Privacy Policy

1. Data Controller

The controller of personal data collected through the AtivaMoney platform is:

To exercise your rights or clarify any question relating to the processing of your personal data, you may contact us at the address indicated above.

2. Personal Data Collected

AtivaMoney collects and processes the following categories of personal data:

2.1 Registration Data

When creating an account, we collect: full name, email address and, optionally, mobile phone number (for multi-factor authentication). This data is necessary for the provision of the service.

2.2 Banking Data via Open Banking

With the express consent of the User and through a PSD2 connection via GoCardless, we collect: transaction information (amount, date, description, merchant), account balances and metadata associated with the authorised bank accounts. This data is used exclusively for the provision of PFM features.

2.3 Usage Data

We automatically collect data about the use of the platform, including: access logs, interface preferences, features used and interactions with the platform. This data is used to improve the service and ensure security.

2.4 Categorisation Data

When the User categorises, tags or corrects automatic categorisation suggestions for their transactions, those preference and correction data are processed to personalise and improve the AI categorisation model.

2.5 Waiting-List Sign-up

When you join the waiting list on the website, we store: your email address, the plan you are interested in, the language, the website page where you signed up and a cryptographic summary (hash) of your IP address, used only to limit abusive sign-ups. When present, we also store the source of the visit: the campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the Google (gclid) and Meta (fbclid) ad click identifiers that were in the address through which you reached the website (the click identifiers only if you have accepted all cookies). We use the source to know which campaigns bring sign-ups and to measure their results. To confirm the sign-up is not made by a robot, the form uses Cloudflare Turnstile.

2.6 Payment Data

Subscription payments are handled by Stripe (see Section 5). Card or other payment method details are entered directly on Stripe's payment page and never pass through AtivaMoney's servers. From Stripe we store only what is needed to manage your subscription: the identifiers of your customer and your subscription, the plan and billing period, the status (trial, active, overdue, cancelled), the dates of the end of the trial and of the current period, whether cancellation is scheduled, and the price and campaign applied. We do not store the card number, the name or the billing address you give to Stripe. When you open "Payment methods", we read the brand, the last four digits and the expiry date of the card from Stripe to show them to you and warn you of expiry; they are kept only in temporary memory, for about 10 minutes, and are not saved in the database.

2.7 Website Browsing Data

If you accept all cookies, Google Analytics, Google Ads and the Meta pixel collect data about your visit to the ativamoney.com website (pages viewed, source of the visit, device and browser, identifiers stored in cookies and, when you join the waiting list, a sign-up event with the chosen plan, without your email). Details are in the Cookie Policy. The website also uses Cloudflare Web Analytics, which measures page performance without cookies.

2.8 Trial and Guaranteed Price Data

To apply the trial and guaranteed price rules described in the Terms of Use, we keep: the trial you used (the Free plan trial, without a card, and/or a paid plan trial, with a card), its start and end dates, the price and campaign in force on the day you signed up and when you joined a paid plan, the guaranteed price, the date until which it is guaranteed and any revision of that price in your favour, and a record of the notices we sent you about these matters. We do not store card details.

3. Purposes and Legal Bases

The processing of your personal data is carried out on the basis of the following purposes and respective legal bases, under the General Data Protection Regulation (GDPR — Reg. EU 2016/679):

4. Banking Data — Special Handling

Banking data obtained via Open Banking is handled with particular care and subject to the following safeguards:

• Exclusive use for PFM: Banking data is processed exclusively for the personal finance management purposes described in this Policy, never for different purposes;
• Not sold: The User's banking data is not, under any circumstances, sold, transferred or shared with third parties for commercial or advertising purposes;
• Not disclosed for commercial purposes: We do not use banking data to build commercial profiles, sell advertising or share information with competing financial institutions;
• Access via GoCardless (PSD2): Access is carried out through an entity regulated by the FCA, under PSD2, with explicit authorisation from the User, and is revocable at any time as described in the Terms of Use.

5. Data Sharing

AtivaMoney shares personal data only with the processors and recipients strictly necessary for the provision of the service, as set out below (processors are bound by data processing agreements that comply with the GDPR):

• GoCardless Ltd — Open Banking provider (PSD2). Headquartered in the United Kingdom, with operations in the European Economic Area. Authorised and regulated by the FCA.
• Oracle Cloud Infrastructure (Oracle EU Sovereign Cloud) — Hosting and data processing infrastructure. Data resides exclusively in 100 % European regions: Madrid, Spain (EU Sovereign South) and Frankfurt, Germany (EU Sovereign Central), operated by legal entities based in the European Union and separate from Oracle's global commercial regions.
• MailerSend (MailerLite group) — Transactional email service (account confirmations, alerts and notifications). Headquartered in the European Union.
• Twilio Inc. — SMS messaging service (phone number verification and alerts). Headquartered in the United States of America; transfers take place under the safeguard mechanisms described in Section 6.
• Stripe — Subscription payments, through the Stripe Managed Payments service. Under this service, Sold through Link, LLC (Stripe group, presented as Link) acts as merchant of record on behalf of AtivaMoney. Stripe and AtivaMoney are independent controllers: Stripe processes payment, billing, fraud-prevention and transaction-support data under its Privacy Policy, with Stripe Payments Europe, Limited (Ireland) as the contracting entity for European consumers; AtivaMoney processes the data it receives from Stripe to manage the subscription (email, plan, and the status of the trial, the subscription and the charges).
• Cloudflare — Content delivery network and proxy for the website and the application, attack protection (WAF) and a secure tunnel to our servers (all traffic goes through Cloudflare); anti-robot verification (Turnstile) on the website and application forms and at sign-in; and cookieless page performance measurement (Web Analytics), on the website and in the application.

Only if you accept all cookies on the website do the following providers receive data about your visit (see Section 2.7 and the Cookie Policy): Google Ireland Limited (Google Analytics, Google Ads and Google AdSense) and Meta Platforms Ireland Limited (Meta pixel, Facebook and Instagram). Regarding Google Analytics, Google processes the data on behalf of AtivaMoney, as a processor. Regarding Google Ads and Google AdSense, Google acts as an independent controller for the use it makes of that data in its own services, under its data protection terms and privacy policy. Regarding the Meta pixel, AtivaMoney and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR) for the collection, through the pixel, of data from your browser and its transmission to Meta, under Meta's Controller Addendum; you can exercise your rights with either of us, through the contacts in Section 1. The processing Meta carries out after receiving the data is Meta's sole responsibility, under its privacy policy. Requests we receive about the data processed by Meta are forwarded to Meta within seven days.

Apart from the measurement described above, which always depends on your consent, we do not share your personal data for third-party marketing purposes, behavioural advertising or any purpose not described in this Policy. The application's financial data is never shared with advertising or measurement providers.

5.1 Wallet ownership transfer

AtivaMoney lets a wallet owner transfer its ownership to another user. On completing a transfer, the current owner shares all of that wallet's financial data with the recipient — accounts, transactions, categories, tags and history — and the recipient becomes the new owner and controller of that data.

• Informed consent: the transfer is only completed after the current owner expressly confirms that they understand the data sharing and its risks. These consents are recorded (type, version and timestamp) under the GDPR.
• Step-up authentication: the operation requires additional identity verification (codes sent by SMS and email) before it is executed.
• Responsibility after the transfer: once the transfer is complete, AtivaMoney does not control and is not responsible for how the new owner uses the shared data. We recommend transferring wallets only to people you trust.
• Subscription: if, after the transfer, you keep an active subscription with no wallet attached, you will be informed and may cancel it at any time in Settings.

6. International Transfers

Whenever it is necessary to transfer personal data to countries outside the European Economic Area (EEA), in particular in the context of the provision of services by the sub-processors identified in Section 5, such transfer is carried out on the basis of adequate safeguard mechanisms, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, under Art. 46 GDPR;
• Adequacy decisions of the European Commission, where applicable, including the EU-U.S. Data Privacy Framework for providers certified under it, such as Google LLC, Meta Platforms, Inc., Stripe, LLC and Cloudflare, Inc. (list at www.dataprivacyframework.gov/list).

The User may request information on the specific safeguards applicable through the DPO contact indicated in Section 1.

7. Data Retention

Personal data is kept only for the time strictly necessary for the purposes for which it was collected:

• During the contract: all data necessary for the provision of the service is kept while the account is active;
• Following cancellation: data is deleted within a maximum period of 30 days after account cancellation;
• Waiting list: the sign-up and the source of the visit are kept until the launch of the plan you signed up for and the related notice, or until you ask for removal, and deleted, in any case, 12 months after sign-up;
• Payments: payment and billing records are kept by Stripe under its own policy and the legal obligations that apply to it; those kept by AtivaMoney follow the legal obligations rule below;
• Trials and guaranteed price: while the account exists. When the account is deleted, these records are anonymised and no longer linked to you. We do not keep your email or your Stripe identifier to apply the "once per payer" rule to new accounts;
• Cookies and browser data: for the durations given in the Cookie Policy;
• Legal obligations: tax or accounting data may be retained for the period required by law (generally 10 years under Portuguese tax legislation), after which it is deleted;
• Anonymised data: anonymised statistical data, with no possibility of identification, may be kept for an indefinite period for analysis and service improvement.

8. Data Subject Rights (GDPR)

Under the GDPR, the User has the following rights in respect of their personal data:

• Access — Right to obtain confirmation as to whether your data is being processed and to access it;
• Rectification — Right to correct incomplete or inaccurate data;
• Erasure — Right to request deletion of your data ("right to be forgotten"), in the cases set out in the GDPR;
• Portability — Right to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller;
• Restriction — Right to request the restriction of processing of your data in certain circumstances;
• Objection — Right to object to processing based on legitimate interests or for direct marketing purposes;
• Not subject to automated decision-making — Right not to be subject to decisions based solely on automated processing that produce legal or significant effects.

In the application, the "Export my data" function, in Settings, gives you at any time a copy of your personal data, your accounts and your transactions in a file you can keep.

To exercise any of these rights, contact our Data Protection Officer:
Email: [email protected]

The User also has the right to lodge a complaint with the competent supervisory authority: the Portuguese Data Protection Authority — Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

9. Security

AtivaMoney implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction, including:

• TLS 1.3 — All communication between the User and the platform is encrypted with TLS 1.3;
• Encryption at rest — Stored data is encrypted at rest;
• Multi-Factor Authentication (MFA) — MFA support for all user accounts;
• Access auditing — Audit logs of all accesses to sensitive data;
• 24/7 monitoring — Continuous monitoring of the infrastructure to detect anomalies and incidents;
• OWASP Top 10 — Development and security testing guided by the OWASP Top 10 recommendations.

10. Cookies

AtivaMoney uses cookies and similar technologies to ensure the operation of the platform, store User preferences and, with consent, analyse use of the website, measure the results of our advertising campaigns (Google Ads and the Meta pixel) and show ads on the blog (Google AdSense).

For detailed information on the types of cookies used, their purposes and how to manage your preferences, please consult our Cookie Policy.