Privacy Policy

Who We Are

Mohnu is a personal finance management application operated by Kaue Pilger (the "operator", "we", or "us"), based in Brazil. It helps you record, categorise, and understand your spending and savings. Because we offer the service to people in the European Economic Area (EEA), we act as the data controller for your personal data under the EU General Data Protection Regulation (GDPR). If you are in Brazil, the equivalent protections under the Lei Geral de Proteção de Dados (LGPD) also apply. For any privacy question, or to exercise your data rights (access, export, correction, or deletion), contact us at: support@mohnu.com

What We Collect

When you create an account and use Mohnu, we process the following personal data:

• •Email address
• •First and last name
• •A declaration that you are 18 or older when you continue or sign up
• •Financial data you voluntarily enter: transactions, categories, account balances, and payment holders
• •IP address and request metadata — used for security and rate limiting only
• •Session tokens stored as encrypted cookies, required for authentication

How We Use Your Data

Your data is used exclusively to:

• •Operate and deliver the Mohnu personal finance service
• •Authenticate your identity across sessions
• •Enforce security controls and rate-limit abusive requests
• •Process optional AI-powered actions when you choose to use them
• •Respond to support and data rights requests you send us

Legal Basis (GDPR Art. 6)

We process your personal data on the following legal bases under Article 6 of the GDPR: (a) Performance of a contract (Art. 6(1)(b)) — to provide the Mohnu service you signed up for, including your account, your financial records, and billing. (b) Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and rate-limit requests, using data such as IP addresses and session metadata. You may object to this processing (see Your Rights). (c) Consent (Art. 6(1)(a)) — for strictly optional features, such as any future analytics cookies, which are only activated after you opt in. You may withdraw consent at any time. (d) Legal obligation (Art. 6(1)(c)) — to retain limited billing records where we are required to do so by applicable law. We do not process your data for advertising, profiling, or sale to third parties.

Service Providers (Sub-Processors)

These third-party services process your data on our behalf:

International Data Transfers

Your account data is stored in Germany (EU) via Neon, and rate-limit counters are stored by Upstash in Germany (EU). Application requests are served through Vercel's global edge network, which includes nodes in the United States. Transactional emails are routed through Resend (USA), and billing is processed by Stripe (USA / global). Optional AI requests may be processed by Google Gemini on Google infrastructure, and the optional voice feature sends the audio you record to OpenAI (USA) for transcription. Error monitoring, where enabled, is provided by Sentry. Some of these providers are located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on the safeguards permitted under Chapter V of the GDPR — principally the European Commission's Standard Contractual Clauses (Art. 46) included in our providers' data processing agreements, and, where a provider is certified, the EU-US Data Privacy Framework. These transfers are limited to what is strictly necessary to operate the service or to process the optional action you requested. You can request more information about these safeguards at support@mohnu.com.

Optional AI Features

Artificial Intelligence features are optional. You can use Mohnu without using AI and record or categorise your financial data manually. When you choose to use an AI-powered feature, Mohnu may send Google Gemini only the information needed to process that request, such as the text you provide and limited financial context needed for the feature. Depending on the feature, this context may include category names, account names, member names, transaction names, transaction types, or amounts you entered for that AI action. The optional voice feature lets you create a transaction by speaking. When you use it, the audio you record is sent to OpenAI solely to transcribe it into text; that text is then processed exactly like a transaction you typed. Mohnu does not store your audio: it is held only in memory for the duration of the request, forwarded to OpenAI for transcription, and discarded immediately afterwards — it is never written to our disks or saved to your account. OpenAI may process the audio according to its own terms and data processing practices. Mohnu does not sell your data. We aim to send only the minimum necessary data to our AI providers and do not send email addresses, user IDs, tenant IDs, workspace IDs, Stripe or billing data, or authentication data as part of AI prompts. Google and OpenAI may process data submitted to them according to their own terms, privacy rules, and data processing practices.

Data Retention

We retain your account and financial data for as long as your account remains active. We do not currently operate a general automated retention schedule for active accounts. Workspace owners can schedule deletion of the tenant/workspace account from Settings. After confirmation, deletion is scheduled with a 7-day cancellation period and then purged by an automated job. Non-owner users should contact support@mohnu.com for help with account or data requests.

Your Rights Under the GDPR (Art. 15–22)

If you are in the EEA, you have the following rights regarding your personal data:

• •Access (Art. 15) — request a copy of the personal data we hold about you
• •Rectification (Art. 16) — request that inaccurate or incomplete data be corrected
• •Erasure (Art. 17) — request deletion of your personal data, subject to limited legal exceptions
• •Restriction (Art. 18) — request that we limit how we process your data in certain circumstances
• •Portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format
• •Objection (Art. 21) — object to processing based on our legitimate interests
• •Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time, without affecting processing already carried out
• •Lodge a complaint (Art. 77) — complain to the data protection supervisory authority in your country

How to Exercise Your Rights

You may request access to, export of, or deletion of your personal data by contacting support@mohnu.com. Where self-service tools are available in the app, you may also use them. We may exclude internal, security-sensitive, or legally restricted information. For correction, non-owner requests, export help, deletion help, or any other data rights request, send an email to support@mohnu.com with the subject line "Data Request" and describe what you need. We aim to respond within 5 business days and, in any case, within one month as required by Article 12(3) of the GDPR. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the data protection supervisory authority in your EEA country of residence.

Cookies

Mohnu uses the following cookies: (a) Essential cookies: session authentication tokens and locale preferences. These are required for the service to function and cannot be disabled. (b) Analytics cookies: we may introduce optional analytics to improve the product. These will only be set after you provide explicit consent through an in-app cookie notice. This policy will be updated before any analytics tracking is activated.

Age Restriction

Mohnu is intended for users who are 18 years of age or older. We do not knowingly collect data from minors. Mohnu does not collect date of birth during sign-up. When you continue or create an account, you declare that you are 18 or older and agree to the Terms of Service and Privacy Policy. If you are under 18, do not create an account. If we become aware that a user is under 18, we will delete their account and associated data immediately.

Changes and Contact

We may update this policy as the service evolves. Material changes will be communicated by email to affected users before taking effect. Continued use of the service after a change constitutes acceptance. For any privacy questions or data protection rights requests, contact us at: support@mohnu.com