Privacy Policy

App: Spenze | Company: Mehnic | Last updated: September 25, 2026

    Summary: Spenze collects only the data necessary to provide our personal finance management service with AI features. We do not sell your data. You can request deletion at any time.
  

1. Who We Are

The Spenze app is developed and operated by Mehnic, a company that owns a portfolio of mobile applications. For the purposes of applicable privacy laws (including Brazil's LGPD, the EU GDPR, and California's CCPA), Mehnic is the data controller for your personal information.

Data Protection Officer (DPO) / Privacy Contact:
Email: fabio.almcosta@gmail.com

2. Information We Collect

2.1 Account and Profile Data

Full name — provided during registration
Email address — for authentication and communication
Profile photo — optional, uploaded by you
Language and currency preferences — for interface personalization
Financial goal — e.g., save money, pay off debt (set during onboarding)

2.2 Financial Data

Transactions — amount, date, description, category (income or expense)
Budgets — spending limits per category and period
Custom categories — created by you

This data is stored on our secure servers (PostgreSQL on a Hostinger VPS) and is visible only to you.

2.3 Voice Data

When you use voice entry, audio is sent to Groq for transcription. The transcript is sent to DeepSeek to extract transaction details. Spenze does not keep a permanent copy of the audio after processing. Provider processing is governed by the terms and policies linked in section 4.

For AI chat and insights, we send DeepSeek your message, the necessary financial context and relevant conversation history. Images you upload are also sent to DeepSeek. For text-based PDFs, XLSX spreadsheets and supported TXT/CSV files, content is extracted on our server before being sent to DeepSeek. Unsupported files or files without extractable text are rejected; do not upload information you do not wish to share with these providers.

2.4 Social Authentication

If you sign in with Google, Facebook, or Apple:

We receive your name and email as provided by the social provider
We do not store your access tokens or passwords from those providers
Each provider has its own Privacy Policy: Google, Facebook/Meta, Apple

2.5 Subscription Data

Plan status (free or premium)
Subscription expiry date and type
Processed via RevenueCat — actual payment is handled by Apple App Store or Google Play and never passes through our servers

2.6 Technical and Usage Data

Device language and OS (iOS or Android)
Messages sent to the AI financial assistant (chat feature)
App crash and error logs (no personal financial data included)

3. How We Use Your Data

Purpose	Data Used	Legal Basis
Create and maintain your account	Name, email	Performance of contract
Provide the financial management service	Transactions, budgets, categories	Performance of contract
AI features (insights, chat assistant)	Transactions, history	Legitimate interest / Consent
Voice-to-transaction feature	Audio (temporary, not stored)	Consent
Social authentication	Name, email from provider	Performance of contract
Subscription management	Plan status	Performance of contract
Customer support	Email, reported issue data	Legitimate interest
Security and fraud prevention	Technical logs	Legitimate interest / Legal obligation

We do not use your financial data for advertising, profiling for third parties, or any purpose other than delivering and improving the Spenze service.

4. How We Share Your Data

We do not sell, rent, or share your personal data with third parties for commercial or advertising purposes. We share data only with infrastructure providers necessary to run the service:

Provider	Purpose	Country	Privacy Policy
Hostinger	API and PostgreSQL hosting on a VPS	International infrastructure	View
Groq	Transcription of user-submitted audio	USA	View
DeepSeek	Chat, insights, images and interpretation of text extracted from documents and audio	China	View
RevenueCat	Subscription management	USA	View
Google	Social login (OAuth)	USA	View
Facebook / Meta	Social login (OAuth)	USA	View
Apple	Sign in with Apple (OAuth), App Store	USA	View

Each provider's processing terms are available through the links above. External services may retain data according to their terms and settings; we do not promise immediate deletion from those providers' systems.

5. International Data Transfers

Using external providers involves international data transfers, including to the United States and, for DeepSeek, China. Consult the provider terms and policies in section 4 for information about their processing locations and practices. Contact us using the details in this policy with questions about your data.

6. Data Retention

Account data and transactions: retained while your account is active
After account deletion: all personal data is permanently deleted from our servers within 30 days
Voice audio: we do not keep a permanent copy after transcription; external processing follows provider terms
Technical logs: up to 90 days for security and debugging purposes
Legal obligations: some data may be retained longer if required by applicable law

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

For all users (LGPD — Brazil):

Access: know what data we hold about you
Correction: update inaccurate or incomplete data
Deletion: request deletion of data processed with your consent, or unnecessary data — available directly in the app at Settings → Account → Delete Account
Data portability: receive your data in structured format (CSV) — available at Settings → Export Data
Revocation of consent: withdraw consent at any time for consent-based processing
Objection: object to processing based on legitimate interest
ANPD complaint: you may file a complaint with the Brazilian National Data Protection Authority (gov.br/anpd)

For EU/EEA users (GDPR):

All rights above plus: restriction of processing and right to lodge a complaint with your local supervisory authority

For California users (CCPA):

Right to know, delete, and opt out of sale (we do not sell data). You may also request non-discrimination for exercising these rights.

To exercise any of these rights, contact us at fabio.almcosta@gmail.com. We respond within 15 business days.

8. Data Security

We implement technical and organizational measures to protect your data:

All communication encrypted via HTTPS/TLS
Passwords stored using secure hashing (bcrypt)
Database hosted in a restricted-access environment (PostgreSQL on a Hostinger VPS)
Authentication via JWT tokens with automatic expiration
Automatic database backups

No system is completely immune to security threats. In the event of a data breach that affects your personal data, we will notify affected users and relevant authorities as required by applicable law.

9. Children's Privacy

Spenze is intended for users 18 years of age or older. We do not knowingly collect personal data from children under 13 (or under 16 in the EU). If we become aware that a minor's data has been collected, we will take immediate steps to delete it. If you believe a child has provided us personal data, please contact us at fabio.almcosta@gmail.com.

10. Cookies and Tracking

Spenze is a mobile application and does not use cookies. We do not use advertising trackers, cross-app tracking, or behavioral profiling for third-party purposes.

11. Push Notifications

With your permission, we may send push notifications for financial alerts and reminders. You can revoke this permission at any time in your device settings or in the app under Settings → Notifications.

12. App Store Data Practices (Apple)

In compliance with Apple App Store requirements, here is a summary of our data practices:

Data used to track you: None
Data linked to you: Contact info (email, name), Financial info (transactions, budgets), User content (profile photo), Identifiers (user ID)
Data not linked to you: Usage data for app functionality diagnostics

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

The "Last updated" date at the top will be revised
For material changes, we will notify you by email or via an in-app notification
Continued use of the app after changes constitutes acceptance of the updated policy

14. Governing Law

This Privacy Policy is governed by the laws of Brazil, in particular Law No. 13.709/2018 (LGPD). For users in the EU, GDPR applies to the extent applicable. The courts of São Paulo, Brazil have jurisdiction for any disputes.

15. Contact Us

Mehnic
Data Protection Officer: Fabio Almeida Costa
Email: fabio.almcosta@gmail.com
Response time: within 15 business days