Version: 1.7·Effective date: 2026-09-18·Updated on 2026-09-21
This Privacy Policy explains how Wizz! comms., a company incorporated in Ireland with registered office in Castlerea, Co. Roscommon (the "Controller", "we"), processes personal data when you use the MeJu service ("Service"). It also serves as the Data Processing Addendum (DPA) for users who require one.
This policy meets the disclosure obligations of Articles 13 and 14 GDPR and Articles 9 and 18 LGPD.
Financial (structured records): transaction records, categories, recurring invoices, investment positions, budgets and goals that you create or import into your workspace.
Billing: plan, currency, billing period, last four digits of card and brand (Stripe tokenises full card data; we never receive or store it).
Technical: IP address, user agent, device type, language, page views, basic event metadata, and the report generated when something fails in the Service (error message and stack, route accessed, browser and workspace identifier). That report is sanitised before it leaves us: email, phone number, IP address, username, request body and any financial value are stripped.
Attribution and product usage: a random visitor identifier, the origin of your first and most recent visit (campaign, ad click, referring site), country, and product usage milestones. Details in section 3.A.
Support: content of any message you send us.
Recovery contact (WhatsApp): if you choose "by WhatsApp" when you don't finish signing up and authorise the contact, we keep your phone number, the date of your consent and its source, only for a MANUAL human recovery contact. Never an automated send.
3.A. Attribution cookies and usage milestones
To know where the people using MeJu come from, and whether the product is actually being used, we set three cookies of our own (first-party, meaning only MeJu reads them) on every visit to the site.
| Cookie | What it's for | Duration |
|---|---|---|
| meju_vid | A random identifier for your browser. Links a visit to a signup made later. On its own, it contains no name, email, or anything that identifies you. | 1 year |
| meju_attr_first | Stores where your first visit came from: campaign parameters, ad click identifiers (Google, Meta, TikTok), the site that referred you, and the page you landed on. | 90 days |
| meju_attr_last | The same kind of information as the cookie above, but from your most recent visit. | 30 days |
These three cookies are set regardless of your choice in the cookie banner (Essential category), for the same reason meju_currency and NEXT_LOCALE are too: they never leave MeJu for a third party, so they don't depend on your analytics or marketing consent.
What we store in our database. When you join the waitlist or create an account, we link these cookies to two records: the origin of your signup (where you came from) and the usage milestones you reach along the way (for example: joined the waitlist, created an account, verified your email, finished initial onboarding, made your first financial entry, started or cancelled a subscription). With your consent given in the cookie banner, five of these milestones (visiting a public page on the site, clicking "start free trial" or "buy", free trial started, first paid charge, and Lifetime purchase) are also reported to Meta from our server. For the last three, we send your email and space identifier as SHA-256 hashes, and, for the two paid milestones, the amount charged. The page visit and click milestones carry no email and no space identifier; instead, your IP address and browser identifier (user agent), unhashed. Meta requires those two fields in plain text, unlike the email, to confirm it's you (section 7).
What is NEVER stored in either of these records: your name, your email, your phone number, and no financial amount, not even a total or a summary. Of your access, we store only your country. With Marketing consent given, your IP address and browser identifier are also reported, unhashed, both when you click "start free trial" or "buy" and when you visit any public page on the site (section 7).
Legal basis. Storing this origin and these milestones in our own database rests on legitimate interest: understanding where users come from and whether the product is being used, in the same spirit as the source field we already collect today when you join the waitlist. Sending that data to a third-party tool (for example, an advertising platform) is different: that does require your analytics or marketing consent, given (or not) in the cookie banner. We do not send the full origin and milestone records to any third party; the sole exception is the five milestones described above, sent to Meta only with your consent and only as described in section 7. In three of them (the page visit, the click, and the start of the free trial), the random identifier of your browser (the meju_vid cookie) also leaves as a SHA-256 hash, so Meta can link those actions to the same person; in the two billing milestones it does not, because those come from a Stripe notification, outside your browser. The meju_attr_first and meju_attr_last cookies still never leave MeJu. The Meta Pixel and the server-side Conversions API, both described in section 7, are the mechanism for that exception: the Pixel uses Meta's own cookies (_fbp and _fbc) in your browser, and both only send data after you give marketing consent.
How to request deletion. At any time, at [email protected], or through your right to erasure in section 10.
4. Data we do NOT collect
This is part of how MeJu protects your privacy by design:
Original PDF or CSV statements you upload are not stored. They are parsed in memory, the structured records are saved, and the original file is discarded.
We do not collect biometric data.
We do not collect special category data (Art. 9 GDPR).
We do not collect children's data (the Service is not directed at people under 18).
We never sell your personal data. We never use your financial records to train AI models.
6. Artificial Intelligence
We use artificial intelligence for three things inside the Service: generating aggregated financial suggestions (the daily tip, the monthly summary, the panorama report, the observation of out-of-pattern spends and category suggestions), interpreting the messages you send to the WhatsApp Assistant, when you link your phone number (section 6.A), and transcribing into text the voice messages you send to that same Assistant.
Model. We use two model regimes, one for each use described in this section. To interpret the messages you send to the WhatsApp Assistant and for category suggestions, we use gpt-4o-mini, from OpenAI, L.L.C., in the United States, called either directly through the OpenAI API or routed through OpenRouter, Inc., also in the United States, which forwards the call to the model provider and returns the response. For the aggregated financial suggestions (the daily tip, the monthly summary, the panorama report and the observation of out-of-pattern spends), we use a chain of open models, also routed through OpenRouter, which may vary depending on provider availability. To transcribe voice messages, we use whisper-large-v3, a speech recognition model, served by Groq, Inc., in the United States, with OpenAI, L.L.C. as a configurable fallback (whisper-1). We may change any of these models to a comparable model with the same retention and privacy posture; the models in use are always the ones declared in this section, and we update this document whenever they change.
What is sent. Before the call, we aggregate your data into an anonymised snapshot containing only:
percentage variations between months and categories;
balance status (positive, neutral, negative);
day of the week and current day of the month;
account language (pt or en) and currency (BRL or EUR);
category labels you defined (e.g. "groceries", "transport");
for the category-suggestion feature, the transaction description, truncated to 80 characters, only after a local heuristic match fails.
Exception: the WhatsApp Assistant. When you use the Assistant (section 6.A), the text of the message you write is sent to the model, to extract the transaction from it or understand the question. Unlike the snapshot above, this text is content you wrote yourself, and it can include a name, an amount, or any other information you typed.
What is NEVER sent.
no full name, email address, User identifier or Account identifier that MeJu adds to the call (the text you write to the Assistant may mention names on its own, see the exception above);
no transaction description for the daily tip, summary, panorama or anomaly features;
no absolute monetary amount for the daily tip, summary, panorama or anomaly features (only percentages and signs in those cases);
no bank account number, no card data, no IBAN;
no original PDF or CSV statement.
Country of processing. United States.
Safeguards. Transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) 2021/914. The safeguards differ depending on the call's path, so we state them separately:
Direct call to OpenAI. OpenAI's Data Processing Addendum, with zero data retention contractually enabled at our organisation level: prompts and completions are not persisted, are not used for training, are not reviewed by humans, and are not used to improve any model.
Call routed through OpenRouter. OpenRouter, Inc. states that it does not use inputs and outputs to train models and does not retain them beyond the time needed to route the call, except as required for abuse detection, security, billing or legal obligations, and relies on the Standard Contractual Clauses under Art. 46 GDPR. On the calls that carry the text of your messages, every request asks OpenRouter not to route to providers that store inputs for training. On this path, our organisation's zero-retention contract with OpenAI does not apply, because the call reaches the provider through OpenRouter and not directly from us; what protects this segment is OpenRouter's policy described here and the fact that the content sent is the content described above.
Output is informational. AI output may be inaccurate, incomplete or outdated. It is informational only and is not financial, tax, accounting, investment or legal advice. You remain solely responsible for any decision you make based on AI output.
Opt-out. You can switch AI off at any time under Settings > Plan > Artificial Intelligence. When off, no snapshot is built and no AI call is made for the aggregated suggestions (the daily tip, the monthly summary, the panorama and the observation of out-of-pattern spends). The WhatsApp Assistant is governed by its own consent given when you link your number (section 6.A) and keeps processing your messages even with this toggle off; to stop it, unlink your number in Settings. Existing AI suggestions stored in your account stay until you delete them or close the account.
6.A. WhatsApp Assistant
If you link your phone number, MeJu offers a WhatsApp assistant that records transactions, answers questions about your finances and sends reminders you turn on.
What is processed. Your phone number, the content of the messages exchanged with the assistant and the record of your consent (date, time and version of the terms accepted). Messages are processed to carry out what you asked (for example, recording an expense) and are linked to your space.
Legal basis. Consent, collected when you link your number. You can unlink at any time in Settings, which stops all processing by the assistant.
Transport. Messages travel through the WhatsApp Business Platform, operated by Meta (see section 7). Meta handles messages under the platform terms. The content you send to the assistant is not used by MeJu for any purpose other than answering and recording what you asked.
Voice messages. You can also send the assistant a voice note. The audio is downloaded from Meta and sent to a transcription subprocessor (Groq, Inc., or, by configuration, OpenAI, both in the United States), which returns the corresponding text; that text then follows the same path as a typed message, including the assistant AI described below. We do not store the audio: inside MeJu it exists only in memory during that call and is never written to disk or to a database. What the transcription subprocessor does with the file is governed by its own terms, described in the table in section 7. The legal basis remains the consent given when you linked your number.
Assistant AI. Simple queries are answered without AI. When AI is used, the text of the message you wrote is sent to the model provider to extract the transaction or understand the question; your name, your phone number and your account identifiers do not go along. The assistant's overview is different: it uses the anonymised snapshot described in section 6 and never the text of your messages. Both cases follow the models, the countries and the safeguards in section 6.
Reminders. Sent only if you turn them on, using message templates approved by the platform. You can turn them off at any time in Settings.
7. Subprocessors
We rely on the following subprocessors to operate the Service. Each is bound by a data processing agreement and appropriate safeguards.
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, object storage | EU region | Intra-EEA |
| Stripe Payments Europe Ltd | Payments, subscriptions, customer portal | Ireland (EU) | Intra-EEA |
| Resend | Transactional email | United States | Standard Contractual Clauses |
| Hostinger | Service hosting (virtual private server) | United Kingdom (Manchester) | EU-UK adequacy decision (Decision 2021/1772); TLS in transit |
| Cloudflare, Inc. | Reverse proxy, DNS and traffic protection in front of the server (processes the IP address of every request) | United States (global edge network) | Standard Contractual Clauses; EU-US Data Privacy Framework certification |
| Meta Platforms Ireland Ltd (WhatsApp Business Platform) | Sending and receiving WhatsApp Assistant messages, including reminders | Ireland (EU); platform traffic may transit Meta's global infrastructure | WhatsApp Business Platform terms and Meta's Standard Contractual Clauses |
| Google Analytics | Anonymous traffic analytics | United States | Standard Contractual Clauses, IP anonymisation, consent gated |
| Google Tag Manager (GTM Web) | Loads the container that today feeds the GTM Server container (Stape), used for ad attribution on Meta, not for general site analytics, gated on the Marketing category in the cookie banner, a different legal basis than the one used by Google Analytics above | United States | Standard Contractual Clauses, consent gated |
| Meta Platforms Ireland Ltd (Meta Business Tools / Meta Pixel / Conversions API) | Advertising measurement and attribution, only when you accept the Marketing category in the cookie banner (stamped at the time of purchase); nothing is queued or sent without it. From your browser (Meta Pixel): your page view, through the _fbp and _fbc cookies. From our server (Conversions API), at five moments: free trial started, first paid charge, and Lifetime purchase, with your email and space identifier as SHA-256 hashes, and, for the two paid milestones, also the amount charged (the MeJu plan price, already public on /pricing; never a value you record in the app) and the currency; and visiting a public page on the site or clicking "start free trial"/"buy", with no email and no space identifier, instead your country as a hash, the _fbp/_fbc cookies or the ad click identifier, the event name, date and time, the page visited or clicked from, and, unhashed, your IP address and browser identifier (user agent), required by Meta in plain text, unlike the email, to confirm it's you; on the page visit, the click, and the start of the free trial, the random identifier of your browser (meju_vid) is also sent as a SHA-256 hash, and on the two billing moments it is not, because those come from a Stripe notification, outside your browser | Ireland (EU); traffic may transit Meta's global infrastructure, including the United States | Meta Business Tools Terms and Standard Contractual Clauses 2021/914; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; conditioned on consent; automatic advanced matching is off; the email is sent only by our server, as a SHA-256 hash, and only with your consent; phone number and name are never sent |
| Groq, Inc. | Transcribes audio from voice messages sent to the WhatsApp Assistant (Whisper model); the default subprocessor for this transcription, with OpenAI as a configurable fallback (section 6.A) | United States | Standard Contractual Clauses 2021/914, incorporated into the services agreement (Module 2, controller to processor); Groq states that it does not use inputs or outputs to train or fine-tune models and that, by default, it does not retain request content, and may log inputs and outputs for up to 30 days solely to troubleshoot failures and investigate abuse |
| OpenAI Inc. | Interpretation of messages sent to the WhatsApp Assistant and category suggestion (section 6), either directly or routed through OpenRouter; and, as a configurable fallback, transcription of audio from voice messages sent to the Assistant (Whisper model, section 6.A) | United States | Standard Contractual Clauses 2021/914; zero retention contracted on the direct call; when routed through OpenRouter, the request blocks providers that train on the data; no training |
| Functional Software, Inc. (Sentry) | Error tracking for the Service: receives the failure report described in section 3, so that we can detect and fix defects | EU region (Frankfurt, Germany); the company is US-based and part of the account metadata is replicated to the United States | Standard Contractual Clauses 2021/914 (Module 2, controller to processor), incorporated into Sentry's public DPA, which is deemed signed upon entering the service agreement; error events stored in the European Union by region choice; the report sent carries no email, phone number, IP address, username or financial value |
| OpenRouter, Inc. | Routing of Assistant interpretation and category-suggestion calls when they are not made directly to OpenAI, and routing of the open-model chain used for the aggregated financial suggestions (daily tip, monthly summary, panorama, observation of out-of-pattern spends) | United States | Standard Contractual Clauses (Art. 46 GDPR); OpenRouter states that it does not use inputs and outputs to train models and does not retain them beyond what is needed to route the call; on calls carrying Assistant or category-suggestion text, the request blocks providers that train; the aggregated suggestions use only the anonymised snapshot, no personal data |
We update this list at https://mejuapp.com/legal/privacy whenever it changes.
8. International transfers
EU/EEA → United States (Resend, Google Analytics, Google Tag Manager, OpenAI, OpenRouter, Groq, Cloudflare, Meta (Business Tools, as to transit through its global infrastructure), and Sentry only as to the replicated account metadata, since the error events stay in the European Union): transferred under the European Commission's Standard Contractual Clauses (SCCs) 2021/914, with additional technical measures (TLS 1.3 in transit, contractual zero retention on the direct OpenAI call, IP anonymisation at Google Analytics, advanced matching disabled on the Meta Pixel). You may request a copy of these clauses by writing to [email protected].
Brazil → European Union (Supabase, Stripe Europe, Sentry): transferred under LGPD Art. 33, II (cross-border transfer to a country that offers an adequate level of personal data protection, as recognised by the European Commission's adequacy framework and pending an ANPD adequacy decision) or, in the alternative, Art. 33, IX (specific consent of the data subject when applicable to a given operation).
Brazil → United States (Resend, Google Analytics, Google Tag Manager, OpenAI, OpenRouter, Groq, Cloudflare, Meta (Business Tools)): transferred under LGPD Art. 33, II in combination with Standard Contractual Clauses signed with each subprocessor, with the additional safeguards described in sections 6 and 7 for OpenAI, for OpenRouter and for Groq.
EU/EEA and Brazil → United Kingdom (Hostinger, hosting): transferred under the European Commission's adequacy decision for the United Kingdom (Decision 2021/1772) and, for data subjects in Brazil, under LGPD Art. 33, II (country offering an adequate level of protection).
9. Retention
Retention is set by category, not by account.
| Category | Retention period | Trigger of deletion |
|---|---|---|
| Account profile (name, email, password hash) | Active account | 30 days after account closure |
| Financial records (transactions, categories, budgets, goals, recurring) | Active account | 30 days after account closure |
| Batches of transactions moved to the trash, including investments and card items saved with them | 7 days in a recoverable snapshot | Automatic permanent deletion after 7 days, or immediately if you delete it for good from the trash |
| AI snapshots and AI outputs (daily tip, summary, panorama) | Active account | 30 days after account closure or immediately on AI opt-out |
| Backups | 30 days | Rolling deletion in normal rotation |
| Technical and security logs, including error reports in Sentry | 90 days | Rolling deletion |
| Email verification and magic-link tokens | 15 minutes | Automatic expiry |
| Assistant message content (typed text or audio transcript) | 60 minutes | Deleted once the message is processed; an automatic sweep removes any remainder within 60 minutes |
| Rate-limit counters | 24 hours | Automatic expiry |
| Server queue for events sent to Meta's Conversions API (email and space identifier as hashes, amount charged, for the three subscription/purchase moments; for the page visit and the "start free trial"/"buy" click moments (no email, no space identifier), your IP address and browser, unhashed) | Up to 7 days after delivery; at most 30 days even if delivery never happens | Automatic deletion after that period, or after 30 days regardless of delivery status; for the first paid charge, a marker without personal data remains, only to stop a renewal from being reported again |
| Billing data, invoices, tax records | 5 years (Irish accounting and tax obligation) | 5-year statutory retention from issuance |
| Consent records (cookies, AI, marketing) | 5 years or until withdrawal + 1 year | Statutory limitation period |
| WhatsApp recovery contact (phone number, consent) | 90 days from the unfinished signup | Automatic deletion after 90 days, or sooner at your request |
After deletion, residual references may remain in offline backups until the backup rotation completes; restoring a backup never reinstates a deleted account, only operational data of active accounts.
10. Your rights
You have the right to:
access your personal data;
correct inaccurate or incomplete data;
delete your data (right to erasure / right to be forgotten);
restrict or object to processing;
portability (receive your data in a structured, machine-readable format);
withdraw consent at any time, without affecting prior lawful processing;
not be subject to decisions based solely on automated processing that produces legal or similarly significant effects on you (we do not make such decisions; AI suggestions are informational and you remain the decision-maker);
lodge a complaint with a supervisory authority.
How to exercise your rights.
| Right | In-app path | Or by email |
|---|---|---|
| Access and portability | Backups page in the app (JSON file of your workspace) | [email protected] |
| Correction | Edit any record directly inside the workspace | [email protected] |
| Erasure | [email protected] (handled and confirmed by email) | N/A |
| Restrict or object | [email protected] | N/A |
| Withdraw AI consent | Settings > Plan > Artificial Intelligence (toggle off) | [email protected] |
| Withdraw cookie consent | "Cookie settings" link in the footer | N/A |
| Withdraw marketing consent | unsubscribe link in any email | [email protected] |
We respond to any rights request within 30 days. If we need an extension (complex requests, GDPR Art. 12(3)), we tell you within the first 30 days. There is no charge unless the request is manifestly unfounded or excessive.
11. Supervisory authorities
European Union: Data Protection Commission (DPC) Ireland, www.dataprotection.ie.
Brazil: Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.
You may complain to either authority depending on where you live.
12. Security
We apply organisational and technical measures including:
row-level security per workspace in the database;
encryption at rest (Supabase managed) and TLS 1.3 in transit;
secrets stored only as environment variables;
access to production limited to authorised personnel under least privilege;
regular dependency and configuration audits.
If a personal data breach poses a risk to your rights, we notify the supervisory authority within 72 hours under GDPR Art. 33 and you under Art. 34 where required.
13. Cookies
See our Cookies Policy at /legal/cookies for full details, categories and the cookie banner controls.
14. Children
The Service is not directed at and may not be used by people under 18.
15. Changes to this policy
We may update this policy. Material changes are notified by email at least 30 days before they take effect and appear with a new version number and effective date.