Privacy Policy

Draft of July 20, 2026 — pending legal review.

1. Data controller

The controller of the personal data collected through MyFinances360 (the "Service", available at myfinances360.com and app.myfinances360.com) is [TODO: legal name of the controller], with registered address at [TODO: address], Dominican Republic. You can contact us at [TODO: contact email].

2. Data we collect

We collect only the data needed to provide the Service:

• Account data: name, email address and password (stored in encrypted, irreversible form).
• Financial data you record: expenses, categories, tags, money accounts (cash, savings, checking, cards), movements, budgets, savings goals, debts, payment reminders and subscriptions.
• Receipt images that you photograph or upload for digitization.
• Bank-statement emails: the messages and attachments (PDF) from the mailbox you yourself configure for automatic import.
• Import-mailbox credentials: the connection details (server, username, password) of the mailbox you configure are stored encrypted on the server and used exclusively to read the statements you send or forward to that mailbox.
• Tax data present on your receipts, such as RNC, NCF and ITBIS, for the purchases report (606 form).
• Minimal technical data: access logs (date, IP address, endpoint) needed for the security and operation of the Service.

3. AI processing

To extract the data from your receipts and bank statements (merchant, amount, date, ITBIS, NCF, RNC), the images and documents are sent from our server to the Claude API, operated by Anthropic PBC (USA), which acts as a data processor. Under Anthropic's commercial terms, data sent through its API is not used to train its models. The API key remains on our server; your device never holds it. Manual expense entry is always available as an alternative if you prefer not to use automatic extraction.

4. Purposes and legal basis

• Providing the Service (recording, classifying and reporting your expenses): performance of the contract.
• Automatic email import and AI extraction: performance of the contract, activated by your own configuration.
• Security, fraud prevention and prevention of referral-program abuse: legitimate interest.
• Communications about your account or membership (trial notices, renewal, Service changes): performance of the contract. We do not send third-party advertising.

5. Who we share your data with

We do not sell or rent your personal data. We share it only with providers we need to operate the Service, under contracts that limit its use:

• Our hosting provider (servers and database).
• Anthropic PBC (document data extraction, section 3).
• [TODO: payment processor, once selected] for membership billing.

We may also disclose data where a law or an order from a competent authority requires it.

6. International transfers

Our providers may process data outside the Dominican Republic (for example, Anthropic in the USA). In those cases we require appropriate contractual safeguards to protect your data.

7. Retention

We keep your data for as long as your account exists. If you delete your account, we erase your personal data within a reasonable period, except data we must keep under a legal obligation (for example, billing records). Backups are rotated and deleted periodically.

8. Your rights

Under Dominican Republic Law No. 172-13 on the protection of personal data and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data and obtain a copy of it.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") by deleting your account.
• Object to processing or request its restriction.
• Portability: receive your data in a structured, commonly used format (the app includes CSV/Excel exports).
• Lodge a complaint with the competent supervisory authority.

To exercise these rights, write to us at [TODO: contact email].

9. Security

All communication between the app and our servers is encrypted (HTTPS/TLS). Passwords are stored using strong hashing algorithms; import-mailbox credentials and statement-PDF passwords are stored encrypted. Access to our systems is restricted and logged.

10. Cookies and analytics

This website uses no cookies, tracking pixels or analytics tools. The application uses only the local storage strictly needed to keep you signed in (access token); it contains no advertising and no third-party trackers.

11. Minors

The Service is not directed at persons under 18. We do not knowingly collect data from minors; if we detect a minor's account, we will delete it.

12. Changes to this policy

We may update this policy to reflect changes to the Service or to the law. We will publish the current version on this page and, if the change is material, notify you in the app or by email before it takes effect.

13. Contact

For any question about this policy or your data: [TODO: contact email].