Privacy policy

1. Who is responsible for your data

Monexa Hub is the controller of the personal data processed in the service. For any privacy matter, including exercising your rights, write to [email protected].

2. Data we collect

• Account: name, email and password — the password is stored only as a hash, never in plain text. If you sign in with Google or GitHub, we receive the name, email and profile picture they provide.
• Financial data you enter or import: portfolios, trades, options operations, dividends, goals, analyses and tax settings.
• B3 integration (optional): CPF and password for the B3 Investor Area, stored encrypted. The B3 verification code is typed by you; we do not access your email inbox.
• Payments: Stripe processes billing. We do not receive or store card details; we only keep the customer and subscription identifiers and your plan status.
• Technical usage: error logs (page, browser and error message), the feedback you send and, in the mobile app, the notification token.

3. How we use it

• To provide the service: calculate positions, returns, dividends, reports and income tax support.
• To sync your B3 account, when you enable the integration.
• To bill and manage your subscription.
• To send the notifications you configure.
• To provide support, fix errors and protect the service against abuse.

We do not sell your data and we do not use it for advertising.

4. Legal bases

We process data based on the performance of the contract (providing the service you signed up for), compliance with legal obligations (for example, billing records), legitimate interest (security and service improvement) and, where required, your consent — which you may withdraw.

5. Who we share it with

We share data only with providers needed for the service to work, each limited to its role:

• Stripe — payment processing;
• Railway — hosting of the application and database;
• Cloudflare — network, delivery and protection of the website;
• Google and GitHub — sign-in, only if you choose to use them;
• Expo — delivery of notifications in the mobile app;
• B3 — your credentials are used only to access your own account in the Investor Area.

6. International transfers

Some of these providers process data outside Brazil. In those cases, the transfer follows the safeguards set out in the LGPD (Brazil's General Data Protection Law) and each provider's data protection commitments. Quote and market data providers receive only asset codes, never personal data.

7. Cookies and local storage

We use one essential cookie to keep you signed in and the browser's storage to remember preferences such as theme and language. We do not use advertising or tracking cookies.

8. Security

We use encrypted connections (HTTPS), passwords stored as hashes and encryption of B3 credentials. No system is completely immune to failure; if an incident affects your data, you and the authorities will be notified as required by law.

9. How long we keep it

We keep your data while your account exists. If you ask for deletion, we delete it, except for what the law requires us to keep for a period — such as billing records.

10. Your rights

Under the LGPD, you can at any time:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary data;
• request portability of your data;
• request deletion of your account and your data;
• find out who we share your data with;
• withdraw consent, when consent is the basis for processing.

11. How to exercise your rights

Write to [email protected] from your account's email address. Account deletion is not yet available inside the app, so it is done through this request. If you live outside Brazil, we also respect the equivalent rights under the law of your country, such as the General Data Protection Regulation (GDPR) in the European Union. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or with the authority in your country.

12. Minors

Monexa Hub is not intended for people under 18 and does not knowingly collect their data.

13. Changes to this policy

We may update this policy. Material changes will be announced in the app or by email. The date of the last update is shown at the top of this page.