Monarka is an expense tracker that stores personal financial information. This policy explains what data we collect, why we need it, and how we look after it. It is written in plain English on purpose — if anything is unclear, email hola@monarka.lat. The Spanish version of this document is the authoritative one for legal purposes.
1. Who we are
Monarka is a project operated by its founding team. For data-protection purposes, we act as the data controller of the information you load into the application.
Controller contact: in writing to hola@monarka.lat.
2. What data we collect
We only store what we need for the app to work:
- Account data: email, display name and a password stored as a hash by Supabase Auth (we never see the password in clear text).
- Financial data you enter: vaults, accounts, transactions, categories, recurring rules, loans, properties and investments. This data lives in your account and only you can see it.
- Basic technical data: IP address, browser type, operating system and a session identifier, captured in logs for security and diagnostic purposes.
- Functional cookies: Supabase session cookies to keep you authenticated and theme preferences (light or dark). The interface language is determined by the URL you visit (
/for Spanish,/enfor English), not by a cookie. We do not use advertising cookies or third-party trackers.
3. What we use your data for
The data we store serves three bounded functions:
- Run the application — show your balances, generate credit-card installments, compute loan amortization, materialize recurring rules, value properties and investments.
- Keep it safe — detect suspicious access, prevent service abuse, and resolve incidents.
- Communicate with you — answer your questions and send relevant service notices (terms changes, scheduled maintenance). We will not send you marketing unless you explicitly opt in.
We do not use your data to train AI models, we do not share it with advertisers, and we do not sell it. Period.
4. Where it is stored
Your data lives in Supabase (PostgreSQL with Row-Level Security) and the application is served from Vercel. Both providers have robust security standards and operate on infrastructure encrypted in transit (TLS) and at rest. The exact server region is listed in our subprocessor list, available on request.
5. How long we keep it
- While your account is active, we keep everything you uploaded.
- If you delete your account, we erase personal data within 30 days. Technical logs may be retained up to 90 days for security reasons.
- Encrypted backups may persist up to 60 additional days before they rotate out.
6. Your rights
As the data subject, you may exercise the following rights at any time:
- Access — request a copy of the information we hold about you.
- Rectification — correct inaccurate data.
- Erasure — request that we delete your data (subject to legal retention obligations).
- Portability — export your data in a structured, readable format. The app already includes movement export.
- Objection — request that we stop processing your data for specific purposes.
To exercise any of these rights, email hola@monarka.lat. We respond within 15 business days.
7. Applicable legal framework
This policy is governed by Paraguay's Law Nº 6534/2020 on the Protection of Personal Credit Data and, where applicable, by the European Union General Data Protection Regulation (GDPR) for users residing in the EEA. We also comply with California's CCPA standards for users in that state.
8. Minors
Monarka is not directed to children under 16. If we receive data from a minor without parental consent, we delete it as soon as we detect it.
9. Changes to this policy
If we update this policy, we will publish the new version at this same URL and, if changes are material, we will email you before they take effect.
10. Contact
For any question about this policy or about how we treat your data, email hola@monarka.lat.