Privacy Policy

This Privacy Policy explains how [Your registered legal entity name] (“Meliora Nexa”, “we”, “us”) collects, uses, stores, and protects your information when you use our personal finance tracking application (the “Service”).

We built this Service to handle sensitive financial information, and we treat it accordingly. We do not sell your personal data, and we do not use your financial data to serve advertising.

Account information.

When you sign in with Google, we receive your name, email address, and profile picture from your Google account. We use this solely to create and identify your account.

Financial information you enter.

The Service stores the records you create, including expenses, debts, installment plans, income sources, recurring bills, bank accounts and account transactions, credit cards, forecast scenarios, and any descriptions, categories, remarks, or amounts you attach to them.

Email-derived transaction data.

If — and only if — you explicitly connect your Gmail account, we access transaction-related emails on a read-only basis to detect purchases and bills. We store the resulting proposed transactions for your review, along with the connection settings and tokens needed to maintain the integration. This feature is optional; the Service is fully usable without it, and you can disconnect at any time.

Technical information.

We process standard technical data required to operate the Service, such as session cookies for authentication and server logs generated by our hosting provider.

• To provide the Service — storing and displaying your financial records.
• To authenticate you and keep your account secure.
• To calculate balances, currency conversions, reconciliations, and spending forecasts.
• To detect transactions from emails you have chosen to let us read, and present them for your approval.
• To share data with other users only when you explicitly grant them access.
• To respond to your support requests and to comply with legal obligations.

We do not sell, rent, or trade your personal information, and we do not use your financial or email content for advertising or profiling.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for Gmail data:

• We request read-only access and use it solely to identify transaction details (merchant, amount, date, currency) in order to create expense records for you.
• We do not transfer this data to others except as required to provide the feature, comply with law, or as part of a merger with equivalent protections.
• We do not use this data for advertising, and no human reads your email except with your explicit permission for support or security purposes.
• Revoking access at your Google Account permissions page — or disconnecting in-app — stops all further email access.

We share data with a limited set of providers strictly to operate the Service:

• Google — authentication (sign-in) and, if you connect it, read-only Gmail access.
• Anthropic — when the email ingestion feature is enabled, the content of transaction emails is sent to Anthropic’s Claude API to extract structured transaction details. Anthropic does not train its models on data submitted through its API.
• Vercel — application hosting and delivery.
• Prisma Data Platform — managed PostgreSQL database hosting.

• Sensitive financial fields — including amounts, titles, descriptions, and currencies — are encrypted at rest using AES-256-GCM authenticated encryption before being written to the database.
• All traffic between your browser and the Service is encrypted in transit over HTTPS.
• Access to your records is scoped to your account and enforced on every request.
• Credentials for third-party integrations are stored encrypted.

No system can be guaranteed perfectly secure, but we design and operate the Service to minimize the impact of any single failure.

The Service includes a sharing feature that lets you grant another user read access to your financial records. This only happens when you explicitly create a share, and you can revoke it at any time. Nothing is shared with other users by default.

We retain your data for as long as your account is active. You may delete individual records at any time within the app. To request deletion of your entire account and all associated data, or to request a copy of your data, contact us at [your-support-email@example.com]. We will action verified requests within 30 days, except where we are required to retain records by law.

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, and to withdraw consent for optional features such as the Gmail integration. To exercise any of these rights, contact us at [your-support-email@example.com].

Our providers may process and store data in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above, and where appropriate we will notify you in the app.

Questions about this policy or your data? Contact [Your registered legal entity name] at [your-support-email@example.com].

[Your registered business address]