Privacy Policy
Version of 28 September 2026
This policy explains what personal data the Armoneda app processes, why, who we share it with and what rights you have. If this English version and the Romanian version differ, the Romanian version prevails.
1. Who the controller is
The data controller is Rădoi Florin Gabriel, a natural person, author of the Armoneda app.
- Address: Strada Popești-Vest nr. 15, et. 4, ap. 63, Popești-Leordeni, Ilfov County, postal code 077160, Romania
- General contact: contact@armoneda.com
- Personal data requests: privacy@armoneda.com
If the service is taken over by a legal entity (a sole proprietorship or a company), we will let you know and ask you to accept the new version of this policy.
2. What data we process
- Account data: name, email address, password (stored only in an irreversible cryptographic form), language, currency and other preferences.
- Financial data you enter or import: accounts, balances, transactions, categories, budgets, due payments, goals, investments and debts.
- Bank data through PSD2 connections: if you connect your banks, we receive their accounts, balances and transactions through the bank connection provider listed in section 5. We never see or store your bank login credentials.
- Documents: invoices, receipts and statements you upload. If you connect an email mailbox, the app searches it for messages with invoices and saves the ones it finds; the mailbox app password is stored encrypted.
- Your conversations with the Harmon assistant, if you use it.
- Technical data: IP address and device and browser type for active sessions, security and error logs.
- Subscription payment data: payments are processed by Stripe. We never see or store your card number; we only receive the payment confirmation and the details needed to record it.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service: your account, budget, bank connections, documents, shared household, collecting the subscription | performance of a contract — Art. 6(1)(b) |
| The Harmon assistant (AI) | your consent — Art. 6(1)(a); you can withdraw it at any time by turning Harmon off in Settings |
| Keeping the tax and accounting records of payments | legal obligation — Art. 6(1)(c) |
| Security of your account and of the server, abuse prevention | legitimate interest — Art. 6(1)(f) |
We do not use your data for advertising and we do not sell it.
4. The Harmon assistant and data sent to AI
Harmon uses artificial intelligence models from Anthropic or OpenAI. We send Anthropic or OpenAI only the data needed for the answer, without your name, email, IBANs or card numbers. The providers do not use it to train their models.
Specifically, before sending, the app replaces on our server the names of household members and of people in bank descriptions, IBANs, card numbers, personal identification numbers, email addresses, phone numbers and postal addresses with codes (pseudonymisation). The answer is translated back, also on our server. PDF documents (invoices, statements) are not sent to AI providers.
This data is still personal data: transactions, amounts and merchants can be linked to a person. The providers may keep it temporarily, under their own policies, to prevent abuse.
Harmon does not change anything in the app without your explicit approval, for each action.
5. Who we share data with
We share data only with the providers we need for the service, each receiving only the data required for its role:
| Provider | Role | Where it processes |
|---|---|---|
| OVHcloud | the server running the app, the database and the (encrypted) backups | France (EU) |
| Enable Banking Oy | bank connections via PSD2 | Finland (EU) |
| Anthropic | AI models used by Harmon | USA |
| OpenAI | AI models used by Harmon | USA |
| Stripe | subscription payment processing | EU and USA |
| OVHcloud | sending the app's emails (confirmations, notifications) and the contact mailboxes | EU |
The app does not currently use third-party behaviour analytics or error monitoring services. If we add or change a provider, we publish a new version of this policy and ask you to accept it.
Members of your household see the data you choose to share with them, according to each account's sharing rules.
External agents you connect: if you create API keys or connect an external assistant to your account, the data that assistant reads reaches it without pseudonymisation, under your control and responsibility.
We disclose data to authorities only when the law requires us to.
6. Transfers outside the EU
Anthropic, OpenAI and, in part, Stripe process data in the USA. These transfers rely on the mechanisms provided by the GDPR (the EU–US adequacy decision for certified companies or the standard contractual clauses approved by the European Commission), as applicable.
7. How long we keep data
- For as long as your account is active.
- When you delete your account, it is deactivated immediately and the data is permanently deleted after 30 days. Until then you can come back and reactivate it. Backups rotate within the same interval.
- Subscription payment records are kept for as long as tax and accounting laws require.
- Technical and security logs are kept for a limited period and then deleted automatically.
8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing and to data portability, to object to processing based on legitimate interest and to withdraw your consent for Harmon at any time. You can export part of your data directly from the app (Documents › Exports).
For any request, write to privacy@armoneda.com. We reply within one month; for complex requests this can be extended by two further months, in which case we will let you know.
You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro, or with the supervisory authority in your country of residence.
9. Security
The connection to the app is encrypted (HTTPS), passwords are stored only in an irreversible cryptographic form, and sensitive data (for example, bank connections and mailbox app passwords) is encrypted in the database.
10. Cookies
We use only strictly necessary cookies: your login session and display preferences. We do not use analytics or advertising cookies.
11. Changes
Each version of this policy is dated. When we change it, we show you the new version at your next sign-in and ask you to accept it before you continue.