Privacy Policy

Effective October 5, 2026

This Privacy Policy explains how we collect and use personal data when you use Netmonth (the "Service").

In short: we collect only what we need to run the Service, we never sell your data, we use no advertising cookies and show no ads, and you can download or delete everything at any time.

1. Data controller

The data controller responsible for your personal data is:

2. Data we collect

• Account data: name, email address, password, language, number format and currency preferences. If you sign in with Google, we receive your name, email address and a Google account identifier.
• Financial data you provide: transactions you enter, statements you upload (the file and the transactions read from it), categories, rules and recurring items. We never ask for, and you should never give us, your online banking credentials.
• Subscription data: your plan, subscription status and renewal dates, which we receive from our payment provider Paddle. We do not receive or store your card details.
• Messages: what you send us through the contact form or by email.
• Technical data: IP address, browser type, and server logs needed for security, troubleshooting and fraud prevention.

3. Why we use it (and legal bases)

• To provide the Service — store your data, read your statements, calculate totals, convert currencies (performance of a contract).
• To manage your subscription and send service emails such as password resets (performance of a contract).
• To answer your messages (performance of a contract or legitimate interests).
• To keep the Service secure and prevent abuse (legitimate interests).
• To comply with legal obligations, such as tax and accounting rules.

We do not use your financial data for advertising, and we do not sell or "share" personal data as those terms are defined under California law.

4. Service providers

We use carefully selected providers who process data on our behalf under data processing agreements:

• Hosting provider — our servers and database.
• Anthropic — reads statement files that cannot be read by our own parsers (for example PDFs) and helps recognize columns in spreadsheet files. Under Anthropic's commercial terms, this data is not used to train their models.
• Paddle — processes payments as our Merchant of Record. Paddle acts as an independent controller for the payment data you give it; see Paddle's privacy policy.
• Google — only if you choose "Sign in with Google".
• Google Analytics — anonymous statistics about how our pages are used (pages visited, device type, approximate country). Advertising features and Google signals are switched off, and no account data or financial data is ever sent. In the EU/EEA, the UK and Switzerland it runs without cookies.
• Email delivery provider — sends service emails such as password resets.

Exchange rates are downloaded from the European Central Bank; no personal data is sent to it. We may also disclose data to public authorities when the law requires it.

5. International transfers

Some providers process data outside your country, including in the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses, and, for transfers from Türkiye, the safeguards required by the Turkish Personal Data Protection Law No. 6698 (KVKK).

6. How long we keep data

• Account and financial data: as long as your account exists. Uploaded statement files are kept so that you can view them later, and are deleted with the statement or your account.
• After you delete your account: your data is deleted from our live systems immediately and from any backups within 30 days.
• Server security logs: up to 90 days.
• Website usage statistics (Google Analytics): up to 14 months.
• Invoices and payment records: kept by Paddle and, where applicable, by us for the period required by tax law.

7. Cookies

We use essential cookies to keep you signed in, to protect forms against cross-site request forgery, and to remember your language. We also use Google Analytics cookies to understand how the website is used; in the EU/EEA, the UK and Switzerland, Google Analytics runs without cookies. We do not use advertising cookies. You can block or delete cookies in your browser settings at any time. Paddle's checkout may set its own cookies when you start a payment.

8. Your rights

Depending on where you live — for example under the GDPR in the EU/UK, the CCPA/CPRA in California, or Article 11 of the KVKK in Türkiye — you have the right to:

• learn whether your personal data is processed and access it, and receive a copy in a portable format — use Settings → Your data → Download;
• learn the purposes of processing and the recipients your data is transferred to, in Türkiye or abroad;
• correct inaccurate data — in Settings or by editing your transactions;
• delete your data — use Settings → Your data → Delete account, see Account deletion;
• object to or restrict certain processing, object to a result produced solely by automated processing that is to your detriment, and withdraw consent where processing is based on consent;
• claim compensation for damage caused by unlawful processing;
• not be discriminated against for exercising your rights;
• lodge a complaint with your data protection authority (in Türkiye: the Personal Data Protection Authority, KVKK).

For any other request, email [email protected] from the address registered to your account. We respond within 30 days at the latest.

9. Security

Data is transmitted over encrypted connections (HTTPS). Access to production systems is restricted. Card details are never stored on our servers. No system is perfectly secure, so please use a strong, unique password.

10. Children

The Service is not intended for children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy. If changes are material, we will notify you by email or in the Service before they take effect.