Privacy and Cookie Policy
Last updated: 20 October 2026
This Privacy and Cookie Policy (the "Policy") describes how the personal data of users of the Mayora Budget application (the "Application"), available for iPhone and at app.trymayora.com, and of visitors to the trymayora.com website (the "Website") is processed, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, the "GDPR"), Portuguese Law No. 58/2019 of 8 August and Portuguese Law No. 41/2004 of 18 August, as amended. This English version is provided for convenience; in the event of any discrepancy, the Portuguese version prevails.
1. Data controller
The controller of personal data is Filipe Martins, a natural person who develops and provides the Application and the Website (the "Controller").
Any question concerning the processing of personal data, including the exercise of the rights set out in section 9, may be addressed to the Controller at [email protected].
Given the nature and scale of the processing, the Controller is not required to designate a data protection officer under Article 37 of the GDPR and has not done so.
2. Personal data processed
In connection with the Application, the following categories of personal data, provided by the user or generated through the use of the service, are processed:
- Identification and access data: email address, password (stored exclusively as a cryptographic hash and not readable by anyone, including the Controller) and, where provided by the user, a name.
- Financial data entered by the user: expenses, income, bills, budgets, savings goals, categories, notes and the corresponding amounts and dates.
- Group data: the group the user belongs to, its other members and, where recorded, the names of dependants entered by an adult member for the purpose of organising expenses.
- Receipt images: only where the user attaches them to a transaction. Images are reduced on the user's device before being stored.
- Preferences: language, number format, theme, time zone and screen configuration.
- Notification data: the technical device identifier required to deliver notifications, only where the user enables them, and the notifications sent.
- Support requests: the subject and messages exchanged when the user opens a help request in the Application.
- Security data: a cryptographic hash of the email address for which a password reset is requested, used solely to limit abusive requests.
Bank statements. The statement import feature reads the selected file (PDF or spreadsheet) exclusively on the user's device. The file is not transmitted to the Controller or to any third party. Only the transactions expressly confirmed by the user are stored.
Technical logs. The Application includes an error-logging mechanism that is disabled for all users except the Controller's development account. Should this change, this Policy will be updated in advance.
The Application does not collect usage data for analytics purposes, does not integrate advertising services or third-party tracking tools, and does not process special categories of personal data within the meaning of Article 9 of the GDPR.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creation and management of the account; provision of the Application's features, including sharing the budget among group members | Performance of the contract with the user (Article 6(1)(b) GDPR) |
| Sending notifications and reminders to the device | The user's consent, given when enabling notifications (Article 6(1)(a) GDPR) |
| Handling support requests and requests to exercise rights | Performance of the contract and compliance with a legal obligation (Article 6(1)(b) and (c) GDPR) |
| Security of the service and prevention of abuse | The Controller's legitimate interest (Article 6(1)(f) GDPR) |
| Audience measurement on the Website with Google Analytics (section 12) | The visitor's consent (Article 6(1)(a) GDPR and Article 5 of Law No. 41/2004) |
| Aggregate count of visits to the Website with Cloudflare Web Analytics, without cookies (section 12) | The Controller's legitimate interest in knowing how many people visit the Website and where they come from (Article 6(1)(f) GDPR) |
Personal data is not sold, transferred or shared with third parties for commercial or advertising purposes.
4. Recipients
Group members. Financial data recorded in a group is accessible to the members of that group, this being the purpose of the Application. A user who leaves a group no longer has access to its data.
Processors. The Controller uses the following service providers, which process personal data on its behalf and in accordance with its instructions, under Article 28 of the GDPR:
| Entity | Service | Location |
|---|---|---|
| Supabase, Inc. | Database hosting, authentication and file storage | Ireland (EU) |
| Cloudflare, Inc. | Hosting of the web Application and of the Website; aggregate, cookieless count of visits to the Website (section 12); routing of support email | Global network, including the US |
| Resend, Inc. | Sending password reset emails | US |
| Expo (650 Industries, Inc.) | Delivery of notifications and updates to the iPhone Application | US |
| Apple Inc. / Google LLC / browser vendors | Final delivery of notifications to the device, where enabled | Depending on the provider |
| Google Ireland Limited | Google Analytics, on the Website only and subject to consent (section 12) | Ireland (EU), with possible transfer to the US |
Personal data may also be disclosed to judicial or administrative authorities where required by law.
5. Transfers outside the European Economic Area
The Application's database is hosted in the European Union. Some of the processors listed in section 4 are based in the United States and may process personal data outside the European Economic Area. Such transfers take place under the standard contractual clauses adopted by the European Commission, in accordance with Article 46(2)(c) of the GDPR, which form part of the data processing agreements entered into with each processor. Cloudflare, Inc. and Resend, Inc. are, in addition, certified under the EU-US Data Privacy Framework. Data subjects may obtain further information on these safeguards from the Controller.
6. Retention periods
- Account and financial data: kept for as long as the account remains active and erased upon deletion of the account, as set out in section 7.
- Read notifications: erased 90 days after being read.
- Support requests: erased 30 days after being resolved.
- Technical logs: erased 7 days after being created.
- Password reset security data: erased 48 hours after the request.
- Website audience measurement data: retained by Google Analytics for 14 months. Cloudflare Web Analytics data is aggregated, does not identify the visitor and is retained by Cloudflare under the terms of the service.
7. Account deletion
The user may delete their account at any time in the Application, under Settings › Delete the account, or by request to the Controller. Before confirmation, the Application states the consequences for each group the user belongs to:
- where the user is the only member of a group, the group and all data recorded in it, including receipt images, are erased;
- where the group has other members, the user is removed from the group and the group's data remains available to the remaining members, no longer associated with the user.
Deletion takes effect immediately in the production systems.
8. Security
The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including encryption of communications, access control enforced in the database itself, which restricts each user to the data of the groups they belong to, and private storage of receipt images.
9. Rights of data subjects
Under Articles 15 to 22 of the GDPR, data subjects have the right to request access to their personal data, its rectification or erasure, restriction of processing and data portability, and to object to processing, as well as to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
The rights of access, rectification and erasure may be exercised directly in the Application. Other requests should be sent to the Controller at [email protected] and will be answered within one month of receipt, which may be extended under Article 12(3) of the GDPR.
Data subjects also have the right to lodge a complaint with the competent supervisory authority, the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, www.cnpd.pt).
10. Automated decisions
The Application suggests categories for imported transactions based on rules executed on the user's device. These suggestions are subject to the user's confirmation and do not constitute decisions based solely on automated processing that produce legal effects or similarly significantly affect the user, within the meaning of Article 22 of the GDPR.
11. Minors
The Application is not intended for children under 13, the age from which consent may be given under Article 16 of Law No. 58/2019, and the Controller does not knowingly collect personal data from children under that age. Dependants recorded in a group have no account and no access to the Application.
12. Cookies and similar technologies
In the Application, only local storage technologies strictly necessary to maintain the authenticated session and the user's preferences are used; these do not require consent under Article 5(2) of Law No. 41/2004.
On the Website, the following technologies are used:
| Name | Type and purpose | Duration |
|---|---|---|
mayora.cookies | Strictly necessary. Local storage that records the visitor's choice regarding analytics cookies. | Until deleted by the visitor |
mayora.theme | Functional. Local storage that records the theme (light or dark) chosen by the visitor. | Until deleted by the visitor |
_ga, _ga_* | Analytics. Google Analytics cookies used to measure the pages visited, the source of visits, the type of device and browser and the country. Set only after consent. | Up to 2 years |
Analytics cookies are set, and Google Analytics is loaded, only after the visitor accepts them in the notice displayed on the Website. In the absence of a response, or upon refusal, no Google service is loaded. Data sharing with Google for advertising purposes is disabled, and measurement data is not linked to the Application account.
Visitors may change or withdraw their consent at any time through the Cookies option in the footer of every page of the Website. Withdrawal of consent results in the deletion of the Google Analytics cookies.
The Website also uses Cloudflare Web Analytics, which counts visits in aggregate (pages viewed, source of the visit, country, type of device) without setting cookies, without storing data on the visitor's device and without identifying the visitor. As it does not access information stored on the device, it does not require consent.
13. Changes to this Policy
The Controller may amend this Policy; the date of the last update is shown at the top. Material changes, in particular those involving new categories of data or new purposes of processing, will be notified in the Application before they take effect.