Your data.
Clearly explained.

Who is responsible?

Joël Scheffers manages the pilot and is the data controller for MoniRatio. Dutch Chamber of Commerce (KvK) number: 42218879. Questions: support@moniratio.com.

What data do we use?

Website and tester applications

To serve pages, technical request data such as IP address and requested page is processed; the hosting provider may keep technical logs. A test application asks for a desired username, contact email and optional explanation. We use these to review your application and contact you personally. It does not subscribe you to a newsletter or create an app account.

Account and financial overview

An app account uses a username and password without an email address. Access and security records include password and recovery-code hashes, sessions and beta status. The administration contains what you enter or import: for example names, income, expenses, entries, accounts, savings goals, debts, investments and trading data. Data is linked to your account and shielded from other users. An account without email is not anonymous: the chosen username can connect your test application to the account.

If you save notification preferences, we store the selected accounts, advance notice, time, time zone and quiet hours. These are draft settings for future notifications; saving them does not send messages. They are outside financial exports and are included in account deletion.

Exchanges, notes and contact

If you connect a supported exchange, we store the connection and encrypted API data; the server uses them to make read requests. Set keys to read-only at the exchange, without trading or withdrawal rights. Source and verification data retrieved may also be stored. Pilot Logbook notes remain in your account and are not sent automatically. When you email or send feedback, we process what you choose to share. Do not send passwords, recovery codes, API keys or complete financial exports.

Cookies and browser storage

Privacy settings on this website

Moniratio.com uses iubenda Privacy Controls and Cookie Solution to display and remember privacy settings. Necessary technology handles operation and privacy preferences. Only with your consent to “Measurement” do we use HeyCatch for visit and click statistics; advertising remains off. Open “Privacy settings” in the footer. If the control does not load, this information remains available and optional measurement stays off.

Iubenda receives technical request data such as IP address and requested page and the recorded privacy choice. Technical cookies beginning _iub_cs- remember the choice and time; _iub_previous_preference_id may refer to the previous recorded preference. Cookies are configured for 365 days, may be renewed, are scoped to the visited website host without sharing to subdomains, and are managed by page scripts. Their duration does not determine server-log or backup retention, which still needs separate confirmation. See iubenda’s product privacy policy.

In the app

A functional session cookie keeps you signed in for at most 30 days. It is protected from ordinary page scripts and sent securely via HTTPS; logging out or account changes may end a session earlier. Browser storage communicates session changes and remembers the selected overview during a browser session; it may refer to a username or selected person.

The app also remembers per account in this browser which risk explanations and feature introductions you have read. These preferences contain an account reference and read explanations, not financial amounts. They remain until you clear the associated browser data; no automatic expiry is set. Clear browser data on shared devices if you want to remove them. The public test guide stores no answers; copying questions only places fixed text on your clipboard and you decide whether to send it.

Optional website analytics with HeyCatch

With your consent to “Measurement”, we use HeyCatch on the public website to understand which pages people visit, where they come from and which elements they click. This helps us improve explanations and navigation. Without that consent, no HeyCatch measurement events are sent and no analytics identifiers remain stored in your browser. An earlier necessary-only preference does not enable this measurement.

Data includes page and referrer addresses, campaign information, clicks, timestamps, and technical browser, device and session information with pseudonymous identifiers. HeyCatch also receives technical request information, including the IP address. We do not link these statistics to your app account or send your financial records, app username or app email address. Session replay is disabled in the SDK we use; we do not add screen recordings.

After consent, the SDK can store identifiers and session information in localStorage and sessionStorage, including keys starting with ph_ and a session counter called heycatch_session_volume. Local storage has no fixed cookie expiry. You can refuse measurement or withdraw consent through “Privacy settings”. Withdrawal stops event collection and removes the associated identity storage; a technical opt-out marker may remain. You can also clear browser data yourself.

HeyCatch, Inc. is based in the United States and describes itself as a processor for SDK data. Its privacy policy names PostHog US Cloud and, for AI analytics, OpenRouter and model providers. Processing outside the EEA is therefore possible. The processor terms and subprocessor information describe the applicable agreements and transfer safeguards. This installation does not independently verify those safeguards.

According to the policy read on 3 November 2026, HeyCatch retains SDK data during our active subscription and for up to two months after it ends, unless earlier deletion is requested or the subscription is reactivated. Withdrawing browser consent does not automatically erase earlier server data. You can contact us about such a request.

Metricool remains paused and its tracking script is not loaded. This HeyCatch installation applies only to the public website; the financial app and private pricing draft do not receive this integration. Hosting also processes the technical requests needed to display the website.

Purposes, legal bases and parties

Processing supports application review, the pilot service you request, assistance and protection of accounts and data. The legal basis for each processing activity still needs to be documented and confirmed. Agreement in a test application does not replace that assessment.

Moniratio uses OpenAI ChatGPT Sites and underlying Cloudflare services for website and app hosting and storage. OpenAI acts as processor for personal data on published Sites under the Sites terms and data processing arrangements. The exact account and contract variant for this environment is still being documented.

The public website uses iubenda s.r.l. in Italy, chosen through TransIP, for privacy controls. Iubenda processes technical request and preference data; see its Legal & Privacy Hub. The exact contract scope and implementation through TransIP remain to be documented.

Moniratio uses TransIP for email, with processing arrangements in place; setup and receipt for support@moniratio.com are still being checked. A personal Microsoft Outlook.com account was also used for existing support correspondence. Microsoft processes messages received there as the receiving email service; its terms and suitable configuration remain under review. Your email address, message and attachments are processed by the email services. An exchange receives authentication and request data needed for read requests. The app also retrieves public market data from data providers.

Processing outside the EEA is possible. OpenAI’s public subprocessor list lists Cloudflare for web hosting with the United States as a processing location. Sites processing arrangements describe safeguards including standard contractual clauses or adequacy decisions. Actual storage locations, subprocessors and retention for infrastructure logs and backups for this environment still need confirmation, as do applicable arrangements and roles for other services. Email us if you want more information before sharing data.

Retention and deletion

• Test applications: applications older than 90 days are gradually cleaned up when new applications arrive. Physical deletion on exactly day 90 is not guaranteed. You may request earlier deletion.
• Account and administration: data remains available for the pilot. You can delete your account, active financial data and saved recovery copies in Settings. No separate inactivity retention period has been established.
• Recovery copies: automatic copies target the last 30 days, with at most 30 points per account. Cleanup runs during active use or permitted backup actions; physical cleanup may occur later during inactivity. Up to three safety points before restoration may also be kept, with no separate age limit yet.
• Ordinary support emails and attachments: a 90-day retention period after handling has been chosen as a manual working arrangement. Implementation and mailbox settings are still being checked; no automatic cleanup rule is set.
• Other mail, technical logs and hosting copies: complete retention and deletion arrangements remain unresolved. An expired session or account deletion does not mean every technical copy is immediately removed everywhere.

An application, invitation or email is separate from your app account. Deleting the account does not automatically delete earlier applications, separate invitation records or support emails. Include these in a privacy request if you want them assessed for deletion. JSON and CSV exports you downloaded remain wherever you stored them and contain readable data; financial exports do not automatically include all application, access or contact data.

Export and delete yourself

Open the app and go to Settings → Account and data. To take your administration with you, select the full JSON recovery copy or individual CSV files. The JSON bundle covers financial administration and recovery, not every personal-data record concerning your account, application or contact.

To delete your app account, choose “Prepare deletion” under account deletion and confirm in your own session. Save any export you want to keep first. Waiting or paused accounts can export their data or delete the account from the access screen. An ordinary financial recovery copy cannot undo account deletion.

For access to other personal data or a broader request, contact us. An email or username alone does not prove access to an app account; we agree a suitable verification before sharing or changing account data. Do not send a password, recovery code, API key or financial export.

Your rights and contact

You may request access, correction, deletion, restriction or transfer of your personal data. Depending on the legal basis, you may object or withdraw consent. Applicable rights depend on the circumstances. Email support@moniratio.com and specify whether the request concerns your account, test application, email contact or multiple areas. We need to verify the request is yours; do not send passwords, recovery codes or API keys.

We generally handle rights requests within one month of receipt. An acknowledgement alone is not a substantive response. If complexity or volume requires it, the statutory period may be extended by up to two months; we will explain why within the first month. You may also complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens. We update this page if the pilot or processing changes; the date above indicates its last update.