Privacy Policy

1. Who Is Responsible for Your Data

Monetol is operated by Lucsoft SL, NIF B10948149, Urbanización Paraíso de la Bahía, Bloque 1, H, 29690 Casares Costa, Málaga, España. Email: office@lucsoft.es. Website: lucsoft.es. Lucsoft is the data controller for the personal data described in this policy, except where stated otherwise in Section 9. You can contact us about anything in this policy at office@lucsoft.es.

2. Information We Collect

• Account information: name, email address, phone number and role (landlord or tenant), collected when you sign up (including via Google sign-in).
• Property and tenancy data: property addresses and details, tenant records, contract terms, rent, bills, expenses and payment records that landlords enter into the Service.
• Personal Finance data: the personal and company finances you set up, accounts (name, type, last four digits if you add them, opening balance), income and spending entries, categories, budgets, rows from bank statements you choose to import, and the people you invite to view or edit them.
• Tax and legal data: fiscal identifiers, addresses and other details you enter for contracts, co-owners or tax declarations.
• Uploaded files: documents, contracts and bills (images, PDFs, Word or spreadsheet files), which may contain personal or financial information.
• Messages: text and attachments sent between landlords and tenants through in-app messaging. Message content is encrypted at rest.
• Billing information: your subscription plan and payment status. Card details are handled by Stripe and never stored by us.
• Technical and usage data: login timestamps, IP address and device/browser information in server logs, a session cookie, and privacy-friendly aggregate performance and usage statistics.

3. Why We Use It and Our Legal Bases

• To provide the Service (performance of our contract with you): running your account, showing your properties, tenancies and finances, generating contracts and summaries, sending service emails such as invitations, and reading documents you upload when you use smart upload.
• To keep the Service safe and lawful (our legitimate interests): preventing, detecting and investigating fraud, money laundering, abuse, security incidents and breaches of our Terms; enforcing our Terms; and establishing, exercising or defending legal claims.
• To comply with the law (legal obligation): keeping accounting and tax records for our own sales, and responding to lawful requests from courts and authorities.
• To improve the Service (our legitimate interests): understanding, in aggregate, how features are used and how the Service performs.

4. Automated Processing of Uploaded Documents

When you upload a bill or document for smart upload, the file (or text extracted from it) is sent to Google's Gemini AI to identify details such as the vendor, amount, currency and due date. If configured, a fallback ChatGPT-compatible service (accessed via RapidAPI) may be used instead for documents whose text has already been extracted. These providers process the content only to return the extracted data; it is not used to train Monetol's own systems, and we send no more of the document than needed. Results are shown to you for review before they are used. No decision with legal or similarly significant effects is made about you solely by automated means.

5. Messaging and Content Review

Message content is encrypted at rest. When an administrator initiates a safety review — for example in response to a concern raised about a specific time period — message content from that period may be processed by Google's Gemini AI to help identify content that may breach our Terms of Service. This is not continuous scanning of every message. Anything identified is shown to a Lucsoft administrator, who decides whether any action is warranted.

6. How We Share Information

We do not sell your personal data. We share it only as follows:

• Service providers acting on our behalf under data protection terms:
  • Vercel — hosting of the website and privacy-friendly analytics and performance measurement;
  • Firebase (Google) — authentication and identity management;
  • TiDB Cloud — hosting of the application database;
  • Google Gemini, and optionally a RapidAPI-hosted ChatGPT-compatible service — document reading and, only when an administrator initiates one, the message review described in Section 5;
  • Brevo — delivery of transactional emails such as invitations;
  • Stripe — payment processing for subscriptions;
  • SimplePDF — the in-browser PDF editor, for documents you choose to edit.
• Other users, as you choose: tenants see what their landlord shares with them, and people you invite to your Personal Finance data can see (and, if you allow it, edit) it.
• Authorities and legal requirements: we may preserve and disclose personal data to the police, financial intelligence units, tax authorities, courts, regulators or other competent authorities where we believe in good faith that it is required by law or a valid legal request, or necessary to prevent or investigate fraud, money laundering, terrorist financing or other crime, to protect the safety or rights of any person, or to protect Lucsoft and the Service. Where the law forbids it, we will not tell you about such a disclosure.
• Business transfers:if Lucsoft's business or the Service is reorganised, merged or sold, personal data may be transferred to the successor under this policy.

7. International Transfers

Some providers above may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses, together with any additional safeguards required.

8. Data Retention

We keep your data while your account is active. After you close your account we delete or anonymise it within a reasonable period, except where we must or may keep it longer: to meet legal, tax or accounting obligations; to resolve disputes or defend legal claims (generally for the applicable limitation period); and, where we suspect fraud, money laundering or other unlawful activity, for as long as needed to investigate it and to cooperate with the competent authorities.

9. Data You Enter About Other People

When landlords enter tenants' or co-owners' details, or users enter information about family members or other people (for example in Personal Finance), they decide what to enter and why, and act as the controller of that data; Lucsoft processes it on their behalf to provide the Service. Users must have a lawful basis for that data and give the people concerned any required information. Requests from those people may be sent to the relevant user or to us, and we will help where we can. Lucsoft is not responsible for data that users enter unlawfully.

10. Your Rights

Under the GDPR and similar laws you may request access to, correction, deletion or a copy of your personal data, object to or restrict certain processing, and withdraw any consent you gave. To exercise these rights, email office@lucsoft.es; we may need to verify your identity. Some rights are limited by law — for example, we cannot delete data we must keep for legal reasons or data related to an ongoing investigation. You also have the right to complain to a data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es) — or the authority where you live.

11. Cookies

Monetol uses a single essential session cookie to keep you signed in and to decide whether to show you protected pages. Our analytics and performance measurement do not use cookies for tracking, and we do not use advertising or cross-site tracking cookies.

12. Data Security

We use industry-standard measures — including encrypted connections, access controls and encryption at rest for message content — to protect your data. No system is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us at office@lucsoft.es if you suspect unauthorised access to your account.

13. Children

The Service is intended for adults aged 18 or over and is not directed at children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email before they take effect.

15. Contact

Lucsoft SL, NIF B10948149, Urbanización Paraíso de la Bahía, Bloque 1, H, 29690 Casares Costa, Málaga, España. Email: office@lucsoft.es. Website: lucsoft.es.