Myney ("we", "us", "our") is operated by Plutus FIRE Limited, a company registered in Ireland (CRO 807084), with its registered office at Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland. We take your privacy seriously. This policy explains what data we collect, why we collect it, how we use it, and what rights you have.

1. Who We Are

Plutus FIRE Limited is the data controller for all personal data processed through the Myney application and website (collectively, the "Service"). For any privacy-related questions, you can reach our Data Protection Officer at:

Email: dpo@getmyney.com

2. What Data We Collect

2.1 Account Information

When you create an account or join our waitlist, we collect:

Your name
Your email address
Your country of residence

2.2 Financial Data via Open Banking (PSD2)

When you connect your bank accounts, we access your financial data through regulated third-party providers:

Greece: Enable Banking
Poland: Enable Banking
Pan-European institutions (e.g. Revolut, N26, Bunq): Enable Banking

This access is read-only. We can view your account balances, transaction history, and account details. We cannot initiate payments, move funds, or modify your accounts in any way. We never see or store your bank login credentials — authentication happens directly between you and your bank.

2.3 Additional Information You Provide

To help you find better deals, you may voluntarily share additional information such as:

Current utility bills (electricity, gas, internet, mobile)
Insurance policy details
Subscription information
Other financial documents or contract details

You are never required to provide this information. You can use Myney without sharing any of it.

2.4 Device and Usage Data

We collect limited technical data to improve the Service:

Device type and operating system
App version
Anonymised usage patterns (e.g. which features you use)
IP address (anonymised)

We use privacy-focused analytics that do not track you across other websites or apps.

3. Why We Collect Your Data

We process your personal data for the following purposes:

Purpose	Legal Basis (GDPR)
Providing the Service (account, dashboard, alerts)	Performance of contract (Art. 6(1)(b))
Accessing bank data via PSD2	Your explicit consent (Art. 6(1)(a))
Finding better deals and comparing providers	Legitimate interest (Art. 6(1)(f))
Processing additional documents you share	Your consent (Art. 6(1)(a))
Sending service-related communications	Performance of contract (Art. 6(1)(b))
Improving the Service via analytics	Legitimate interest (Art. 6(1)(f))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

4. How We Use Your Financial Data

Your financial data is used to:

Show you a consolidated view of your accounts and transactions
Categorise your spending automatically
Alert you to unusual activity, upcoming bills, or low balances
Compare your current providers (energy, telecoms, insurance, banking) against market alternatives
Identify forgotten or unused subscriptions

We do not sell your financial data. Ever.

We do not share your transaction data with advertisers, data brokers, or any third party for marketing purposes.

6. Data Storage and Security

All data is stored on servers located in the European Union (Hetzner, Germany/Finland)
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
Access to personal data is restricted to authorised personnel on a need-to-know basis
We conduct regular security reviews and follow industry best practices

7. Data Retention

Data type	Retention period
Account information	Until you delete your account
Financial data (transactions, balances)	Up to 24 months, or until you disconnect your bank
Documents you upload (bills, contracts)	Until you delete them, or until you delete your account
Waitlist information	Until launch, then converted to an account or deleted upon request
Analytics data	Anonymised; retained in aggregate form

When you delete your account, we delete or anonymise all your personal data within 30 days, unless we are legally required to retain it.

8. Your Rights

Under the GDPR, you have the following rights:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — ask us to delete your data ("right to be forgotten")
Restriction — ask us to limit how we process your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Withdraw consent — revoke consent at any time (e.g. disconnect your bank)

To exercise any of these rights, email us at dpo@getmyney.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority:

Ireland: Data Protection Commission (DPC) — dataprotection.ie
Greece: Hellenic Data Protection Authority (HDPA) — dpa.gr
Poland: Urząd Ochrony Danych Osobowych (UODO) — uodo.gov.pl

9. Cookies

The Myney website uses only essential cookies required for the Service to function (e.g. session management, language preference). We do not use advertising or tracking cookies.

Our analytics solution is privacy-focused and does not rely on cookies to track users.

10. Children

Myney is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us at dpo@getmyney.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and notify you via email or in-app notification for material changes.

12. Language

This Policy is drafted in English. Translations into other languages are provided for convenience only. In the event of any inconsistency or conflict between the English version and any translated version, the English version shall prevail.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data:

Plutus FIRE Limited
Venture Hub, 136 Capel Street
Dublin, D01 T2C9, Ireland