Privacy

01Information We Collect

• Account Data: Name and email address (if logging in using a Google account) or manual registration data (email/username).

• Transaction Data: Records of income, expenses, and receipt photos (if uploaded by the user).

• Technical Data: Device information, cookies, and activity logs to support service performance.

02How We Use Your Information

Your data is used to:

• Provide, operate, and improve the Moneysaurus AI service.

• Store transaction records according to User input.

• Send notifications related to service usage.

• Ensure system security and prevent abuse.

03Data Storage & Security

• Data is stored on servers with industry-standard security (encryption, access control).

• We do not sell, rent, or share your personal data with third parties without consent, unless required by law.

• Users may request data deletion by deleting their account through settings or by contacting us.

04Legal Basis for Processing

In accordance with Article 8 of Law No. 27 of 2022 on Personal Data Protection, we process your personal data based on:

• User Consent: By creating an account and accepting these terms, you consent to the processing of your personal data as described in this policy.

• Contract Performance: Processing necessary to provide the Moneysaurus AI service as agreed upon registration.

• Legal Obligation: Processing required to comply with applicable Indonesian laws and regulations.

05Third-Party Integrations & Cross-Border Data Transfers

Your data may be processed by the following third-party services, some of which operate outside Indonesia. By accepting this Privacy Policy, you explicitly consent to these international transfers in accordance with Articles 34-35 of UU PDP:

• Google Gemini (United States): Anonymized transaction data (amounts, categories, dates), wallet balances, and budget/goal information are sent to Google Gemini for AI-powered financial analysis. No bank account credentials or authentication data are sent. Data is not used for AI model training.

• Google Login (United States): Requires access to basic account data (name & email) for authentication.

• Xendit (Singapore): Payment amounts, transaction IDs, and metadata are shared for premium subscription payment processing.

• Telegram (International): If using Telegram integration, chat messages and financial queries are processed through Telegram's servers, subject to Telegram's Privacy Policy.

• WhatsApp / Wasender (International): If using WhatsApp integration, phone numbers and message content are processed through Wasender API servers.

• All cross-border transfers employ industry-standard encryption in transit (TLS 1.2+). We ensure adequate data protection safeguards are in place with each processor.

06User Rights

In accordance with Law No. 27 of 2022 on Personal Data Protection (Articles 5-21), Users have the right to:

• Access, correct, update, or delete their personal data.

• Withdraw consent for data processing at any time.

• Object to the processing of certain data.

• Obtain a copy of their personal data in a structured, commonly used, and machine-readable format (data portability) via the data export feature in account settings.

• Lodge a complaint with the Indonesian Data Protection Authority (Badan Pelindungan Data Pribadi / BPPD) if they believe their data rights have been violated.

07Data Retention

• Personal data will be stored as long as the User's account is active.

• If an account is deleted, all related data will be deleted within a maximum of 30 days after the deletion request is received.

08Children's Privacy

• The Moneysaurus AI Service is not intended for children under 13 years old.

• We do not intentionally collect data from children under that age.

• If it is discovered that data from a child is stored, we will immediately delete it.

09Data Security Incident Response

In accordance with Article 46 of UU PDP, in the event of a personal data security breach that poses a risk to your rights and freedoms, we will:

• Assess the incident within 24 hours of discovery.

• Notify affected users within 72 hours via registered email, providing details of the breach, the types of data affected, and steps taken to mitigate the impact.

• Report the incident to the Indonesian Data Protection Authority (BPPD) as required by applicable law.

• Provide guidance on protective measures users can take to safeguard their accounts.

10Changes to the Privacy Policy

• We may update this Privacy Policy from time to time.

• Significant changes will be notified via registered email or in-app notifications.

11Contact