1. Data Controller
matlot is published by Gregory Van Hees. In the current phase, the application is intended for personal and family use — each household administrator is solely responsible for the data they record.
For any privacy question, data inquiry, or exercise of your GDPR rights: privacy@matlot.app.
2. Data Collected
We only collect data necessary for the application to function:
- Email address — for account creation and authentication
- Financial data — incomes, expenses, savings that you enter yourself
- Household member names — for expense distribution
- Login data — account creation date, last login
- Loyalty card numbers — only if you save some in Provisions, so they can be shown again in store. They identify you to that retailer and give access to nothing else. You can delete them at any time.
We do not collect real banking data, payment card numbers, or any information that would allow access to your accounts. A loyalty card is not a means of payment.
3. Purpose of Processing
Your data is used exclusively to:
- Allow you to track and manage your household budget
- Calculate expense distributions between household members
- Display the history and changes in your budget
- Operate the service — the publisher can view household names, member counts and license status for subscription management, support and billing; never your financial data.
Your data is never used for advertising, commercial profiling, or shared with third parties.
4. Hosting and Processors
The application uses the following services, all GDPR compliant:
- Supabase — data storage and authentication (eu-west-1 region, Dublin, Ireland)
- Vercel — web application hosting
- Brevo — account email delivery (confirmation, password reset); French company, data hosted in the European Union; processes only your email address, never your financial data.
- Sentry — automatic technical error detection (EU region, Frankfurt, Germany); processes only stack traces and technical metadata, never your financial data.
- PostHog — anonymised audience measurement and usage statistics (EU region, Frankfurt, Germany); works without cookies, page paths anonymised, never your financial data. This public site is measured too: visits and button clicks are counted without creating any visitor profile, and without keeping anything from one page to the next.
- Anthropic — question assistant; receives your question and the labels of your items (the names you gave your recurring charges and your transactions, and your categories), never the amounts in your data. Your questions are kept and read by the matlot team to decide which features come next. The assistant stays off until you turn it on.
Each of these processors has signed a data processing agreement (DPA) compliant with GDPR.
5. Retention Period
Your data is retained as long as your account is active. Upon account deletion, all your data (profile, household, financial history) is permanently deleted from our servers within 30 days.
6. Your Rights
Under GDPR, you have the following rights:
- Right of access — you can view all your data directly in the application
- Right to rectification — you can modify your data at any time
- Right to erasure — you can delete your account from the application's Settings
- Right to portability — your financial data is visible and accessible in the application
- Right to object — you can stop using the application and delete your account at any time
7. Security
Your data is protected by:
- End-to-end encryption of communications (HTTPS)
- Row Level Security access control — each user can only access their own household's data
- Secure authentication via email and password
8. Cookies
The application only uses strictly necessary technical cookies for authentication (session token). No advertising or tracking cookies are used. Audience measurement (PostHog), on the app as well as on this site, works without cookies or local storage: nothing is written to your device, and no identifier follows you from one page to the next.