Privacy Policy

• Account data: name, email, phone number, business name and city, and your profile photo and office logo if you add them. If you sign in with Google or Sign in with Apple, we receive your name and email from them (Apple may hide your real email and give us a relay address that forwards to you).
• Project data: the projects, expenses, payments, clients, vendors, contractors, agreements, quotations, purchase requests, stages, and tasks you enter, and the files you attach to them (receipt photos, site photos, and documents).
• Office accounting data (Office and Firm plans): treasuries (cash safe, bank accounts, InstaPay, wallets, and cards) and their balances, office expenses and income and recurring entries, transfers between treasuries, custody, receipts, partner drawings and funding, and office staff data: name, phone, job title, monthly salary, advances, and pay runs.
• Payment accounts you add so your clients can pay you: an InstaPay address or the phone number linked to it, and the bank name, account holder name, account number, and IBAN.
• Data about other people that you enter: for example your clients, property owners, contractors, suppliers, team members, and staff (their names, phone numbers, and the amounts related to them).
• Client portal and owner account data: when your client opens a portal link, or a property owner signs in with a code, we process what they do there, such as telling you they have paid, the transfer proof they upload, and their answers to approval requests.
• Billing data: your card is processed directly by Stripe; we do not store full card details on our servers. If you pay your subscription by InstaPay, we keep the amount, the transfer reference, and the screenshot you upload.
• Mobile app data: your device's notification token, operating system, device name, and app language (see Section 7).
• Technical usage data: device and browser information, IP address, the pages you visit, and technical errors, for operations, security, and analytics.
• Files you upload for AI reading: Excel workbooks, receipt photos or their PDFs, bank and card statements, and InstaPay transfer screenshots, plus what is read from them (see Section 5).
• Data of contractors and suppliers in the Myzan marketplace (by our invitation only): business name, contact name, phone number, trades, service areas, description, website, Instagram account, logo, portfolio photos, and catalogue.

• Operate the Service and provide its features to you, your team, and your clients.
• Process subscriptions and payments and issue receipts.
• Communicate with you about your account, support, and important updates, and send notifications in the Service and on your phone, and account emails.
• Show the payment accounts you added to your clients in payment requests and the client portal.
• Read the files you upload with AI and turn them into a draft you review, and improve the accuracy of that reading and of Myzan (see Section 5).
• Measure how well our ad campaigns work and understand how the Service is used (see Section 9).
• Improve the Service, protect its security, prevent fraud, and detect and fix technical errors.

We process your data on the basis of performing our contract with you (providing the Service), your consent (e.g. marketing messages), our legitimate interests (e.g. security and measuring our ad campaigns), and compliance with legal obligations. You can withdraw marketing consent at any time.

We rely on trusted service providers who process data on our behalf to run the Service:

• Supabase (database, sign-in, and file storage).
• Vercel (hosting the website and app, and measuring page performance with Vercel Web Analytics and Speed Insights).
• Stripe (to process payments securely).
• Resend (to send email, such as sign-in emails, invitations, and account emails).
• DeepInfra, Inc. (to run the open AI models that read files you upload for that purpose; see Section 5).
• Expo (to deliver notifications to the mobile app through Apple's and Google's push services).
• Sentry (to detect technical errors; see Section 9).
• PostHog (product analytics on the site, the Service's pages and the mobile app; see Section 9).
• Google (for sign-in with Google if you choose it, and for Google Analytics; see Section 9).
• Apple (for Sign in with Apple if you choose it).

We also use analytics and ad-measurement tools from Contentsquare and Meta (see Section 9). When you message us on WhatsApp, the messages pass through WhatsApp, which is owned by Meta, and are subject to its terms (see Section 8). We do not sell your data to anyone.

The "AI import" feature reads files that you upload and turns them into a draft of data. It covers Excel workbooks, receipt and invoice photos or their PDFs, bank and card statements (PDF, CSV or images), and InstaPay transfer screenshots. Reading only starts when you upload a file for that purpose.

Reading is done by open-weight AI models hosted by DeepInfra, Inc., to which the data is sent through its API. According to DeepInfra's published policy, it does not store the inputs and outputs of these models and does not use them to train models without explicit consent. Processing may take place in the United States.

What is sent to the provider:

• Excel workbooks: the contents of the sheets as text, with the project name, client name, fee model, project currency, and your cost-category names. Columns holding phone numbers, bank accounts, IBANs, or card details are removed before sending, and similar long numbers are masked.
• Receipts: the receipt photo after it is downsized (up to 1600 px), or the text of a PDF with account, card, and phone numbers masked, plus your list of cost categories, your account currency, and today's date.
• Statements and InstaPay screenshots: the statement text with account numbers, IBANs, card numbers, and phone numbers masked, or the images of scanned pages and screenshots.

Nothing is written to your account as a result of this reading until you review the result and confirm it. The password of a protected PDF is not sent to the provider; it is used once and never stored.

We keep a copy of every file this feature reads, and of the result of reading it, in private storage that users cannot access and that only authorized Myzan staff can reach. We may use uploaded files and the results of reading them to improve the accuracy of the reading and to improve Myzan, and to count your account's monthly allowance.

Using this feature is optional. You can always enter your data by hand or import it the usual way without any AI reading, and the rest of your use of the Service is unaffected.

• Client portal: when you turn on the portal link for a project, anyone who has the link can see a read-only financial view of the project and the files you choose to show the client. The portal is designed to hide vendor and contractor names and prices. The project name appears in the link preview when the link is shared in messaging apps. You can turn the link off, or create a new link that cancels the old one, at any time.
• Payment accounts: the InstaPay and bank accounts you added (including the account number and IBAN) are shown to your client in payment requests and the client portal.
• Your office name and logo: they appear in the portal and in the PDFs and quotations you share.
• Profile photo and office logo: they are kept in public storage, so anyone who knows the image address can open it.
• Your team: members of your office see the data that the role you give each of them allows.
• Myzan marketplace: the Myzan team reviews and verifies contractor and supplier listings. There are no public marketplace pages yet, and we will update this policy before any listing is shown publicly.

• Notifications: when you allow notifications, we keep your device's notification token, operating system, device name, and app language, and we send the notification's title and text through Expo and Apple's and Google's push services. You can turn notifications off in your phone's settings, and they stop reaching the device when you sign out.
• Camera and photos: used only when you choose to photograph a receipt or the site, or to attach a picture.
• Contacts: only the people you choose to add as clients, contractors, or suppliers are uploaded (name and phone number); we do not upload your whole address book.
• Face ID and fingerprint: checked by your phone itself; your face or fingerprint data never reaches us.

We may use your phone number to communicate with you about the product via WhatsApp — such as welcome messages, service updates, and support. We will not send marketing messages via WhatsApp without your consent, and you can opt out at any time.

The "Contact us" and "Report a problem" buttons open a WhatsApp chat with the Myzan team. What you send there reaches us through WhatsApp, and we use it to reply to you and fix the problem.

• Essential cookies: to operate sign-in and remember your preferences (such as language).
• Analytics: we use Google Analytics and Contentsquare on the site's pages, including the Service's pages after you sign in, to understand how pages are used and improve them, and Vercel Web Analytics and Speed Insights to measure page speed.
• Product analytics: on the site and the Service's pages, PostHog records the pages you visit, what you click, and technical errors, linked to your account ID, plan, and language once you sign in. Our servers also tell it about your sign-up and a paid subscription with its value. PostHog is not built into the mobile app, but our servers tell it which steps you use there, such as account setup, creating a project, and opening and saving the expense form, linked to your account ID and without any amounts, names, or project content.
• Error monitoring: Sentry records technical errors with browser, device, and IP address information, and may record a sample of sessions with text and form inputs masked.
• Meta pixel: on our marketing and sign-up pages only — never inside the Service once you are signed in — to measure how well our ad campaigns work.
• Meta signals from our servers: we tell Meta about your sign-up, your first project, your first expense, reaching 3 transactions within your first 16 days, and a paid subscription with its value. Each signal carries a hashed (irreversible) form of your email, phone number, country, and account ID, the Meta cookie identifiers in your browser, and the IP address and browser type from when you signed up. We never send the raw values, and never any content of your projects, prices, clients, or vendors. We send no signals at all for accounts created in the mobile app, and nothing you do inside the app is counted.

See the Cookie Policy for details.

Babel LLC is registered in the United States, while your data is primarily stored on servers located within the European Union (Ireland). Some service providers may process data in other regions. This means your data may be transferred and processed internationally, including in the European Union and the United States. Several of the providers listed in Section 4 are based in the United States and may process data there, including Stripe, Resend, Sentry, Expo, Google, and Meta, as well as DeepInfra for files read by AI (Section 5). We take reasonable steps to protect your data wherever it is processed.

You have the right to access, correct, and delete your personal data, to object to certain processing, and to withdraw consent. To exercise any of these rights, contact us and we will respond within the period required by law.

We retain your data while your account is active and, after closure, for as long as needed to meet legal obligations, resolve disputes, and enforce our agreements — after which we delete it or render it anonymous.

You can delete your account yourself at any time: in the Myzan app under More → Settings → Delete account, and on the website under Settings → Delete account; the steps are at myzan.co/en/account/delete. The account is deleted as soon as you confirm, and this cannot be undone. If you cannot sign in, contact us at hello@myzan.co or on WhatsApp. When we delete it, we delete your account and the data linked to it, including the files you uploaded, and cancel any paid subscription right away, with no refund for the time left. We keep only what we need to meet a legal obligation or protect the Service, including payment records without your name, email or phone number, and the copies used to improve AI reading as described in Section 5. What you entered in another office as a member of its team stays with that office, and service providers keep data under their own policies.

The Service is intended for professionals and is not directed to anyone under 18. We do not knowingly collect data from minors.

We apply reasonable technical and organizational measures to protect your data. However, no system can be guaranteed 100% secure, and we encourage you to keep your login credentials confidential.

For any privacy question or request, contact us at hello@myzan.co.