Privacy Policy

1. Controller and contact

The data controller for the personal data processed through Moniova is Moniova ("we", "us", "our").

For any request related to your personal data or this policy, contact us at [email protected]. We will respond within the time limits set by applicable law (e.g. 30 days under the Turkish Personal Data Protection Law (KVKK), or without undue delay under the GDPR where it applies).

2. Data we collect

Account data: When you register, we collect your email address and your password, which is stored securely using industry-standard methods. We do not store your password in plain text.

Data you provide in the service: When you use Moniova, you may enter information about your credit cards, accounts, installments, and statements. This data is stored so we can provide the service (e.g. cash flow views, risk indicators). We do not connect to your bank or access your accounts; all financial data is what you enter or import.

Gmail data (optional feature): If you choose to enable the Gmail integration, Moniova will read incoming emails in your Gmail inbox solely to identify bank and financial institution notification emails (e.g. transaction alerts, statement notifications). When a matching email is identified, only the relevant transaction data (amount, merchant, date) is securely sent to Moniova. After processing, a label is added to the email in your inbox to indicate it has been handled. Moniova does not read, store, or process any other emails. The raw email content is not retained on our servers beyond what is required to extract the transaction data. This feature is entirely optional and can be disabled at any time.

Technical and usage data: We collect technical data such as IP address, browser type, device information, approximate location (country/region level), and logs of requests to our systems. We use the following tools to operate, secure, and improve the service:

Google Analytics: We use Google Analytics to understand how visitors interact with our website (e.g. pages viewed, time on site, traffic sources). Google Analytics sets cookies on your device. These cookies are activated only after you give consent through the cookie banner. You can withdraw consent at any time via the cookie settings link in the footer. Google may transfer data to servers in the United States; we rely on standard contractual clauses for this transfer. For more information, see Google's privacy policy at policies.google.com/privacy.

PostHog: We use PostHog, hosted on our own infrastructure, for product analytics and session recording. PostHog does not use cookies and does not transfer data to third parties. Session recordings mask all input fields by default. PostHog data does not leave our infrastructure.

Cookiebot: We use Cookiebot to manage your cookie preferences. Cookiebot sets a necessary cookie to remember your consent choice. This cookie is exempt from consent requirements as it is strictly necessary for the cookie consent mechanism to function.

3. Cookies and similar technologies

Cookies are small text files stored on your device by your browser. We use cookies and similar technologies (e.g. local storage) for the following purposes:

Strictly necessary: A consent cookie remembers your cookie preferences. This cookie is set without requiring your consent because it is essential for the cookie consent mechanism to function.

Analytics (consent required): Analytics cookies help us understand how our website is used. These cookies are only set after you provide consent through the cookie banner.

Product analytics (no cookies): PostHog does not use cookies and is hosted on our own servers. It is used to understand feature usage and improve the product.

You can manage your cookie preferences at any time by clicking the "Cookie Policy" link in the footer of our website, which includes a full cookie declaration and the option to change your consent. You can also configure your browser to block or delete cookies, though this may affect the functionality of some parts of the website.

For a complete, auto-updated list of all cookies used on this site, visit the Cookie Policy page at moniova.com/cookies.

4. Purposes and legal basis

We process your data for the following purposes and on the following legal bases:

Providing the service: We process your account data and the data you enter in the app to create and manage your account and to deliver Moniova's features (e.g. installment tracking, cash flow projection). Legal basis: performance of the contract with you (and, where relevant, your consent when you sign up).

Gmail integration (optional): Where you have enabled the Gmail integration, we access your Gmail account to read bank notification emails, extract transaction data, and add a processed label to those emails. This access is used exclusively to deliver this feature; it is not used for any other purpose including advertising, profiling, or analytics. Legal basis: your explicit consent when you enable the feature.

Analytics: Where you consent to analytics cookies (via the cookie banner), we process usage data through Google Analytics to understand how visitors use our website. Legal basis: your consent. PostHog analytics operates on our own infrastructure without cookies; we process this data on the basis of our legitimate interest in understanding product usage and improving the service.

Security and operation: We process technical and usage data to secure our systems, prevent abuse, and operate the service. Legal basis: our legitimate interest in a secure and stable service.

Legal obligations: We may retain or disclose data where required by applicable law (e.g. court order, regulatory request). Legal basis: compliance with a legal obligation.

Where we rely on your consent for a specific processing activity, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Retention

We keep your account data and the data you enter in the service for as long as your account is active. If you close your account or request deletion, we will delete or anonymise your personal data in line with our deletion process and applicable law, except where we must retain data for legal obligations.

Technical and usage data (e.g. logs) are retained for a limited period necessary for security and operation, typically up to 24 months, unless a shorter or longer period is required by law.

6. Your rights

Depending on your location, you may have the following rights in relation to your personal data:

Access: You can ask us whether we process your data and, if so, receive a copy and information about the processing.

Rectification: You can ask us to correct inaccurate or incomplete personal data.

Erasure: You can ask us to delete your personal data, subject to exceptions under applicable law (e.g. legal retention).

Restriction: You can ask us to restrict processing in certain circumstances.

Data portability: Where the legal basis is contract or consent and the processing is carried out by automated means, you may have the right to receive your data in a structured, commonly used, machine-readable format.

Objection: You can object to processing based on legitimate interest; we will cease unless we have compelling legitimate grounds that override your interests.

Withdraw consent: Where we process data on the basis of consent, you may withdraw consent at any time.

Complaint: You have the right to lodge a complaint with a supervisory authority. In Turkey, you may apply to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). In the European Economic Area, you may contact the supervisory authority in your country of residence.

To exercise any of these rights, contact us at [email protected]. We will handle your request in accordance with applicable law.

7. Google API Services — limited use disclosure

Moniova's use of information received from Google APIs, including Gmail data, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: (a) Gmail data is used only to provide or improve the transaction import feature; (b) Gmail data is not used for serving advertisements; (c) Gmail data is not transferred to third parties except as necessary to provide the feature; (d) Gmail data is not used for credit scoring, lending, or any purpose unrelated to the transaction import feature; (e) humans do not read your Gmail data unless you explicitly consent or we are required by law.

You can revoke Moniova's access to your Gmail at any time by visiting your Google Account permissions page (myaccount.google.com/permissions) and removing Moniova. Disabling the Gmail integration within Moniova will also stop all further Gmail access and delete the associated Apps Script from your Google account.

8. Data sharing and transfers

Moniova does not connect to your bank or other financial institutions. We do not sell your personal data.

We may share data with service providers that help us operate the service. Current providers include: Google (analytics — USA) and Cookiebot (cookie consent management — EU). PostHog is hosted on our own infrastructure and does not share data externally. Such providers act on our instructions and are bound by contractual obligations to protect your data. Where we use providers that process data outside your country, we ensure appropriate safeguards are in place as required by applicable law (e.g. standard contractual clauses, adequacy decisions).

9. Security

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. These include encryption of data in transit and at rest where appropriate, access controls, and secure development practices. No system is completely secure; we will notify you and the relevant authority of a personal data breach where required by law.

10. Children

Moniova is not directed at individuals under 18. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has provided us with personal data, contact us at [email protected] and we will delete it.

11. Changes

We may update this Privacy Policy from time to time. The effective date will be stated at the top or bottom of the policy. We will notify you of material changes by posting the updated policy on our website or through the service. Continued use of the service after the effective date constitutes acceptance of the updated policy, except where your consent is required by law.

12. Contact

For privacy-related requests, questions, or complaints, contact us at [email protected]. We will respond in accordance with applicable data protection law.