MoneyTracky Logo

PRIVACY AND PERSONAL DATA PROCESSING POLICY

  • Company / Legal Entity: APPS PLUS AI S.A.S.
  • Tax ID (NIT): 902.115.901-8
  • Principal Address: Cra 31 # 54 - 52, Medellín, Colombia
  • Privacy Contact Email: data@moneytracky.com
  • Website: https://www.moneytracky.com
  • Data Protection Officer / Controller Contact: Edgar Rodriguez – Director of Privacy and Compliance
  • Effective Date: October 15, 2026
  • Version: 1.3

1. SCOPE AND APPLICABLE JURISDICTION

This Privacy Policy describes the processing of personal data carried out by APPS PLUS AI S.A.S. (hereinafter, the "Company") for users who access, download, install, or use the MoneyTracky software, platform, and mobile application (hereinafter, the "Service" or the "Application").

This policy is fully integrated with MoneyTracky's Terms and Conditions of Use and is structured in strict compliance with applicable regulatory frameworks across its coverage jurisdictions:

  1. Colombia: Statutory Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015, Law 1480 of 2011, and guidelines issued by the Superintendence of Industry and Commerce (SIC).
  2. United States of America: Applicable federal and state regulations, including the California Consumer Privacy Act (CCPA, as amended by the California Privacy Rights Act – CPRA), the Children’s Online Privacy Protection Act (COPPA), Federal Trade Commission (FTC) enforcement principles, and Delaware state commercial law.

2. INFORMATION WE COLLECT

The Application collects the following categories of data:

  1. Account and Identity Information:
    • Data obtained via Google® Identity Services: Full name, email address, and associated profile picture, collected with the User's express authorization upon registering or signing in through Google® authentication services.
    • Account Eligibility Requirement: Registration and access to the Application strictly require a personal Google account with a @gmail.com domain. The User is solely responsible for keeping their Google® account information accurate and up to date.
  2. Operational Data, Google Drive® Environment, and Device Permissions:
    • Google Drive® Structure: Folder ID or link to the root folder created under the designation "MoneyTracky" and its corresponding subfolders within the User's personal Google Drive® storage, required to store processed receipts, generated reports, and backup files.
    • Usage and Extraction Metadata: File names, processed document types, issuance dates, modality (digital or physical/printed), and computing token usage associated with Artificial Intelligence (AI) models (Google Gemini®).
    • Voice Recordings (Microphone Access): If the User utilizes voice-to-text dictation commands within the AI assistant or query features, the Application requests temporary access to the device microphone strictly during audio capture for transcription purposes.
    • Optional Google Apps Script: The Application offers an optional script to automate the retrieval of invoices from Gmail® to Google Drive®. This script executes entirely within the User's own Google® account, infrastructure, and granted permissions. The Company does not access the User's inbox nor does it store personal communications on its servers.
  3. Billing and Subscription Data:
    • Subscription history, purchased tier (e.g., Freemium, Basic, Premium, Ultra), validity term, associated profile, and transaction confirmations.
    • Payment Processing Clarification: All financial transactions are processed through certified PCI-DSS compliant platforms (Google Play Billing, Apple App Store, or authorized payment gateways in Colombia and the United States). The Company never collects or stores complete credit/debit card numbers, expiration dates, or security codes (CVV/CVC).
  4. Technical and Diagnostic Data:
    • Declared country of residence (Colombia or U.S.), preferred language (Spanish or English), unique device identifier, operating system, session logs, and technical crash or diagnostic reports.

3. PURPOSES OF PROCESSING

Collected personal and operational data are processed for the following legitimate purposes:

  • Service Delivery and Operation: User authentication, profile management (Builder, Merchant, Family, Farm Owner), and synchronization with Google Cloud Platform and Google Drive® services.
  • Automated Data Extraction and Intelligent Queries: Providing AI-assisted extraction (Google Gemini®) of income and expense items from documents, and enabling report generation and contextual responses via Query with AI and AI Assistant features.
  • Administrative and Billing Management: Issuing invoices or electronic billing receipts, and managing membership status, renewals, and cancellations.
  • Support and System Security: Troubleshooting technical issues, responding to customer support inquiries, executing balance re-synchronization routines, and preventing fraud, infrastructure abuse, or cybersecurity incidents.
  • Service Improvement and Analytics: Generating aggregated, anonymized usage statistics across feature profiles to optimize machine learning algorithms and properly dimension cloud infrastructure.
  • Operational Communications and Notifications: Delivering monthly document quota alerts, service term expiration notices, operational support communications, and updates regarding legal terms or privacy policies.

4. DATA ARCHITECTURE, AI PROCESSING, AND THIRD PARTIES

  1. Local Device Storage and Google Drive®:
    • The local database containing extracted information from the User's documents resides exclusively on the internal storage of the User's mobile device.
    • Digital documents, images, exported reports, and backup files are stored privately under the sole ownership and control of the User within their personal Google Drive® account.
    • The Company DOES NOT host, store, or mirror copies of the User's local databases on internet servers.
  2. Artificial Intelligence Processing (Google Gemini®):
    • Optical Character Recognition (OCR) and semantic data extraction are processed ephemerally through Google Gemini® models and Google Cloud Platform APIs.
    • AI Privacy Commitment: Personal documents, receipts, and extracted financial data are NEVER sold to third parties and are NOT used to train general public Artificial Intelligence models.

5. PRIVACY RIGHTS AND CHOICES

5.1 RESIDENTS OF COLOMBIA (STATUTORY LAW 1581 OF 2012)

Users residing in the Republic of Colombia hold statutory Habeas Data rights:

  • To access, update, and rectify their personal data held by the Company. Note that name, email, and profile picture cannot be rectified directly through the Company, as they are managed directly by the User via their @gmail.com account.
  • To request proof of consent granted for data processing.
  • To be informed regarding the use and purposes of their personal data.
  • To file claims and grievances before the Superintendence of Industry and Commerce (SIC).
  • To revoke consent or request data deletion whenever legally applicable.
  • To access their processed personal data free of charge.

Contact Channel and Timelines: Submit requests to data@moneytracky.com. Informational inquiries are addressed within ten (10) business days; formal complaints and deletion requests within fifteen (15) business days.

5.2 RESIDENTS OF THE UNITED STATES (CCPA / CPRA AND OTHER STATE LAWS)

Users residing in the United States hold the following statutory privacy rights:

  1. Right to Know / Access: Request disclosure of categories and specific pieces of personal information collected, sources, processing purposes, and third parties involved.
  2. Right to Delete: Request deletion of personal information, subject to statutory retention exceptions (e.g., tax, audit, and regulatory requirements).
  3. Right to Correct: Request correction of inaccurate personal data. Note that name, email, and profile picture are managed directly by the User through their @gmail.com account and cannot be modified directly by the Company.
  4. Do Not Sell or Share Personal Information: APPS PLUS AI S.A.S. DOES NOT SELL YOUR PERSONAL INFORMATION NOR SHARE IT WITH THIRD PARTIES FOR CROSS-CONTEXT BEHAVIORAL OR TARGETED ADVERTISING.
  5. Right to Non-Discrimination: The Company will not deny services, charge differentiated prices, or alter service quality for exercising privacy rights.

U.S. Inquiries Procedure: Send a formal verifiable request to data@moneytracky.com. The Company will verify identity and ownership and provide a formal response within fifteen (15) calendar days.

6. CHILDREN'S PRIVACY (COPPA COMPLIANCE)

  • In accordance with our Terms of Use, the U.S. Children’s Online Privacy Protection Act (COPPA), and applicable Colombian law, the Service is restricted exclusively to individuals eighteen (18) years of age or older.
  • The Company does not knowingly collect personal information from minors. If the registration of a minor is identified, the associated account and operational data will be deleted immediately.

7. DATA RETENTION AND DISPOSAL

  1. Active Accounts: Operational metadata and account credentials remain stored while the User maintains an active account and valid service standing.
  2. Account Cancellation or Deletion: When a User cancels the Service or requests account deletion, document processing halts immediately. Retained operational and service metadata will be deleted or irreversibly anonymized within ninety (90) calendar days.
  3. Google Drive® Files: All files and backups located in Google Drive® remain under the exclusive ownership and control of the User; cancelling a MoneyTracky account does not delete, alter, or remove files stored in the User's private Google Drive®.
  4. Tax and Legal Compliance Retention: Billing, transactional, and accounting logs are retained according to statutory retention periods required by tax and commercial regulations (up to 5 years in Colombia and up to 7 years in the United States).

8. INFORMATION SECURITY

The Company implements technical, administrative, and physical security safeguards to maintain data confidentiality and integrity:

  • End-to-end encrypted transmission using TLS 1.2 protocols and data encryption at rest using the AES-256 standard, powered by Google Cloud.
  • Cloud infrastructure access (Firebase / Google Cloud) is strictly restricted to authorized technical personnel under the principle of least privilege, requiring two-factor authentication (2FA). MoneyTracky staff cannot access your physical device or your private Google Drive® account.
  • Continuous dependency monitoring and periodic vulnerability assessments across all integrated software components and third-party libraries.

9. CHANGES TO THIS PRIVACY POLICY

The Company reserves the right to modify or update this Privacy Policy periodically. Any material changes will be communicated via the mobile Application or directly to the User's registered email address with at least fifteen (15) calendar days' prior notice before taking effect, in accordance with the Terms and Conditions of Use. Continued use of the Service following the effective date constitutes full acceptance of the updated Privacy Policy.