Effective date: 2026-05-13
Privacy Policy
Mellow Budget (“Mellow”, “the App”, “we”, “us” or “our”) is a Malta-based personal finance and budgeting app operated under the nerds.mt / Taxceo brand. Mellow is designed to help users organise expenses, income, receipts, wallets, transfers, subscriptions, scheduled transactions, budgets, reminders and exports in a privacy-first way.
This Privacy Policy explains how personal data is handled in connection with the App, the Mellow website, support communications, optional iCloud sync, optional AI receipt processing, currency-rate requests and related app functionality. It is written with reference to Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), the Data Protection Act, Chapter 586 of the Laws of Malta, Malta subsidiary data protection legislation, applicable ePrivacy/cookie rules, and other applicable European and Maltese data protection requirements.
Mellow does not require a Mellow account, does not include advertising, does not use third-party analytics, and is not configured to track you across apps or websites. Your finance data is stored locally by default. Optional iCloud sync uses your Apple account. Optional AI receipt processing is used only when configured and when you use the relevant AI features.
1. Data Controller and Contact Details
For data protection purposes, the controller for the Mellow website, support communications and any Mellow-operated online processing is:
- Controller: nerds.mt / Taxceo, Malta
- Product: Mellow Budget
- Email: mellow@nerds.mt
- Website: https://nerds.mt/mellow/
If a formal legal entity name, registered address or appointed Data Protection Officer is later adopted, this section should be updated before publication. At present, privacy requests should be sent to mellow@nerds.mt.
2. Important Distinction: Local Data, iCloud Data and Data Sent to Us
Mellow is intentionally designed so that most app data remains on your device. We do not receive or access your local budget records unless you actively use a feature that sends data outside the device, such as support email, optional AI processing, optional custom Worker processing, or optional cloud services.
If you enable iCloud sync, supported app data is synced through Apple iCloud and CloudKit under your Apple account. Apple’s own privacy terms and iCloud settings also apply to that processing.
3. Categories of Personal Data Processed
Depending on how you use Mellow, the App may process the following categories of data:
- Financial and budgeting data: expenses, income, amounts, currencies, budget limits, categories, wallets, balances, transfers, subscriptions, recurring bills, scheduled transactions, cash-flow summaries and related notes.
- Receipt and document data: receipt images, imported receipt documents, merchant/contact names, dates, line items, tax/VAT references if visible on the receipt, totals, categories and extracted fields.
- Optional profile/app data: optional first name, base currency, settings, notification preferences, accessibility preferences, iCloud sync settings, AI/Worker settings and app configuration.
- Device and technical data: app version, operating system information, error context, IP address or security metadata where network services are used, and technical logs necessary to operate or secure online services.
- Support data: your email address, message content, screenshots, attachments and any information you choose to send when contacting support.
4. Special Category Data and Sensitive Receipts
Mellow is not designed to collect special category data, such as health information, religious information, biometric data, political opinions or trade union information. However, receipts or notes may reveal sensitive information, for example pharmacy, medical, donation, membership or location details.
You should avoid storing or submitting sensitive receipts unless you are comfortable doing so. You should especially avoid sending sensitive receipts to an AI Worker unless this is strictly necessary for your own use and you understand that the specific image or text may be processed by the selected Worker and AI provider.
5. Purposes and Lawful Bases
We process personal data only where there is a lawful basis under GDPR and applicable Maltese data protection law. The main purposes and lawful bases are:
| Purpose | Examples | Lawful basis |
|---|---|---|
| Providing app functionality | Recording expenses, income, receipts, wallets, transfers, subscriptions, budgets, scheduled transactions and exports. | Performance of a contract or steps requested by you; legitimate interests in providing a functional app. |
| Local storage | Keeping your data on your device so the App can work offline and without an account. | Performance of a contract or user-requested functionality. |
| Optional iCloud sync | Syncing supported app records across your Apple devices using iCloud/CloudKit. | Your choice to enable sync and performance of the requested functionality. Apple may process data under its own terms. |
| Optional AI receipt processing | Extracting receipt fields, suggesting categories, cleaning merchant/contact names or generating short budget insights. | Your request to use the feature; where required, consent. You can avoid AI processing by not using AI features. |
| Security and abuse prevention | Worker rate limits, request-size limits, technical safeguards, fraud/abuse prevention and service protection. | Legitimate interests in keeping the service secure, reliable and resistant to abuse. |
| Support and communications | Responding to emails, support requests, privacy requests and App Store review matters. | Legitimate interests, performance of requested support, and legal obligation where applicable. |
| Legal compliance | Responding to lawful requests, exercising legal rights, complying with data protection, consumer, accounting or regulatory obligations. | Legal obligation and legitimate interests. |
6. AI Worker and Receipt Processing
Mellow may use an HTTPS AI Worker to support receipt scanning, merchant/contact cleanup, category suggestions and short budget insights. The iOS App does not ship the underlying AI provider API key. Requests are routed through a configured Worker.
When an AI workflow runs, Mellow may send only the data reasonably needed for that task, such as a receipt image, extracted receipt text, merchant/contact name, amount, currency, date, category or limited financial context. AI features should not be used for legal, tax, investment, credit, insurance or other regulated advice. AI output is assistive and should be reviewed by the user.
The Mellow Worker is intended to operate without a database and without deliberate logging of receipt content. Security providers may still process limited technical data, such as IP address, request metadata and security logs, to operate and protect the service.
If you configure a Custom Worker, the operator of that Worker may receive the data you send to it. Do not enter a Custom Worker URL or token unless you trust that operator and have reviewed its privacy terms.
7. SmartBudget and Accountability Pods
SmartBudget tools may help users reflect on spending patterns, future projections, recurring behaviour or budget pressure. They are not financial, investment, legal, tax, accounting, credit, debt, insurance or professional advice.
Remote SmartBudget accountability pods are disabled in the current version unless and until a GDPR and data-minimisation review is completed. While disabled, no pod matchmaking endpoint is called and no pod goal, amount, category, income, user identifier, device identifier or contact identifier is sent for remote matching.
8. iCloud Sync and Apple Services
If you enable iCloud sync, Mellow may sync supported structured data through Apple iCloud/CloudKit. Receipt image files may also be stored through an iCloud documents container where available, with local storage fallback where iCloud is unavailable or disabled.
Apple may act as an independent controller or processor depending on the Apple service and your Apple account settings. You can manage iCloud and Apple privacy settings through your device and Apple ID settings.
9. Currency Rates and Network Requests
Mellow may request exchange-rate data from a public exchange-rate service to help display amounts in your selected base currency. These requests are intended to refresh rate data and should not require a Mellow account. The App may cache rates so it remains useful when offline or when rates cannot refresh.
10. Notifications
Mellow may schedule local notifications for subscription reminders, renewal/cancellation reminders, budget prompts or other app reminders if you grant notification permission. Local notifications are scheduled on your device. You can change notification permissions through iOS, iPadOS or macOS settings.
11. Website, Cookies and Similar Technologies
The public Mellow landing page is intended to operate without advertising, third-party analytics or tracking cookies. If only strictly necessary technical cookies are used, they are used to provide the website or requested functionality.
If non-essential cookies, analytics pixels, advertising tools or similar technologies are added in the future, they must not be activated unless a valid consent mechanism is provided where required by Maltese and European ePrivacy/cookie rules.
12. Data Sharing and Recipients
We do not sell personal data. We may share or make data available only where necessary for the App, services or legal obligations, including:
- Apple: App Store distribution, device services, iCloud/CloudKit sync and Apple account functionality where used.
- Cloudflare or similar infrastructure providers: website hosting, Worker routing, security, rate limiting and abuse prevention.
- AI provider: optional AI receipt processing or insight generation when configured and used.
- Exchange-rate provider: currency-rate refresh requests.
- Email/support providers: handling emails and support requests.
- Professional advisers, authorities or regulators: where needed for legal compliance, claims, defence, reporting or lawful requests.
13. International Transfers
Some service providers may process data outside Malta, the European Union or the European Economic Area. Where personal data is transferred internationally, we aim to rely on appropriate GDPR transfer mechanisms, such as European Commission adequacy decisions, Standard Contractual Clauses, supplementary measures or other lawful transfer safeguards where applicable.
14. Retention
Mellow keeps data only for as long as needed for the relevant purpose, unless a longer period is required by law or necessary to establish, exercise or defend legal claims.
| Data | Retention approach |
|---|---|
| Local app data | Stored on your device until you edit it, delete it, clear app data or uninstall the App. |
| iCloud-synced data | Stored according to your iCloud settings and until deleted by you or through Apple/iCloud controls. |
| Exported files | Created only when you export. You control where exported CSV/PDF files are saved or shared. |
| Support emails | Kept only as long as needed to respond, maintain support history, protect rights or meet legal obligations. |
| Worker/security logs | Kept only as long as necessary for security, troubleshooting, abuse prevention and legal compliance, subject to provider configuration. |
15. Your GDPR Rights
Subject to the conditions and limitations in applicable law, you may have the right to:
- be informed about how your data is processed;
- access your personal data;
- rectify inaccurate or incomplete personal data;
- request erasure of personal data;
- restrict processing;
- object to processing based on legitimate interests or direct marketing;
- receive certain data in a portable format;
- withdraw consent where processing is based on consent, without affecting prior lawful processing;
- not be subject to a solely automated decision producing legal or similarly significant effects, subject to applicable exceptions; and
- lodge a complaint with a supervisory authority.
To exercise your rights, email mellow@nerds.mt. We may ask for information necessary to verify your identity and locate the relevant data. We aim to respond without undue delay and within one month, subject to lawful extensions for complex or multiple requests.
16. Malta Supervisory Authority
If you believe your data protection rights have been infringed, you may lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (“IDPC”). You may also contact another competent EU/EEA supervisory authority where applicable.
IDPC: Office of the Information and Data Protection Commissioner, Malta. Website: https://idpc.org.mt/
17. Security
Mellow uses privacy-by-design and data-minimisation principles. The App is designed to work locally by default, avoid user accounts, avoid advertising, avoid third-party analytics, and limit online processing to functionality the user chooses or requires. We use reasonable technical and organisational measures appropriate to the nature of the data and service, but no system can be guaranteed to be completely secure.
18. Children
Mellow is not directed at children. In Malta, the age for consent in relation to information society services is 13. Users below the applicable age should use Mellow only with parental or guardian involvement where required by law. The App should not be used by children to store sensitive financial or personal information without appropriate supervision.
19. No Professional Advice
Mellow is a personal organisation tool. It does not provide legal, tax, accounting, investment, insurance, credit, debt-management or regulated financial advice. Budgets, reminders, AI suggestions, projections and insights are informational only and should be reviewed by the user.
20. Changes to This Policy
We may update this Privacy Policy as Mellow changes or where required by law. The effective date will be updated when material changes are made. Where legally required, we will provide additional notice or request consent.
21. Contact
For privacy questions, data protection requests, complaints, accessibility/privacy concerns or support, email mellow@nerds.mt.