Privacy Policy

Data we collect

We collect only what the app needs in order to work. There are no advertising trackers and no third-party analytics SDKs in the mobile apps.

• Account data: your name, email address, Google account identifier and profile picture URL, received from Google when you sign in. We never receive or store your Google password.
• Financial data you enter: transactions (amount, currency, month, description, category, and whether they are paid or pending), recurring bills, monthly settings, manual exchange rates, the companies and family groups you belong to, and profit distributions.
• Files you import: the contents of any CSV file you upload to create entries.
• Subscription data: your Stripe customer and subscription identifiers and the date your plan expires. Card numbers are handled entirely by Stripe and never reach our servers.
• Notification devices: when you use a mobile app, a push notification token issued by Firebase Cloud Messaging, the platform (Android or iOS), and the time that device last opened the app.
• Service records: a log of actions taken in the app, a record of which notification emails were sent to you, and the time of your last sign-in. These keep scheduled jobs from repeating themselves and help us investigate problems.
• Technical data: our hosting and database providers process standard connection information, such as IP address and browser or device type, as part of serving each request.

How we use your data

• To run the app: storing your entries, converting them between BRL, USD and CAD at historical exchange rates, and producing your monthly summaries.
• To send the notifications you have enabled — monthly emails and, on mobile, the matching push notifications. A push notification only ever mirrors an email we also sent you.
• To generate AI insights if you are on the Pro plan, as described below.
• To take payment for the Pro plan and to apply trials and promotional discounts.
• To reply to messages you send us through the in-app contact form.
• To keep the service secure, prevent abuse, and meet our legal obligations.

We do not sell your personal data, we do not use it for advertising, and we do not share it with advertisers or data brokers.

AI insights and automated processing

On the Pro plan the app can generate short written insights about your finances. Before anything reaches a language model, your data is condensed into a compact summary — monthly totals per category and currency, expected bills compared against actual ones, unpaid items, and a small number of notable entries. Your transaction history is not sent row by row.

That summary is processed by Anthropic (Claude) through our automation pipeline. Your data is not used to train the model.

Insights are informational only. They are not financial, investment, tax or legal advice.

Insights are generated only for Pro accounts, and you can turn insight emails off at any time in Settings, under Notifications.

What other people can see

Fin Control is built for shared finances, so some data is visible to other people by design:

• Family groups: members of your family can see each other’s personal finances, and family administrators can also change them.
• Companies: members of a company can see that company’s finances, and company administrators can also change them and record distributions — which create a matching income entry in the receiving member’s personal finances.
• Invitations: when you invite someone to a family or company, they see your name and email address.

Your personal finances are never exposed to a company because you are a member of it, and access ends when you leave a group.

Service providers

We rely on a small number of processors, each receiving only what it needs to do its job:

• Vercel — application hosting.
• Neon — the PostgreSQL database where your data is stored.
• Google — Google Sign-In, and Firebase Cloud Messaging for push notifications.
• Resend — delivery of notification and transactional email.
• Stripe — subscription payments and card processing.
• Anthropic — the language model behind AI insights, for Pro accounts.
• n8n — the automation service that schedules insight and campaign jobs.

Daily exchange rates come from a public API based on European Central Bank data. No personal data is sent when rates are requested.

These providers run infrastructure in several countries, so your data may be transferred to and stored outside your country of residence, including in the United States and the European Union.

How long we keep it

• Your account and financial data are kept for as long as your account exists.
• Push notification tokens are deleted when you sign out, or when the device stops accepting notifications.
• Records of sent emails are kept so that a scheduled notification is never delivered to you twice.
• After deletion, copies may persist in encrypted backups for a limited period before they are overwritten.

Deleting your account

You can have your account and everything stored with it deleted at any time. Send the request from the contact form inside the app, under Settings, or email privacy@movydata.com from the address you use to sign in.

We confirm and complete deletion within 30 days. If you are the only administrator of a company, tell us what should happen to that company’s records — they are deleted along with your account unless you ask us to transfer ownership to another member first.

Your rights

We process your data to provide the service you asked for, with your consent for notifications and AI insights, for our legitimate interest in keeping the service secure, and where the law requires it.

Depending on where you live — including under the Brazilian LGPD and the European GDPR — you have the right to access your data, correct it, export it, restrict or object to certain processing, withdraw consent, and have it deleted. Most of this you can do directly in the app; for anything else write to privacy@movydata.com. You may also complain to your local data protection authority.

Security

• Traffic between your device and our servers is encrypted with HTTPS.
• Sign-in goes through Google, so we never handle your password.
• Sessions are stored in signed, encrypted cookies.
• Every request that reads or writes financial data is checked against your membership and role in the family or company it belongs to.

Children

Fin Control is not directed at children. You must be at least 18 years old to create an account.

Changes to this policy

If we change this policy we update the date shown at the top of this page, and for significant changes we notify you in the app or by email.

Contact

Questions about this policy, or about the data we hold on you: privacy@movydata.com, or use the contact form inside the app.