Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

Given the nature and scale of our data processing activities, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any privacy-related inquiries, please contact us at the email address above.

2. Scope and Applicability

This Privacy Policy applies to the MyMoney personal finance platform (the "Service") and describes how we collect, use, disclose, and protect your personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR")
• The Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
• Directive 2002/58/EC (ePrivacy Directive) as implemented in Belgian law

This Service is intended exclusively for users located in the European Union and European Economic Area (EU/EEA). By using the Service, you confirm that you are located within the EU/EEA.

3. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Account Data

• Email address
• Password (cryptographically hashed; we never store or have access to your plaintext password)
• Account creation date

3.2 Financial Data

• Bank account identifiers (account names, IBANs, BICs)
• Account balances
• Transaction data (dates, amounts, descriptions, counterparty names and IBANs, remittance information)
• Spending plan categories and allocations
• Investment holdings and transactions

3.3 Technical Data

• Authentication tokens (session cookies)
• Browser-stored preferences (localStorage)
• Anonymized performance metrics (page load times via Web Vitals)

Data we do NOT collect: We do not collect IP addresses for tracking purposes, location data, device fingerprints, browsing history outside the Service, or any biometric data.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each with a specific legal basis under Article 6(1) GDPR:

Legitimate interest assessment: For performance monitoring, our legitimate interest is ensuring the Service operates reliably. This processing uses anonymized metrics that do not identify individual users, minimizing any impact on your privacy. You may object to this processing by contacting us.

5. Obligation to Provide Data

Mandatory data: Providing your email address and password is necessary to create an account and use the Service. Without this data, we cannot provide the Service to you.

Optional data: Connecting bank accounts and entering financial data is voluntary. However, without this data, certain features of the Service (such as automatic transaction import and insights) will not be available.

7. International Data Transfers

Your data is primarily processed within the European Economic Area. However, some processors (Google, Vercel) may process data outside the EEA.

For transfers to countries without an adequacy decision from the European Commission, we rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission under Decision 2021/914
• Additional supplementary measures where necessary, including encryption and access controls

You may request a copy of the relevant safeguards by contacting us.

8. Cookies and Similar Technologies

We use the following cookies and storage mechanisms:

8.1 Strictly Necessary Cookies

These cookies are essential for the Service to function and cannot be disabled.

Legal basis: These cookies are exempt from consent requirements under Article 5(3) of the ePrivacy Directive as they are strictly necessary to provide the service you requested.

8.2 Performance Cookies (Optional)

With your consent, we use Vercel Speed Insights to collect anonymized performance metrics (Core Web Vitals). This data helps us improve page load times and does not identify individual users.

Legal basis: Consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via our cookie banner or by contacting us.

8.3 Local Storage

We use browser localStorage to remember your UI preferences (e.g., selected account, view settings). This data remains on your device and is cleared when you log out.

9. Data Retention

We retain your personal data according to the following criteria:

When you delete your account, we immediately revoke all bank connections and initiate permanent deletion of your personal data. Complete erasure occurs within 30 days, with backups purged within 90 days.

11. Automated Decision-Making and Profiling

We use AI (Google Generative AI) to assist with transaction categorization and generate financial insights. This processing:

• Provides suggestions only—you can always manually override any AI-generated category
• Does not produce legal effects or similarly significantly affect you
• Is based on aggregated financial patterns, not individual profiling for discrimination or credit decisions

We do not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit: TLS 1.3 for all data transmission
• Encryption at rest: AES-256 encryption for stored data
• Authentication: Secure password hashing (bcrypt), httpOnly session cookies
• Access control: Row-level security policies ensuring users can only access their own data
• Security headers: Content Security Policy (CSP), XSS protection, clickjacking prevention
• No credential storage: Bank login credentials are never transmitted to or stored by us

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly addressing any security incident.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34 GDPR.

14. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last updated" date at the top of this policy
• For significant changes affecting your rights, we will notify you by email at least 30 days before the changes take effect
• Where required by law, we will obtain your consent to material changes

We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy, except where consent is required.

16. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.

For Belgium, the competent authority is:

You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.

17. Miscellaneous Provisions

17.1 Governing Law

This Privacy Policy and any disputes arising from it shall be governed by the laws of Belgium, without regard to conflict of law principles. This choice of law does not deprive you of the protection afforded by provisions that cannot be derogated from by agreement under the law of your country of habitual residence.

17.2 Severability

If any provision of this Privacy Policy is found to be invalid or unenforceable by a court of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

17.3 No Waiver

Our failure to enforce any right or provision of this Privacy Policy shall not constitute a waiver of that right or provision.

17.4 Language

This Privacy Policy is provided in English. In the event of any conflict between translated versions and the English version, the English version shall prevail.