GDPR Compliance

Last updated: November 5, 2026

MoneyFlow is fully compliant with the General Data Protection Regulation (EU) 2016/679. This page illustrates the principles and specific safeguards we apply for the data of users residing in the European Union.

Core principles applied

• Lawfulness, fairness and transparency – We always explain how and why we use your data.
• Purpose limitation – We only collect data necessary for the stated purposes.
• Data minimization – We do not store direct banking data or sensitive data.
• Accuracy – You can modify or correct any data at any time.
• Storage limitation – We delete data after account closure (max 30 days).
• Integrity and confidentiality – End-to-end encryption and strictly limited access.
• Accountability – We keep a register of processing activities and conduct DPIAs for AI profiling.

Your GDPR rights

In addition to the rights listed in the privacy policy (access, rectification, erasure, etc.), you specifically have the right to data portability (receive a structured copy of your financial data in JSON/CSV format) and the right to object to processing based on legitimate interest (including profiling). To exercise your rights, send a request to info@trymoneyflow.com. We do not charge any fee for exercising rights, except for manifestly unfounded requests.

AI profiling processing

Our PRO features (Your habits, Where you're heading, Savings plan) use machine learning algorithms to analyze your spending patterns and provide predictive insights. This profiling occurs only with your explicit consent (which you can revoke at any time from settings). You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you – MoneyFlow does not make binding automated decisions.

Data Protection Officer (DPO)

We have appointed an internal DPO reachable at info@trymoneyflow.com for any matters related to the protection of personal data.

Data breach notification

If a personal data breach occurs, we notify it to the Garante per la protezione dei dati personali (the Italian Data Protection Authority) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to your rights and freedoms (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay (Art. 34 GDPR).

Extra-EU transfers

App data resides on servers in Germany (AWS eu-central-1) and is not transferred outside the EEA. The exception is payment data for the PRO subscription: it is processed by Stripe, which may transfer it to the United States on the basis of the EU-U.S. Data Privacy Framework, in which Stripe participates, and of the standard contractual clauses approved by the European Commission.

Complaints to the supervisory authority

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian Data Protection Authority (www.garanteprivacy.it), or with the authority of your country of residence.