Privacy policy

1. Information We Collect

We collect information you provide directly, information generated through your use of the Service, and information from your devices. We do not connect to or retrieve data from external financial institutions — all financial data in HelloMula is entered manually by you or members of your household.

1.1 Account & Registration Information

When you create an account we collect:

• Full name and username
• Email address
• Password (stored only in a one-way encrypted form — we never store your password as readable text)
• Household name and structure (primary user, additional members)
• Time zone
• Account creation date and timestamp

1.2 Manually Entered Financial Data

The Service allows you to manually record and track personal financial information, including:

• Financial account names, types, and balances (e.g., checking, savings, credit cards, loans, investments)
• Credit limits and debt balances
• Transaction records including amounts, dates, categories, and descriptions
• Income and expense entries
• Recurring transaction schedules (e.g., rent, utilities, subscriptions)
• Budgets and budget category limits
• Savings goals, goal target amounts, and contributions logged toward goals
• Inputs you provide to Decision Lab analysis modules (e.g., occupation for salary benchmarking, tax filing status for tax estimates, retirement assumptions, property and vehicle scenario details)
• Optional: website URLs and login notes associated with financial accounts (stored at your discretion)

1.3 Household Member Information

If you invite additional members to your household, we collect their email addresses for invitation purposes and any profile information they provide upon accepting the invitation. You are responsible for ensuring you have appropriate consent before sharing another person’s information with us.

1.4 Communications

We collect messages sent between household members using the in-app messaging feature, as well as any communications you send to us directly (e.g., support requests).

1.5 Usage Data

When you use the Service, we automatically collect certain technical information, including:

• IP address
• Browser type and version
• Operating system
• Referring URLs and pages visited within the Service
• Date and time of access
• Time zone information (captured client-side at login)
• Session duration and feature usage patterns

1.6 Log Data

We maintain application and security logs for operational purposes. These logs record authentication events (logins, failed attempts, password resets), session activity, and error events. Log entries include timestamps, IP addresses, and session identifiers but do not include financial transaction details.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Operating the Service

• Creating and managing your account and household
• Displaying financial dashboards, reports, and summaries
• Processing and storing transactions and recurring schedules
• Enabling household member collaboration and messaging
• Authenticating your identity and maintaining secure sessions

2.2 Communications

• Sending transactional emails (account confirmation, password resets, household invitations)
• Sending service-related notifications and important policy updates
• Responding to your support requests and inquiries
• Sending marketing and promotional communications (you may opt out at any time)

2.3 Service Improvement

• Analyzing usage patterns to improve features and user experience
• Diagnosing technical issues and preventing errors
• Conducting internal research and analytics
• Developing new features based on user behavior and feedback

2.4 Security & Fraud Prevention

• Monitoring for unauthorized access and suspicious activity
• Enforcing login attempt limits and account lockout policies
• Investigating potential violations of our Terms of Service
• Complying with applicable legal obligations

2.5 Relevant Offers

We may use information in your account to choose which partner offers to show you. See Section 4.

3. How We Share Your Information

We do not sell your personal information to third parties. However, we may share your information in the circumstances described below.

3.1 Service Providers

We share information with trusted third-party vendors who help us operate the Service. These providers are contractually obligated to use your data only to perform services on our behalf and are prohibited from using it for their own purposes. Current service providers include:

• Email delivery: A transactional email service used to send password resets, invitations and account notices
• Payment processing: Stripe (subscription billing for paid plans). Your card details are collected and stored by Stripe, not by us — we retain only a payment reference and subscription status.
• Cloud infrastructure: Hosting and database providers used to run and store the application
• Analytics providers: Tools used to understand aggregate usage patterns

3.2 Household Members

Information you enter into the Service may be visible to other members of your household depending on their assigned role (Primary User or General User). Account balances, transactions, and reports are shared within the household by design. You control who is added to your household and at what permission level.

3.3 Business Transfers

If Hellomula LLC is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information becomes subject to a different privacy policy.

3.4 Legal Requirements

We may disclose your information if required to do so by law or in good faith belief that such action is necessary to:

• Comply with a legal obligation, subpoena, court order, or governmental request
• Protect and defend the rights or property of Hellomula LLC
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

3.5 With Your Consent

We may share your information for any other purpose with your explicit consent.

4. Offers & Third-Party Marketing

We may show you offers for financial products or services from partners, and we may be paid if you click on or sign up for one. We choose which offers to show using information in your account, and that matching happens within HelloMula. We do not give your personal or financial data to partners to do this. If you follow an offer, anything you provide on the partner’s site is covered by their privacy policy.

5. Financial Data

Because HelloMula is a financial management application, we recognize that the data you enter is particularly sensitive. We handle your financial data with the following commitments:

• No bank linkage: We never connect to or access your actual bank accounts, brokerage accounts, or other financial institutions. All data is manually entered by you.
• Household-scoped access: Your financial data is only visible to you and household members you have explicitly invited and assigned roles to.
• No data sale: We do not sell your individual financial records or transaction history to any third party.
• Secure storage: Financial data is stored in an encrypted database with access restricted to authorized application processes only.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service.

6.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Service to function, including keeping you signed in, confirming who you are, and verifying that form submissions genuinely came from you. These cannot be disabled.
• Functional Cookies: Remember your preferences such as time zone settings and display options.
• Analytics Cookies: Help us understand how the Service is used in aggregate so we can improve it. We use anonymized data only.

6.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Service. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set.

6.3 Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. We currently do not alter our data collection practices in response to DNT signals, as there is no consistent industry standard for their interpretation. We will update this section if our practices change.

7. Data Retention

We retain your personal and financial data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Active accounts: All data is retained for the duration of your account.
• Account deletion: When you delete your account, we will delete or anonymize your personal and financial data within 30 days, except where we are required to retain it for legal, regulatory, or fraud-prevention purposes.
• Security logs: Authentication and security event logs are retained for up to 12 months to support fraud prevention and security investigations.
• Backups: Anonymized or encrypted backup copies may persist for up to 90 days following deletion before being fully purged from backup systems.

You can delete your account at any time from the Privacy & Security tab of your profile (see Section 9.3).

8. Data Security

We implement a range of technical and organizational security measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. We use industry standards for data protection, including encryption, access controls, and regular security audits.

Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk. If you believe your account has been compromised, change your password from your profile right away, then contact us at support@hellomula.com.

9. Your Rights & Choices

Regardless of where you live, you have the following rights with respect to your personal information:

You can exercise most of these rights yourself, at any time, from your profile in the Service.

9.1 Access

Everything you enter into the Service is available to you in the Service at any time. To get a copy, use the download described in Section 9.4.

9.2 Correction

You can edit your name and email address on your profile, and edit or delete any account, transaction, budget, or goal you have entered.

9.3 Deletion & Account Closure

You can delete your account from the Privacy & Security tab of your profile. Your account is removed 30 days after you confirm; until then everything keeps working, and you can cancel with the Keep my account button. After removal, your data is deleted as described in Section 7. If you are the Primary User of a household that still has other active members, those members need to be removed before you can delete your account.

9.4 Portability

You can download your accounts, transactions, recurring schedules, budgets, and goals at any time, as a ZIP of CSV files, from the Privacy & Security tab of your profile.

9.5 Opt-Out of Marketing

You can unsubscribe using the link in any email we send, or turn emails on and off from the Notification Preferences tab of your profile.

For anything you cannot do yourself, such as a copy of other information we hold about you, contact us at support@hellomula.com. We will respond to verified requests within 30 days.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights regarding your personal information.

10.1 Categories of Personal Information Collected

In the past 12 months we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, username, IP address
• Financial information: Manually entered account balances, transaction records, and financial account types
• Internet or network activity: Browser type, pages visited, session data
• Geolocation data: General location inferred from IP address or time zone
• Inferences: Profiles drawn from the above to understand financial preferences

10.2 Your CCPA Rights

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell
• Delete personal information we have collected (subject to certain exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Limit the use and disclosure of sensitive personal information
• Non-discrimination for exercising your privacy rights

10.3 Submitting a Request

You can download, correct, or delete your data yourself as described in Section 9. To submit any other verifiable consumer request, contact us at support@hellomula.com. We will acknowledge receipt within 10 business days and respond within 45 calendar days. We may extend this period by an additional 45 days where necessary, with prior notice.

10.4 Authorized Agent

You may designate an authorized agent to submit requests on your behalf. We may require written authorization and proof of identity to verify the request.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or applicable local law may grant you additional rights.

11.1 Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have signed up for
• Legitimate interests: Security monitoring, fraud prevention, and Service improvement where our interests are not overridden by your rights
• Consent: Marketing communications (you may withdraw consent at any time)
• Legal obligation: Where required by applicable law

11.2 Your GDPR Rights

In addition to the rights described in Section 9, you may also have the right to:

• Restrict processing of your personal data in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent at any time without affecting the lawfulness of prior processing
• Lodge a complaint with your local supervisory authority

11.3 International Data Transfers

Your information may be stored and processed in the United States or other countries where our service providers operate. When transferring data outside the EEA, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

12. Children’s Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@hellomula.com and we will take steps to delete such information promptly.

Users between the ages of 13 and 18 may only use the Service under the supervision of a parent or legal guardian who agrees to be bound by these terms on their behalf.

13. Third-Party Links

The Service may contain links to third-party websites or services, including financial institutions or other services you optionally associate with your accounts. This Privacy Policy applies only to our Service. We are not responsible for the privacy practices of third-party websites, and we encourage you to review their privacy policies before providing any information to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the “Effective Date” at the top of this policy
• Notify you via email to the address associated with your account
• Display a prominent notice within the Service for at least 30 days

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using the Service and can delete your account (see Section 9.3).

We encourage you to review this policy periodically. Previous versions of this Privacy Policy are available upon request.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You can download or delete your data yourself from your profile (see Section 9). For any other privacy request, email us with the subject line “Privacy Request” and include your account email address. We will respond within 30 days.