Log in Start 14 days free14 days free

Privacy Policy

Last updated: 14 October 2026

Your privacy matters to us. This Privacy Policy explains how your personal data is collected, used and protected when you use Moneylights.

1. Who we are

Moneylights is a registered brand developed by Borlantrix OÜ, a company registered in Estonia, European Union. Borlantrix OÜ is the entity responsible for processing the personal data collected through the Moneylights platform, in accordance with the General Data Protection Regulation (GDPR). Data controller: Borlantrix OÜ, Estonian Commercial Register no. 17322848, Tööstuse tn 75-71, 10416 Tallinn, Estonia. Email: hello@moneylights.ai.

2. What data we collect

Depending on how you use Moneylights, we may collect the following data:

  • Identification data: name, email address, company
  • Contact data submitted through forms
  • Technical data: IP address, device type, browser, operating system
  • Browsing data on the public moneylights.ai website, only if you accept analytics or advertising cookies: cookie identifiers, how you reached the site (for example, the Google ad click identifier, gclid, and UTM campaign parameters), pages visited, and information about your device and browser.
  • Sign-up source, only if you accepted Analytics on the website: campaign parameters (UTM), the domain of the site you came from, the first page you visited, the plan given in the sign-up link and, with Advertising, the ad click identifier, linked to your account. See section 9.
  • Financial data in read-only mode only, obtained via Open Banking (e.g. transactions, balances, bank accounts)
  • Financial documents uploaded or linked to transactions (e.g. invoices)
  • Billing and subscription data. Payment card data is collected and processed directly by Stripe — it never passes through Moneylights systems.

We never collect banking credentials or any data that would allow money to be moved.

3. How we use the data

Your data is used to:

  • Provide and improve the Moneylights platform
  • Consolidate and present financial information
  • Organise documentation linked to transactions
  • Deliver the artificial-intelligence assistant features (the assistant's answers are based on your organisation's data; your data is not used to train AI models)
  • Communicate with you about your account, support or relevant service information
  • Comply with legal and regulatory obligations
  • Produce website usage statistics and measure the results of our advertising campaigns, only with your consent and only with data from the public website. If you create an account, know which campaigns bring customers by keeping the sign-up source with your account (see section 9), also only with your consent. We do not use this data to show you personalised ads.

Financial data obtained via Open Banking, documents and the data you enter in the platform are never used for advertising, nor shared with advertising or measurement partners.

4. Open Banking and bank access

Access to bank accounts is carried out exclusively through certified Open Banking, in compliance with the European PSD2 directive. Moneylights has read-only access to bank accounts:

  • It does not move money
  • It does not initiate payments
  • It does not carry out banking operations

You always remain in control and can revoke access at any time with your bank or within the platform itself.

5. Data sharing

Your data may only be shared with:

  • Technology service providers required to run the platform (namely cloud hosting, payment processing, email delivery and artificial-intelligence services)
  • Certified Open Banking partners
  • Google Ireland Limited, for website statistics and campaign measurement, only with your consent and only with browsing data from the public website. It never receives financial data or platform data.
  • Legal authorities, when required by law

We never sell personal data to third parties.

6. Storage and security

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption
  • Access control
  • Information security best practices

Data is stored on secure infrastructure located in the European Union or in jurisdictions with adequate data-protection guarantees. Some providers, such as Google, may process data outside the European Economic Area, notably in the United States. In those cases the transfer relies on the EU-U.S. Data Privacy Framework, for certified companies, or on the Standard Contractual Clauses approved by the European Commission.

7. Your rights

Under the GDPR, you have the right to:

  • Access your personal data
  • Request its rectification or erasure
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent at any time

To exercise your rights, contact us at the email address given below. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (Tatari 39, 10134 Tallinn, Estonia, www.aki.ee), or with the supervisory authority in your country of residence.

8. Data retention

Data is kept only for as long as necessary to fulfil the purposes described in this policy or legal obligations. Retention periods for analytics and advertising cookies are set out in section 9.

9. Cookies, analytics and advertising measurement

Cookies. The use of cookies on the Moneylights website is described in detail in the Cookie Policy, available at /cookies/.

Two separate choices. In the cookie banner you can accept or reject two categories independently:

  • Analytics (Google Analytics 4, by Google): website usage statistics (for example, pages visited and where visits come from), so we can see what works and improve the site. If you create an account in the app, it also covers the sign-up source, so we know which campaigns bring customers (see below).
  • Advertising (Google Ads, by Google): measuring the results of our ads, for example how many people reach the site through an ad and how many start the free trial. We do not use Google Ads to show you personalised ads or to build remarketing lists. If you create an account, it also covers the ad click identifier in the sign-up source.

Nothing before consent. Until you make your choice, Google Analytics and Google Ads are not loaded: no analytics or advertising cookie is set and no data is sent to Google. Each tool is only activated after you accept the corresponding category. Rejecting one or both does not affect how the website works.

Legal basis. Your consent (Article 6(1)(a) GDPR, together with the EU rules on cookies, which Estonia applies through its Electronic Communications Act). The sign-up source is also based on your consent.

What data. Cookie identifiers (_ga, _ga_<ID>, _gcl_au and, if you arrive through a Google ad, _gcl_aw, _gcl_gb or _gcl_ag) and the equivalent information Google Ads keeps in your browser's local storage (_gcl_ls), the Google ad click identifiers (gclid, gbraid and wbraid), campaign parameters (UTM), pages visited, date and time, and technical information about your device and browser (type, operating system, language and IP address, used for the connection and not stored by Google Analytics). We never send financial data, balances, transactions, documents or platform data to Google or to any other advertising or measurement partner.

Sign-up source. If you accepted Analytics on our website and then create an account in the Moneylights app, we keep with your account how you reached us: campaign parameters (UTM), the domain of the site you came from, the first page you visited on our site and the plan given in the sign-up link, if any. If you also accepted Advertising, we also keep the Google ad click identifier (gclid, gbraid or wbraid). We use this to know which campaigns bring customers. If you did not accept Analytics, we keep none of this. We only keep the sign-up source for accounts created after this feature is switched on. The legal basis is your consent (Article 6(1)(a) GDPR). This data is kept only in our database, with your account, and is not shared with advertising partners or with our payment provider (Stripe). We keep it for 24 months from sign-up, or until you delete your account or withdraw your consent, if that happens first; it is then deleted. To withdraw your consent for data already linked to your account, use the “Sign-up source” option in your account settings in the app or write to hello@moneylights.ai. Changing your choice under “Manage cookies” means our website stops telling the app, from that browser, that you accepted Analytics, and no new sign-up source is kept. If you then follow a sign-up link from our site, the app also deletes any sign-up source still waiting to be sent. If you don't, that sign-up source is still sent when you sign in (at most 7 days later), and you can delete it in your account settings.

How the sign-up source reaches the app. If you accept Analytics, our website keeps the campaign parameters of your visit in your browser's session storage (ml-first-touch) and, if you also accept Advertising, the ad click identifier, so the sign-up link can carry them to the app even if you browse other pages of the site. When the sign-up source is active, it also keeps the domain of the site you came from and the first page you visited. This data is deleted when you close the tab, or when you reject or withdraw consent under “Manage cookies”. If you reach the app's sign-up page (moneylights.app) through a link from our site that says you accepted Analytics, the app keeps this data in your browser's local storage (ml-signup-attribution) until you finish signing up and it is linked to your account, for at most 7 days. Details are in the Cookie Policy.

Withdrawing consent. You can change or withdraw your consent at any time under “Manage cookies” in the footer. From then on we stop collecting data for that purpose and delete the cookies of that category that Google set on our domain. This does not affect processing carried out before you withdrew consent. You can also clear this site's data in your browser settings, which also removes your stored choice. Cookies that Google sets on its own domains (such as GCL_AW_P) are managed by Google: you can control your ad settings at https://adssettings.google.com (My Ad Center) or delete them in your browser.

How long your choice lasts. We store your choice in your browser for 12 months. After that, we ask again.

Retention. The _gcl_au, _gcl_aw, _gcl_gb, _gcl_ag and GCL_AW_P cookies (Google Ads) last 90 days. The _ga and _ga_<ID> cookies (Google Analytics) last up to 2 years, but some browsers shorten this (Chrome, for example, caps cookies at 400 days). Usage data in Google Analytics is kept for 2 months. _gcl_ls stays in your browser until you withdraw consent.

Recipient and role. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). For Google Analytics, Google processes the data on our behalf, as a processor. For Google Ads (conversion measurement), Google acts as an independent controller under its data protection terms for advertisers, and in line with its privacy policy (https://policies.google.com/privacy).

International transfers. Google may transfer data to the United States. Those transfers rely on the EU-U.S. Data Privacy Framework, for certified companies, and on the European Commission's Standard Contractual Clauses.

10. Contact

For any questions relating to this Privacy Policy or to your personal data, you can contact us at:
Email: hello@moneylights.ai

11. Changes to this policy

We may update this Privacy Policy from time to time. The most recent version will always be available on the Moneylights website.