a licensed attorney, and this policy is provided for general informational purposes — for specific legal advice, please consult a qualified attorney.
Information we collect
What we collect depends on how you interact with the Website. It falls into three buckets:
You provide directly
- Email address — when you subscribe to the newsletter or fill out a contact form.
- Name — if you choose to provide it when commenting or contacting us.
- Comment content — any text, images, or links you include in a comment.
- Correspondence — anything you include in an email or message to us.
- Survey responses — any answers you voluntarily provide in a reader survey.
Collected automatically
- IP address — assigned to your device by your internet provider.
- Browser & device — type, version, operating system, screen resolution.
- Pages visited — which articles you view, in what order, and for how long.
- Referring URL — the source that directed you here.
- Approximate location — derived from your IP, typically city or region level.
- Cookie data — small text files on your device (see Section 3).
Third-party services
- Services acting on our behalf, each with their own privacy policy — we encourage you to review them:
- Google Analytics ↗
- ConvertKit ↗
- Mailchimp ↗
- Hosting provider
- WordPress comments (native)
- Disqus ↗
- Google AdSense ↗
- Affiliate networks (Amazon Associates, ShareASale)
- YouTube ↗
- X / Twitter ↗
- Instagram ↗
How we use your information
- Operate, maintain, and improve the Website and its content.
- Send you our email newsletter, if you have subscribed.
- Respond to your comments, questions, and correspondence.
- Analyze how visitors use the Website to improve the reading experience.
- Monitor and protect the Website’s security — detecting fraud, abuse, or unauthorized access.
- Comply with legal obligations and enforce our Terms of Use.
- Display advertising that may be relevant to your interests, if you have not opted out.
- Send administrative notices, such as changes to this Privacy Policy or our Terms of Use.
Legal basis for processing GDPR · Art. 6
If you are in the EEA, the United Kingdom, or Switzerland, we process personal data under these lawful bases, as defined by Article 6 of the GDPR:
Consent
Your email address is processed for the newsletter based on your consent, which you can withdraw at any time by unsubscribing.
Legitimate interests
Analytics data is processed based on our legitimate interest in understanding how the Website is used and improving its content and security.
Legal obligation
We may process data where necessary to comply with a legal obligation, such as responding to lawful requests from authorities.
Cookies & tracking technologies
We and our third-party providers use cookies and similar technologies (web beacons, pixels, local storage) to collect and store information about your visits. Cookies are small text files placed on your device.
Essential
Needed for the Website to function — navigation, security, and access to secure areas. The site cannot work properly without them.
Analytics
Count visits and traffic sources so we can measure and improve performance and see which pages are most helpful.
Functional
Remember your preferences — for example, settings you have chosen or a cookie banner you have dismissed.
Advertising
Set by advertising partners to build a profile of your interests and show you relevant ads on other websites.
Social media
If you interact with embedded content (a YouTube video or share button), the platform may set its own cookies.
Your cookie choices
You can control or delete cookies through your browser settings — most browsers let you refuse cookies or alert you when cookies are being sent. Disabling cookies may make some features of the Website work incorrectly.
For visitors in the EEA and other jurisdictions that require consent for non-essential cookies, we display a cookie consent banner that lets you accept, reject, or manage your preferences before non-essential cookies are set.
You can also opt out of certain third-party tracking here:
- Google Analytics opt-out — tools.google.com/dlpage/gaoptout
- Google Ads Settings — adssettings.google.com
- Digital Advertising Alliance opt-out — optout.aboutads.info
- Network Advertising Initiative opt-out — optout.networkadvertising.org
How we share your information
We do not sell your personal information. We only share it in the circumstances below.
International data transfers
Savvy Broke is operated from Karachi, Pakistan, and we use third-party services based in other countries — including the United States (for example, Google Analytics, email marketing platforms, and hosting providers). When you visit the Website from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to and processed in countries outside the EEA, including Pakistan and the United States. To the extent that your personal data is transferred outside the EEA, we rely on the following safeguards:
Standard Contractual Clauses
We use third-party processors that have implemented Standard Contractual Clauses (SCCs) approved by the European Commission — a legal mechanism for transferring personal data from the EEA to third countries.
Adequacy decisions
Some countries to which data may be transferred have been deemed by the European Commission to provide an adequate level of data protection.
Consent
In some cases, we may rely on your explicit consent to transfer your personal data to a third country — which you can withdraw at any time.
If you would like more information about the specific safeguards we rely on for international data transfers — or to obtain a copy of the relevant Standard Contractual Clauses — please contact us at contact@savvybroke.com (see Section 10).
About Pakistan: Pakistan has enacted the Personal Data Protection Bill, modeled in part on the GDPR. However, Pakistan has not yet been formally recognized by the European Commission as providing an adequate level of data protection — we therefore rely on the safeguards described above when transferring EEA residents’ data to our location.
Data retention
We keep personal information only as long as necessary for the purposes described in this policy — unless a longer period is required by law or to resolve disputes.
Your privacy rights
For the EEA, UK & Switzerland GDPR
① Access
Request a copy of the personal data we hold about you.
② Rectification
Ask us to correct inaccurate or incomplete data.
③ Erasure
Request deletion of your data, subject to certain exceptions (“right to be forgotten”).
④ Restrict processing
Ask us to limit how we process your data in certain circumstances.
⑤ Portability
Receive your data in a structured, machine-readable format and transmit it to another controller.
⑥ Object
Object to processing based on legitimate interests or for direct marketing.
⑦ Withdraw consent
Where processing relies on consent, withdraw it at any time.
We respond to GDPR requests within 30 days. You may also lodge a complaint with your local data protection authority — EU supervisory authorities are listed at edpb.europa.eu.
For California residents CCPA / CPRA
① Right to know
Request the categories and specific pieces of personal information collected, the sources, the purposes, and the third parties involved.
② Right to delete
Request deletion of the personal information we have collected, subject to certain exceptions.
③ Opt out of sale / sharing
We do not sell personal information, but sharing with advertising partners for targeted advertising may be a “share” under the CPRA — opt out any time.
④ Limit sensitive data
We do not collect sensitive personal information as defined by the CPRA for the purpose of inferring characteristics about you.
⑤ Non-discrimination
We will never discriminate against you for exercising your CCPA/CPRA rights.
We verify your identity before responding and reply within 45 days (we will notify you in writing if we need more time). You may designate an authorized agent with written, signed authorization on your behalf.
Do Not Sell or Share My Personal Information
Other U.S. states
If you live in a state with its own data protection law (such as Virginia, Colorado, Connecticut, or Utah), you may have similar rights — contact us to exercise any right available under your state’s law.
Do Not Track
Some browsers offer a “Do Not Track” signal. Because there is no industry consensus on interpreting DNT, we do not currently respond to it — but the cookie management and opt-out tools in Section 3 let you control tracking directly.
Exercise any of these rights by emailing us — tell us which right you’re using and we’ll take it from there. GDPR requests: 30 days. CCPA/CPRA requests: 45 days.
✉ Email contact@savvybroke.comChildren’s privacy
The Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, contact us — we will promptly delete it in accordance with the Children’s Online Privacy Protection Act (COPPA) and applicable laws.
About our content: some articles, such as “How to Teach Kids About Money,” are written for parents and may reference children. Those references are informational only — we do not collect personal information from children.
Data security
We use reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, or destruction:
- Encrypted connections (HTTPS/TLS) between your browser and our server.
- Personal data stored with reputable hosting providers that follow industry-standard security practices.
- Access to personal data limited to authorized personnel who need it.
- Security practices reviewed and updated regularly.
No method of transmission over the Internet or electronic storage is 100% secure — we cannot guarantee absolute security, but we are committed to taking reasonable steps to protect your information.
If there is ever a data breach
These two notification obligations are separate. The 72-hour deadline applies to notification of the supervisory authority; notification to users is required without undue delay — but only when a breach poses a high risk to their rights and freedoms.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you by email or by posting a prominent notice on the Website.
Your continued use of the Website after changes take effect means you accept the updated policy. Please review this page periodically.
Contact us
Questions, concerns, or requests about this Privacy Policy or the way we handle your personal information? Contact the Data Controller:
- General inquiries — within 5 business days
- GDPR requests — within 30 days
- CCPA/CPRA requests — within 45 days
Savvy Broke is operated from Karachi, Pakistan. For the purposes of the GDPR, Tehseen Riaz is the Data Controller responsible for your personal data. We do not maintain a public physical mailing address for privacy and security reasons — all formal legal correspondence should be directed to the email above, and we will provide a physical mailing address for formal legal notices upon request.