1. Data Controller
Matlot is published by Gregory Van Hees. In the current phase, the application is intended for personal and family use — each household administrator is solely responsible for the data they record.
For any privacy question, data inquiry, or exercise of your GDPR rights: privacy@matlot.app.
2. Data Collected
We only collect data necessary for the application to function:
- Email address — for account creation and authentication
- Financial data — incomes, expenses, savings that you enter yourself
- Household member names — for expense distribution
- Login data — account creation date, last login
We do not collect real banking data, card numbers, or any information that would allow access to your accounts.
3. Purpose of Processing
Your data is used exclusively to:
- Allow you to track and manage your household budget
- Calculate expense distributions between household members
- Display the history and changes in your budget
- Operate the service — the publisher can view household names, member counts and license status for subscription management, support and billing; never your financial data.
Your data is never used for advertising, commercial profiling, or shared with third parties.
4. Hosting and Processors
The application uses the following services, all GDPR compliant:
- Supabase — data storage and authentication (eu-west-1 region, Dublin, Ireland)
- Vercel — web application hosting
- Sentry — automatic technical error detection (EU region, Frankfurt, Germany); processes only stack traces and technical metadata, never your financial data.
- PostHog — anonymised audience measurement and usage statistics (EU region, Frankfurt, Germany); works without cookies, page paths anonymised, never your financial data.
Each of these processors has signed a data processing agreement (DPA) compliant with GDPR.
5. Retention Period
Your data is retained as long as your account is active. Upon account deletion, all your data (profile, household, financial history) is permanently deleted from our servers within 30 days.
6. Your Rights
Under GDPR, you have the following rights:
- Right of access — you can view all your data directly in the application
- Right to rectification — you can modify your data at any time
- Right to erasure — you can delete your account from the application's Settings
- Right to portability — your financial data is visible and accessible in the application
- Right to object — you can stop using the application and delete your account at any time
7. Security
Your data is protected by:
- End-to-end encryption of communications (HTTPS)
- Row Level Security access control — each user can only access their own household's data
- Secure authentication via email and password
8. Cookies
The application only uses strictly necessary technical cookies for authentication (session token). No advertising or tracking cookies are used. Audience measurement (PostHog) works without cookies or local storage.