Privacy policy

Effective Date: April 24, 2026

1. Information We Collect

Information You Provide Directly

• Account information: email address, password (hashed), and authentication tokens when you register via Apple Sign-In, Google Sign-In, or email.

• Financial data: account balances, income amounts, expense categories, debt information, recurring bills, and investment data you manually enter into the app.

• Onboarding preferences: financial goals, experience level, and monthly expense estimates you provide during setup.

• Profile information: preferred currency and language settings.

Information Collected Automatically

• Device information: device type, operating system version, app version, and unique device identifiers.

• Usage data: features used, screens viewed, session duration, and interaction patterns within the app.

• Crash reports and diagnostics: error logs and performance data to improve app stability.

Information We Do Not Collect

• Monaza does not connect to your bank accounts or access your banking credentials.

• Monaza does not process payments or hold funds on your behalf.

• Monaza does not collect government-issued ID numbers or financial account numbers.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Monaza app and its features

• Personalise your financial dashboard, forecasts, and insights

• Calculate financial metrics such as available balance, days of money remaining, and net worth

• Send you account-related notifications and alerts you have opted into

• Improve and develop new features based on usage patterns

• Detect, investigate, and prevent fraudulent or unauthorised activity

• Comply with legal obligations

• Respond to your support requests

We do not sell your personal information to third parties. We do not use your financial data to serve you advertisements.

3. Information Sharing

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating the app, such as cloud hosting, analytics, and customer support. These providers are contractually obligated to use your data only to perform services for us and in accordance with this policy.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process (such as a court order or subpoena), or to protect the rights, property, or safety of Tumaio, Inc., our users, or the public.

Business Transfers

If Tumaio, Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice in the app before your information is transferred and becomes subject to a different privacy policy.

With Your Consent

We may share your information in other ways if you have given us explicit consent to do so.

4. Data Storage & Security

Your data is stored on secure servers hosted in the United States. We implement industry-standard technical and organisational measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest (AES-256)

• Access controls limiting employee access to personal data

• Regular security reviews and vulnerability assessments

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, regulatory, or fraud prevention purposes.

Aggregated, anonymised data that cannot identify you may be retained indefinitely for product improvement purposes.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your personal data ("right to be forgotten").

• Portability: Request your data in a structured, machine-readable format.

• Objection: Object to certain types of processing, including direct marketing.

• Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@getmonaza.com. We will respond within 30 days. You may also delete your account directly within the app settings.

California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, disclose, or sell; the right to request deletion; and the right not to be discriminated against for exercising these rights. We do not sell personal information. To submit a request, contact support@getmonaza.com.

EEA / UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, our legal basis for processing your data is performance of a contract (to provide the Monaza service) and, where applicable, our legitimate interests in operating and improving the service. You have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

Monaza is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child has provided us with their data, please contact us at support@getmonaza.com.

8. International Data Transfers

Tumaio, Inc. is based in the United States. If you access Monaza from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For users in the EEA or UK, we rely on Standard Contractual Clauses approved by the European Commission as the legal mechanism for transferring data internationally.

By using Monaza, you acknowledge and consent to the transfer of your data to the United States as described in this policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page, by sending an email to your registered address, or by displaying a notice within the app.

Your continued use of Monaza after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Tumaio, Inc. Email: support@getmonaza.com Website: https://getmonaza.com

A Delaware Corporation, United States of America