Privacy Policy

Moneymz helps you understand where your money went. To do that we read the bank and credit-card statements you give us. That is sensitive information, and this page explains exactly what we collect, what we do with it, who else touches it, and how you get rid of it.

We have written this in plain language on purpose. If anything here is unclear, write to us at info@moneymz.com.

Moneymz is a personal-finance tracking service operated from India. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Moneymz is the Data Fiduciary for the personal data described on this page.

Moneymz is operated by its founder, an individual based in India. It is not yet a registered company; this section will be updated when it is.

Moneymz is not a bank, an NBFC, a lender, a broker, an insurer, or an investment adviser, and is not regulated by the Reserve Bank of India or SEBI, because we do nothing that requires such regulation. We hold no money, move no money, and have no ability to transact on any account of yours.

The product runs at app.moneymz.com. Our website runs at moneymz.com.

Applicable Law — the DPDP Act; the Information Technology Act, 2000 and the rules made under it; and any other Indian law that applies to us, each as amended from time to time.

Personal Data — any data about an identifiable individual, as defined in the DPDP Act.

Platform — the Moneymz web application at app.moneymz.com and the website at moneymz.com.

Services — personal expense, investment and savings tracking: statement ingestion, transaction categorisation, budgets, summaries, insights and exports.

You / User / Data Principal — the individual whose Personal Data we process.

Statement Data — the contents of any bank or credit-card statement you upload, paste or forward to us, and the transactions derived from it.

Sub-processor — a third-party service we use to run the Platform, listed in Section 5.

2.1 Account data

When you sign in with Google, we receive your name, email address and profile photo from your Google account. We never see, receive or store your Google password. Moneymz has no password of its own.

2.2 Statement Data

When you upload a file, paste statement text, or forward a statement to your personal Moneymz email address, we process the contents of that statement. This typically includes transaction dates, narrations, merchant names, debit and credit amounts, and — depending on your bank's format — account or card numbers in masked form, and balances.

We extract the transactions from it and store those. We do not keep the original statement file after processing.

2.3 Data you create in the app

Categories you assign, category corrections, merchant renames, budgets, notes, payment-method labels, hidden-category settings, and any preference you set.

2.4 Feedback and correspondence

Anything you send us through the in-app feedback form or by email, including the page you were on when you sent it.

2.5 Technical data

Standard server and platform logs — IP address, browser type, timestamps, and which routes were called. We use these to keep the service running and to diagnose failures.

When you sign in we also record your browser's user-agent and a device identifier computed from your screen size, timezone, language and platform. We use these only to limit each account to two active devices and to detect unusual sign-ins.

2.6 Information we receive from your Google account

When you sign in with Google, we receive your name, email address and profile photo from your Google account, as described in Section 2.1. We use this only to create and identify your account, sign you in, and contact you about your account if needed. We do not request access to your Gmail, Google Drive, Google Contacts, or any other Google service beyond basic sign-in — Moneymz only ever asks for your name, email address and profile photo.

We also use the part of your email address before the @ to create your personal Moneymz forwarding address (for example, name@gmail.com becomes name@moneymz.com).

We do not sell this information, and we do not use it for advertising.

You can delete it at any time: Settings → Delete All My Data removes your account record (Section 7), or write to info@moneymz.com to have your entire account deleted.

Moneymz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We process your Personal Data only to run the Services you asked for:

1. To sign you in and keep your account.

2. To read your statements and turn them into categorised transactions.

3. To calculate your summaries, budgets, insights and net position.

4. To remember your corrections, so the same merchant is categorised the same way next time.

5. To generate the exports you request.

6. To keep the Platform secure, prevent abuse, and apply rate limits.

7. To answer you when you write to us.

8. To comply with Applicable Law.

That is the complete list. We do not process your data for any purpose you have not asked for.

Your statements are read by a third-party AI system. We are telling you this plainly rather than burying it, because it is the single most important thing on this page.

Statement extraction — turning a PDF or spreadsheet into a list of transactions — is performed by Google's Gemini API. The statement text is sent to Google, Google returns structured transactions, and we store those.

Google currently provides this service on its free tier. Under Google's terms for that tier, Google may use the content we send and the results it returns to provide, improve and develop its products, including training its machine-learning models, and Google's human reviewers may read it.

What we send is the content you give us: the statement file, the text you paste, or the email you forward to your Moneymz address. Statements and forwarded emails can themselves contain your name, email address and partial account numbers, so that information may be included. We do not add your account details, your Moneymz identifiers or anything else from your account to what we send.

We do not train any model of our own on your data.

If you are not comfortable with your statement text being processed this way, please do not upload statements. You can still use Moneymz by entering transactions manually, which involves no AI processing at all.

We do not sell your data, and we do not share it with lenders, insurers, credit bureaus or advertisers.

We use a small number of infrastructure providers to run Moneymz. They process your data only to provide their service to us, under their own terms.

Some of this processing happens outside India. The DPDP Act permits such transfers except to countries the Government of India restricts; we do not transfer your data to any restricted country.

Beyond these providers, we disclose your data only:

when you ask us to;

when we are legally required to, by a court, a regulator, or a lawful government request;

to protect the safety, rights or property of Moneymz, our users, or others, including in a fraud or abuse investigation;

if Moneymz is ever sold, merged or transferred — in which case we will tell you before your data moves, and you will be able to delete your account first.

Sign-in is Google-only. We store no passwords, so we cannot lose yours.

Data is encrypted in transit (TLS) and encrypted at rest by our storage provider.

Database rules restrict every record so that only the signed-in owner can read or write it.

Our processing routes verify your identity on the server and are rate-limited.

Secrets and credentials are held in our hosting provider's encrypted environment store and never in our source code.

Access to production data is strictly limited.

No system is perfectly secure, and transmitting data over the internet carries inherent risk. If we become aware of a breach affecting your Personal Data, we will notify you and the Data Protection Board of India as required by the DPDP Act.

We keep your data for as long as your account exists.

You can delete everything yourself. Settings → Delete All My Data removes your transactions, budgets, merchant history and account record, and signs you out. This is immediate and irreversible — we cannot restore it for you afterwards.

You can also write to info@moneymz.com and ask us to delete your account. We will do it and confirm when it is done.

Deleting your data removes it from Moneymz. Content already sent to Google for statement extraction (Section 4) is held by Google under its own terms, and we cannot delete it from Google's systems.

We may retain a minimal record of the fact of deletion, and anything we are required by law to keep.

Under the DPDP Act you have the right to:

Know what Personal Data of yours we hold and what we do with it.

Access a copy of it. Settings → Export gives you your transactions immediately; write to us for anything else.

Correct anything inaccurate, incomplete or out of date. Most of this you can do yourself inside the app.

Erase your data, as described in Section 7.

Withdraw consent at any time. Withdrawing consent for the processing described here means we can no longer provide the Services, so it is equivalent to closing your account.

Nominate another person to exercise these rights on your behalf if you die or become incapacitated. Write to us to register a nominee.

Complain to us, and if we do not resolve it, to the Data Protection Board of India.

We do not charge for any of this. Write to info@moneymz.com and we will respond within 7 days.

Please raise requests from the email address of the account concerned so that we can be sure it is you.

We use cookies and browser storage only to keep you signed in and to remember interface preferences such as your selected month. We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across websites. Clearing them will sign you out; nothing else will break.

Our website moneymz.com uses Google Analytics to count visits in aggregate. The Moneymz app itself does not use analytics or advertising trackers. You can opt out using your browser's settings or Google's Analytics opt-out add-on.

Moneymz is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

Moneymz may link to other websites. We do not control them and are not responsible for their privacy practices. Read their policies before giving them anything.

We may update this policy. The current version is always at app.moneymz.com/privacy with the date at the top. If a change materially affects how we handle your data, we will tell you before it takes effect, and where the law requires fresh consent, we will ask for it.

This policy is governed by the laws of India, and the courts of competent jurisdiction in India shall have jurisdiction over any dispute arising from it.

For any question about this policy, any request about your data, or any complaint about how we have handled it:

We aim to acknowledge within 24 hours and to resolve within 15 days, as required under Applicable Law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.