MoneyKeep is operated by Zeta Pegasi Labs Pte. Ltd. (UEN 202636586D), 152 Beach Road #23-02 Gateway East, Singapore 189721.
Effective: July 25, 2026 · Last updated: 14 October 2026
MoneyKeep collects only the data necessary to provide personal finance tracking services: the email address you sign up with (or the WhatsApp number of an account that joined before the channel closed), the date and version of the terms you accepted, transaction data from the bank statements and spreadsheets you upload, and the budgets, goals and accounts you configure.
If you send a voice note or use the microphone in the web app, we also process a recording of your voice. It is turned into text and then dropped — we never write it to disk and keep no copy. Only the text is saved, as part of your conversation history, and you can delete that history at any time.
Your financial data is stored in a separate database belonging to you alone. Encryption is required: before you can use the app or the bot you set a passphrase, and your database is encrypted at rest with AES-256-GCM using a key derived from it. We hold neither the passphrase nor the key, and the data is decrypted only during your active session, so our own team cannot read the contents of your financial data.
That requirement has a price, and we say it plainly: the passphrase is yours alone, so if you forget it we cannot recover your data — not a policy we chose, but a consequence of not holding the key. You acknowledge this when you create your account.
An account created before encryption became required (26 August 2026) and not used since stays as it was until its owner returns, when setting a passphrase is the first thing shown.
We use your data to: analyze spending, provide budget recommendations, and generate personal reports.
We never sell your data, we never rent or trade it, and we never use it for advertising or to train AI models. Running the Service does mean sending some of it to a small number of providers who work on our behalf — they are named individually below, because "we share it with no one" would not have been true.
We share only what is necessary, with providers acting as processors on our behalf under contractual obligations:
Some of these providers are located outside Singapore, which means a cross-border transfer of data. By using the Service you consent to that transfer to the extent necessary to operate it. We disclose your data to no one else unless required by law or a judicial order.
What is never sent to any of them: your encryption passphrase, the keys to your financial database, and the database file itself — no processor ever receives your complete financial records. What is sent is set out above, processor by processor: the PDF statement to the extraction provider, and the transaction data needed to answer a question to the AI provider.
In the web app the text transcribed from your voice is placed in the message box for you to read, and nothing is sent until you press send. It is a proposal, not a submission: if the transcription is wrong you edit it or delete it, and words you never said never enter your record. Anything you had already typed is kept — the transcript is added to it rather than replacing it.
We never save the statement file you upload. It is held in memory, passed to the extraction provider, and dropped; what we keep is the transaction data extracted from it.
The file itself stays with that provider for 90 days and is then deleted. That 90 days is a setting we choose on our own mailbox there, not a schedule it imposes on us — we say so because a policy that hands a processor the responsibility for a setting its customer controls sends the reader to the wrong party to ask. Its own policy says a deleted document leaves its active systems immediately and its backups within 45 days.
An account that ends without a plan is deleted by us, on a schedule: an account whose free trial ended without a payment is deleted 32 days after the trial ended, and an account that has ever paid is deleted 90 days after its last paid month ended. That deletion is the same one described below; a plan keeps the data, and deleting it sooner is yours to do at any time.
You can delete everything at any time — in the web app under Settings → Delete my account, or by sending DELETE ALL MY DATA to the bot. Both run the same code, because this product has one deletion path and no second one. Your financial database and its salt, your logins, every active session and the account record itself are removed immediately, along with the copies most products forget: if two of your accounts were ever merged, the retired side's database and the snapshot kept to make that merge reversible go too, so no readable duplicate is left anywhere.
Backups are the one exception, and we would rather state it exactly than round it off:
Backups are never opened, searched or edited to remove one account, and nothing is ever restored from them to rebuild an account you deleted; they are only ever used to bring the Service back after a failure. A backup carries exactly the encryption the live file had: if you switched encryption on, the copy is unreadable to us as well; if you did not, the copy is no better protected than the original.
This policy is published in English, and the English text is the one that applies.
For privacy questions: info@zetapegasilabs.com