Privacy policy

Last updated 18 October 2026

MatMax Connect helps households record and share their expenses. MatMax Consulting, Luxembourg ("we") is the controller of the personal data described here. This policy explains what we collect, why, where it is stored and the rights you have under the GDPR.

What we collect

Account: your email address, the password you choose (stored only as a secure hash by our authentication provider), your name and, if you choose one, a profile photo (only you can see it) or an illustrated avatar (the members of your households can see it).

Household data: the households you create or join, their members (including people without an account, such as children, by first name), categories, budgets, bills, subscriptions, trips and the expenses you record or confirm.

Documents: receipts, invoices and statements you choose to scan or upload, and the details read from them (merchant, amounts, dates, line items).

Device: a push notification token if you turn on notifications, and the app lock setting. Face ID is handled by your phone; we never receive biometric data.

Location: with your permission, MatMax Connect uses your current approximate location when you save an Apple Pay payment to add its city and country to the expense. It stores the city and country, not your coordinates. Location can also fill in a household's country and city during setup. You can deny location access and still save the expense without a location.

Apple Pay payments: if you set up the Record payment shortcut, the merchant, amount and card name of each Apple Pay payment are kept on your phone until you save them as an expense or discard them.

Error reports: when something fails in the app, a technical report (the error message, the app version and the phone model) is sent to us so we can fix it. It never contains your documents or what was read from them.

Why we use it

To provide the service you ask for (performance of a contract): keeping your household records, reading documents you add, sharing expenses with the people you choose, reminders and notifications.

To keep the service secure and working (legitimate interest): preventing misuse, fixing errors and retrying documents that could not be read.

We do not sell your data, show advertising or build marketing profiles.

Reading your documents

Receipts, invoices and statements are read on your phone. Apple Vision (iPhone) or ML Kit (Android) recognises the text, and on iPhones with Apple Intelligence its on-device model helps interpret it. Unless you allow cloud reading (below), the recognised text never leaves your phone; only the details are saved to your household. The original file is kept only while it waits for your review and is deleted within a day after you confirm it, so keep the paper or PDF if you need it. If you connect a folder of your own in Save my receipts (for example in iCloud Drive or Google Drive), your phone copies each original there before you confirm it; we cannot see that folder. Nothing is saved as an expense until you confirm it, unless you turn on Auto Confirm.

Travel documents: boarding passes, hotel reservations and transport tickets are read on your device with Apple Vision or Android ML Kit, including local QR and barcode recognition. On supported iPhones, Apple Intelligence may help interpret the recognized text on-device. The source file is not uploaded to MatMax Connect or an external AI service; only itinerary details you review and save are stored. Do not scan passports or identity documents.

Cloud reading (optional, off until you allow it): when your phone cannot read a document with confidence, for example a format it does not know, the text it recognised is sent to an AI model run by Cloudflare, Inc. Card numbers, bank account numbers, e-mail addresses and phone numbers are removed first, and the image or file is never sent. Cloudflare does not use it to train models and does not keep it; MatMax keeps only a daily count of requests. You can switch it off at any time in More → AI & Automation; it applies to the phone where you set it.

To show merchant logos, our server may fetch the logo from the merchant’s own website when it is printed on a document, or look it up through Google’s favicon service. These requests contain no personal data.

When you save a hotel or activity with a place name and address, we send that text to Google Places to find a matching preview photo. The travel document itself and your device location are not sent. Place photos are copied to our private storage and shown only to people who can view that trip, with the photo attribution supplied by Google.

Who else processes your data

Product barcode lookup: if a scanned product is not already saved in your lists, the app sends its barcode and your app language directly to Open Food Facts to suggest a product name and category. This service also receives your IP address as part of the connection. Camera images, account details and household lists are not sent. You can enter the product manually instead. Product data is provided by Open Food Facts under the Open Database License (ODbL); suggestions may be incomplete or incorrect and must be reviewed before saving.

Supabase (database, file storage and sign-in), hosted in the European Union (Ireland).

Apple and Google provide on-device financial and travel document recognition; the documents are not sent to an external AI service for reading.

Apple Intelligence may interpret financial or travel text on supported iPhones; its model runs on-device.

Cloudflare, Inc. (Workers AI) for cloud reading, only if you allow it. Cloudflare may process this text outside the EU, under its data processing addendum and the European Commission’s standard contractual clauses.

Google Places processes hotel and activity names and addresses only when we search for a place photo.

Expo, Apple and Google for delivering push notifications.

Apple, Google and RevenueCat for subscriptions: the stores take the payment; RevenueCat tells us whether your household’s subscription is active. We never see your card details.

Your email provider and our email delivery provider for sign-in links and invitations.

Exchange rates come from the European Central Bank through the Frankfurter service; these requests contain no personal data.

Some of these providers may process data outside the EU. When they do, transfers rely on the European Commission’s adequacy decisions or standard contractual clauses.

Sharing inside the app

Members of a household see that household’s data according to their role. When you share a trip, the people you invite see only that trip’s shared costs and payments, never the rest of your household.

How long we keep it

We keep your data while your account exists. We do not keep your documents: an original file is deleted within a day after you confirm it, and one never confirmed is deleted 12 months after you add it. The expense and the details read from it stay. You can delete expenses, documents and photos at any time. When you delete your account in Profile → Delete account, your account, your profile photo and the households only you use are deleted with their documents. In households you joined, what you recorded stays with that household. Backups are overwritten within our provider’s retention period.

Your rights

You can access, correct, export or delete your data, object to or restrict its processing, and withdraw consent where we rely on it. Most of this is available in the app (More → Export my data exports your household’s expenses); for anything else write to us at the address below.

You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD) in Luxembourg or the authority where you live.

Security

Data is encrypted in transit and at rest. Access in the database is limited to the members of each household, files are private and opened through short-lived links, and you can lock the app with Face ID.

Children

Accounts are for people aged 16 or older. A parent may add children to a household by first name; they do not get an account.

Changes and contact

We will tell you in the app about important changes to this policy. Questions or requests: contact@matmaxconsulting.com.

© 2026 MatMax Consulting · Your business, connected.