Last updated 17 September 2026 · v2026-09-17-draft.1
docs/client/privacy-policy-gap-2026-09-17.md.Moniwyse is a household money workspace. It reads your mailbox to find bank alerts and account statements, extracts the transactions in them, and shows you your own money in one place. This policy explains what that means for your data.
To do
Name the Data Controller, its registered address, and the accountable Data Protection Officer.
The template names The Libri Limited. Confirm whether Moniwyse operates under that entity or a separate one before this page names anybody — it decides who carries the liability.
NDPA expects a real accountable contact, not a shared support inbox. I need a name, a role, and an address that will be monitored.
We collect and store:
When you connect Gmail, you grant Moniwyse the gmail.readonly scope. With it we:
We do not send, reply to, delete or modify anything in your mailbox, and we do not read messages outside that search. You can revoke this access at any time from your Google Account, or disconnect from Moniwyse Settings.
Moniwyse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
To do
This section gates the OAuth verification submission — it needs sign-off, and one decision from you.
The Limited Use affirmation above is the standard wording and matches what the product does today. But Limited Use forbids transferring Google user data to third parties except as necessary to provide or improve the feature, and we do send transaction narrations derived from mail to external AI providers (section 5). I need you or counsel to confirm that framing before this URL goes into the submission.
To do
Map each processing purpose to an NDPA lawful basis.
The purposes are known: providing the account, importing and categorising transactions, producing budgets and net-worth views, security and fraud prevention, and service communications. What I cannot decide is which basis applies to each — consent, contract, or legitimate interest — and NDPA treats that choice as load-bearing.
Lawful-basis documentation is out of scope for this change and is tracked as separate work; this section is the hook it lands in.
We do not sell your data. We share it with the service providers we need to run the product:
To do
Confirm the processor list and name the SMS provider.
The SMS provider has not been chosen yet (see docs/client/sms-provider-comparison-2026-09-17.md). I also need confirmation that this list is complete — if anything else touches household data, it belongs here.
Our hosting and every AI provider we use are based outside Nigeria, primarily in the United States. Using Moniwyse means your financial data is transferred and processed abroad.
To do
State the NDPA transfer mechanism relied on for each destination.
NDPA restricts cross-border transfers unless an adequacy decision, standard contractual clauses, or another recognised safeguard applies. I need to know which one we are relying on, per provider, before this can be stated.
When the household owner deletes the household from Settings, we delete the accounts of everyone in it along with the transactions, balances, statement passwords and mailbox access tokens. That deletion is immediate and is not recoverable by us.
To do
Provide a retention schedule for data while the account is open.
Deletion on request works. What is undefined is how long we hold things in the ordinary course: transactions and balances, statement PDFs and the passwords that open them, mail OAuth tokens, and consent records. NDPA expects defined periods, not “until you ask us”.
Statement passwords and mail access tokens are encrypted at rest. Access to a household is limited to its members and to the operators running this POC. Transport to and from the application is encrypted.
To do
Describe the operator access controls and the breach-notification commitment.
A household can contain people who never signed up themselves — a partner, a parent, a child whose school fees appear as a category. If you invite someone, or record spending on their behalf, you are putting their financial information into Moniwyse.
To do
Decide how we handle data about household members who are not account holders, including children.
The template's under-18 section is about children as users. Ours is about a person whose data is processed by somebody else. I need a position on what the account holder is responsible for, what we tell invited members, and whether anything changes for minors.
You can export your household data from Settings as JSON or CSV, clear imported records, disconnect your mailbox, and delete the household.
Deleting the household removes every member's account and all of its financial data at once. Only the household owner can do this, and it asks you to type the household name first.
To do
List the full NDPA rights and the process for exercising each one — and decide how a household member erases only their own data.
Access, rectification, erasure, restriction, portability, objection, and the right to complain to the NDPC each need a route and a response time. Export and deletion cover part of this already.
The gap is the individual: someone invited into a household has no way to erase just their own record — today it is all of it, by the owner, or none of it. Settings shows a “Remove member” control, but it does not yet change anything stored. That needs a decision, because their data is in there too.
This policy is versioned. When you agreed to it, we recorded which version you saw. If we make a material change to how we process your financial data, we will notify you and ask you to agree again rather than relying on this page having quietly changed.
To do
Confirm the notice period for material changes.
To do
Provide the contact address for privacy questions and for the NDPC complaint route.