Privacy policy

The data controller is money positive, represented by Christopher Ribaud, 7 clos de Pomponne, 77400 Pomponne, France. Privacy contact: contact@moneypositive.org.

Depending on how you use the service, we process: your name, email address, account identifiers and sign-in records; the financial information, goals, preferences and coaching notes you choose to enter; quiz answers and progress; messages sent to support; payment status and transaction references; and limited technical and audience-measurement data.

Passwords are handled by the authentication provider and are not visible to money positive. Payment card details are handled by Stripe and are not stored by money positive.

We use data to create and secure your account, provide and personalise the tools and coaching you request, save your progress, process payments, send essential account emails, answer enquiries, prevent misuse, meet legal obligations and improve the service.

These activities rely, as applicable, on performance of a contract, steps requested before entering a contract, legitimate interests in operating and securing the service, legal obligations, or your consent. Marketing messages are sent only where a valid legal basis exists and you can opt out at any time.

Access is limited to money positive and providers needed to run the service: Lovable for website hosting, Supabase for database and authentication, Resend for transactional email, Stripe for payments, and Umami for audience measurement. Providers act under their own legal and security obligations and only receive data needed for their role.

Newsletter: if you subscribe to occasional insights, your email address, language, the page you subscribed from and the time of consent are stored in our database (Supabase) and sent to Brevo (Sendinblue SAS, France), which we use to send these emails. You can unsubscribe at any time via the link in every email; your contact is then removed or marked as unsubscribed.

Some providers may process data outside the European Economic Area or use international infrastructure. Where required, transfers are covered by an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard. Provider privacy documentation contains current location and safeguard details.

Account and financial data are kept while your account is active and then deleted or anonymised when no longer required, subject to legal, security and backup periods. Payment and accounting records are kept for the period required by law. Support messages and technical logs are retained only as long as reasonably needed for support, security and dispute handling.

The service uses local storage and similar technologies for sign-in, language, theme, progress and security preferences. Umami is used to measure website use and product events. You can limit browser storage in your browser settings, but essential account features may then stop working.

Reasonable technical and organisational safeguards are used, including encrypted connections, authenticated access and access controls. No online service can guarantee absolute security. If a personal-data breach creates a legally reportable risk, the competent authority and affected people will be notified as required.

Under the GDPR, where applicable, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Contact contact@moneypositive.org. Identity may be verified where reasonably necessary. You may also complain to the CNIL at cnil.fr or to your local supervisory authority.

The service is not intended for children under 15. If you believe a child has provided personal data, contact us so it can be reviewed and deleted where appropriate.

This policy may be updated when the service, providers or legal requirements change. The date above identifies the current version. Significant changes affecting account holders will be communicated through an appropriate channel.