Privacy policy

Last updated: October 29, 2026

Compta By Monsieur S helps you keep track of your accounts: the data you entrust to it is personal, and often sensitive. This page explains which data we process, why, for how long, and how to exercise your rights.

Data controller

The controller of your personal data is [to be completed], publisher of Compta By Monsieur S (see the legal notice). For any question about your data or to exercise your rights, write to [to be completed].

Data processed

We only process the data the service needs:

Account: email address, first and last name (optional), language, password (stored hashed, never in clear text), passkeys (only the public key is kept), Google account identifier if you link it.

Management data: accounts, transactions, categories, payees, payment methods, schedules, budgets, loans, net worth and badges that you enter or import. Imported files (statements, transactions) are read to prepare the import, then are not kept.

Subscription: plan subscribed and validity dates. Card payments are processed by our payment provider: your card details are never sent to us.

Support: your messages and bug reports, the screenshot you attach, your browser and the site version; after a site error, the technical context of the page concerned, only if you choose to send it to us.

Last visit: the date you last logged in, to the day, to offer you a welcome-back offer after a long absence.

App and notifications: for each device on which you turn on notifications, the delivery address assigned by your browser's notification service, the keys that encrypt notifications, the browser and operating system (to recognise the device); the notification topics you choose; the date the installed app was first opened (badge).

Technical data: IP address (limiting login attempts and email sending) and server logs.

We never ask for your online banking credentials and do not access your bank accounts.

Purposes and legal bases

Providing the service and managing your account, including the emails that are part of it (address confirmation, forgotten password, schedule reminders and budget alerts you enable): performance of the contract (terms and conditions).

Sending you offers by email about our own service (such as free days of Premium after a long absence): legitimate interest. You can object at any time from your profile or the unsubscribe link in each email.

Sending you the notifications you turn on for a device (reminders, alerts, shared pots, shared accounts, badges): your consent, given by turning them on and accepting the browser prompt. You can withdraw it at any time, device by device (Mobile app page or browser settings), and choose the topics you receive; logging out also turns off the device.

Managing the Premium subscription and its invoicing: performance of the contract and legal accounting obligations.

Securing the service (attempt limiting, anti-robot check, logs): legitimate interest.

Answering your requests and fixing reported errors: legitimate interest.

Your data is never sold, rented or used for advertising or profiling. Badges, trends and suggestions are computed from your own data only, for you only, and lead to no decision about you.

Recipients and hosting

Your data is only accessible to you and, when needed for maintenance or support, to the publisher. It is entrusted to technical processors bound by confidentiality and security obligations: the host [to be completed], the email delivery provider and the payment provider.

If you use Google sign-in or the anti-robot check, Google receives the information described on the Cookies page.

The notifications you turn on go through your browser's notification service (Google for Chrome and Android, Mozilla for Firefox, Microsoft for Edge, Apple for Safari), which may be located outside the European Union. Their content is end-to-end encrypted and unreadable by that service: it only sees your device's address and the size and time of each notification.

Your data is hosted in the European Union. Should a provider access it from a country outside the Union, the transfer would be covered by the safeguards provided by the GDPR (adequacy decision or the European Commission's standard contractual clauses).

Retention periods

Account and management data: as long as your account exists. It is erased when the account is deleted, unless the law requires it to be kept.

Invoices: 10 years (accounting obligation).

Support messages: as long as needed to handle the request, then 3 years at most.

Devices subscribed to notifications: until you turn them off or remove them, or the notification service reports them as expired, and at most as long as your account exists.

Links sent by email (registration, change of address, forgotten password): 1 hour.

IP address for attempt limiting: 1 hour at most. Server logs: 1 year at most.

Security

The site is only available over HTTPS. Passwords are hashed, login attempts are limited, and every piece of data is tied to your account only: no other user can access it. You can strengthen your account security with a passkey.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions about what happens to it after your death. Most information can be changed directly in the application (Profile, Settings); from your Profile, you can also download all your data and delete your account.

To exercise these rights, write to [to be completed] from your account's email address. We reply within one month.

If, after contacting us, you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies

The site only uses the cookies it needs to work; the Google check only loads at your request. Details: Cookies and privacy

Changes

This policy may change along with the service. In case of a significant change, you will be informed by email or at your next login.