Skip to content

Monidoo

Know your money before you spend it.

Privacy notice

These pages describe how Monidoo is designed to handle personal data. They are product documentation placeholders and do not replace a lawyer-reviewed privacy notice, DPIA, or DPA for your launch market.

Who we are

Controller
Monidoo (legal entity TBD)
Address
Registered address TBD — set NEXT_PUBLIC_LEGAL_ADDRESS before launch (EU)

What we process

  • Account identity (email, display name) via Supabase Auth
  • Finance data you enter (accounts, journal, budgets, debts, documents/receipts)
  • Preferences (theme, notification mutes, email-alert opt-in, planning horizon)
  • Technical logs needed to operate the API (request metadata; not full financial payloads by default)
  • Optional AI chat / document extract when you use those features

Purposes & legal bases (GDPR)

  • Contract (Art. 6(1)(b)) — provide the Monidoo service you signed up for (ledger, forecast, sync across devices).
  • Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, service reliability; balanced against your rights.
  • Consent (Art. 6(1)(a)) — optional product alert emails; optional analytics/marketing cookies if enabled; optional AI provider features where consent is required by policy.
  • Legal obligation (Art. 6(1)(c)) — limited retention of security/audit metadata when required.

Processors & transfers

Infrastructure is designed for EU hosting (DigitalOcean Managed PostgreSQL / App Platform, private Spaces for documents). Auth is Supabase. Optional email (Resend) and AI providers may process data outside the EEA — use SCCs / provider DPA and keep AI disabled until reviewed. See cookies and docs/runbooks/privacy-gdpr.md in the repository.

Retention

Active account data is kept while your account exists. After account deletion we erase or anonymize personal records and owned-space documents as described in Settings and the retention runbook. Backup media follow the hosting provider’s backup window before purge.

Your rights

  • Access / portability — Settings → export JSON or CSV
  • Erasure — Settings → delete account (also removes Supabase identity when configured)
  • Rectification — edit profile and finance records in the app
  • Objection / restriction — contact [email protected]; mute or disable email alerts
  • Withdraw consent — cookie preferences; turn off email alerts; stop using optional AI
  • Complaint — your local supervisory authority (EEA)

Children

Monidoo is not directed at children under 16. Do not create an account for a minor.

Back to home