Privacy Policy

This policy covers saasmon.net and the SaaSMon web app ("SaaSMon", "we", "us"). If you have a question about your data, email [email protected].

• Your project and financial data are isolated to your account and are never visible to other users.
• We do not sell your personal data, and we do not use your financial records for advertising.
• You can export your transactions to CSV at any time, on every plan, and request account removal at any time.

• Account details: your name, email address and a salted hash of your password. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider; we never see your Google or GitHub password.
• Financial records you enter or import: projects, income and expense transactions, budgets, categories, account types, recurring rules and notes.
• Images you upload, such as project logos or avatars.
• Billing details: your plan, billing period, subscription status and invoices. Card and payment details are collected and stored by Dodo Payments, not by us.
• API keys: we store only a SHA-256 hash of each key, together with its name, a short visible prefix, its permissions, any expiry date, and when it was created and last used.
• Settings such as your currency, theme and email notification preferences.
• Technical data: IP address, browser and device information, and server logs used for security, rate limiting and troubleshooting.
• Usage analytics collected through Google Tag Manager and Google Analytics, as described in the Cookie Policy.

• To provide the service: storing your records, calculating reports and forecasts, and posting recurring transactions.
• To sign you in and keep your account secure, including bot protection with Cloudflare Turnstile.
• To process your subscription through Dodo Payments.
• To send service emails: email verification, password resets, receipts and invoices, renewal reminders 3 days before a subscription renews, and notices when a payment fails.
• To send optional emails, such as budget alerts and welcome messages, according to your notification preferences.
• To understand how the site is used and improve it.
• To meet legal, tax and accounting obligations, and to prevent fraud and abuse.

Where data protection law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where it is required (for example for some analytics), and our legal obligations.

You can turn renewal reminders, payment-failed notices, budget alerts and welcome emails on or off in your notification preferences. Emails needed to operate your account, such as verification, password reset and receipts, are always sent.

We use a small number of service providers, each only for the purpose listed:

• Dodo Payments, our payment processor and merchant of record, which handles checkout, payment details, sales tax and VAT, and refunds. Dodo Payments processes payment data under its own privacy policy.
• A cloud hosting provider that runs our application and database.
• S3-compatible object storage for images you upload.
• An SMTP email provider that delivers our emails.
• Google and GitHub, only if you choose to sign in with them.
• Cloudflare, for Turnstile bot protection on sign-in and sign-up forms.
• Google, for Google Tag Manager and Google Analytics.

We may also disclose information if required by law, or to protect the rights and safety of our users and the service. If SaaSMon is ever sold or merged, your data would transfer under the same protections described here.

We keep your account and financial records for as long as your account is open. If you ask us to delete your account, we delete your records without undue delay, except information we must keep for legal, tax or accounting reasons (such as billing records) and short-lived backups, which are overwritten on their normal schedule. Revoked API keys stop working immediately.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to withdraw consent. You can export transactions yourself from the dashboard; for anything else, email [email protected] from the address on your account. You can also complain to your local data protection authority.

Our providers may process data in countries other than yours. Where that happens, we rely on the safeguards those providers offer for international transfers.

How we protect your data is described on the Security page.

SaaSMon is a business tool and is not intended for children under 16. We do not knowingly collect their data.

We update this policy when the product or our providers change. The date at the top shows the latest version. If a change materially affects how we use your data, we will email account holders before it takes effect.