Privacy policy

1. Who is responsible for your data

Monexa Hub is the controller of the personal data processed in the service. For any privacy matter, including exercising your rights, write to [email protected].

2. Data we collect

• Account: name, email and password — the password is stored only as a hash, never in plain text. If you sign in with Google, we receive the name, email and profile picture it provides.
• Financial data you enter or import: portfolios, trades, options operations, dividends, goals, analyses and tax settings.
• My Finances (optional): the transactions read from the bank statements and card bills you import (date, description, amount and account), your accounts and cards, categories, monthly plan, savings goals and the names of family members you add. The imported file itself is not kept — only the transactions read from it.
• B3 integration (optional): CPF and password for the B3 Investor Area, stored encrypted. The B3 verification code is typed by you; we do not access your email inbox.
• Payments: Stripe processes billing. We do not receive or store card details; we only keep the customer and subscription identifiers and your plan status.
• Website browsing (optional): on public pages — home, plans, what's new, documents, sign-up and sign-in —, if you accept in the cookie notice, Google Analytics records the pages visited, where you came from, your device, browser and approximate location — and, if you create an account, that the sign-up happened, so we know whether it came from one of our Google ads. Nothing inside the application is measured.
• Technical usage: error logs (page, browser and error message), the feedback you send and, in the mobile app, the notification token.
• Files Monexa could not read: when a brokerage note, bank statement or card bill fails to import, we keep an encrypted copy for up to 30 days, only so support can fix how it is read. After that it is deleted.

3. How we use it

• To provide the service: calculate positions, returns, dividends, reports and income tax support.
• To sync your B3 account, when you enable the integration.
• To organize your personal finances, when you use My Finances: categorize transactions, build the monthly plan, forecast your balance and answer the questions you ask the assistant.
• To bill and manage your subscription.
• To send the notifications you configure.
• To provide support, fix errors and protect the service against abuse.
• To understand, in aggregate, how people reach the website and how many create an account, including how many came from our Google ads — only with your consent.

We do not sell your data and we do not use it to show you ads, here or on other websites.

4. Legal bases

We process data based on the performance of the contract (providing the service you signed up for), compliance with legal obligations (for example, billing records), legitimate interest (security and service improvement) and, where required, your consent — which you may withdraw.

5. Who we share it with

We share data only with providers needed for the service to work, each limited to its role:

• Stripe — payment processing;
• Railway — hosting of the application and database;
• Cloudflare — network, delivery and protection of the website, and anonymous visit counting, without cookies;
• Google — sign-in, only if you choose to use it; and Google Analytics, on public pages, only if you accept analytics cookies. Google Ads receives from Analytics only the count of sign-ups that came from our ads, to measure the campaigns;
• Expo — delivery of notifications in the mobile app;
• Anthropic — the artificial intelligence behind My Finances. To suggest a category, it receives the description, amount and type of each transaction (Pix and transfers are not sent). For the assistant, it receives your question and the numbers computed to answer it, such as totals by category and by merchant. It never receives your name, email or CPF, and does not use this data to train models;
• Amazon Web Services — delivery of account emails, such as sign-up confirmation and password recovery. It receives your email address and the content of the message;
• B3 — your credentials are used only to access your own account in the Investor Area.

6. International transfers

Some of these providers process data outside Brazil. In those cases, the transfer follows the safeguards set out in the LGPD (Brazil's General Data Protection Law) and each provider's data protection commitments. Quote and market data providers receive only asset codes, never personal data.

7. Cookies and local storage

We use one essential cookie to keep you signed in, one cookie that stores your answer to the cookie notice, and the browser's storage to remember preferences such as theme and language.

If you arrived through a partner link (an /r/… address), we store that partner's code — and the link's channel, when there is one — in two cookies (monexa_ref and monexa_ref_ch) for up to 60 days. They are used only to apply the partner's discount to your subscription and to record that the referral came from them; the partner only sees aggregate numbers, never your name or email.

On public pages, and only if you accept in the cookie notice, we use Google Analytics cookies (_ga) to measure visits and how many sign-ups come from our Google ads. We don’t use advertising or remarketing cookies: you won’t start seeing Monexa ads because you visited the website, and nothing inside the application is measured. Until you answer, nothing is loaded.

You can change your choice at any time through the "Cookie preferences" link in the footer of the home page. Your choice lasts 12 months; after that we ask again.

8. Security

We use encrypted connections (HTTPS), passwords stored as hashes and encryption of B3 credentials. No system is completely immune to failure; if an incident affects your data, you and the authorities will be notified as required by law.

9. How long we keep it

We keep your data while your account exists. If you ask for deletion, we delete it, except for what the law requires us to keep for a period — such as billing records.

10. Your rights

Under the LGPD, you can at any time:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary data;
• request portability of your data;
• request deletion of your account and your data;
• find out who we share your data with;
• withdraw consent, when consent is the basis for processing.

11. How to exercise your rights

Write to [email protected] from your account's email address. Account deletion is not yet available inside the app, so it is done through this request. If you live outside Brazil, we also respect the equivalent rights under the law of your country, such as the General Data Protection Regulation (GDPR) in the European Union. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or with the authority in your country.

12. Minors

Monexa Hub is not intended for people under 18 and does not knowingly collect their data.

13. Changes to this policy

We may update this policy. Material changes will be announced in the app or by email. The date of the last update is shown at the top of this page.