This notice explains how the private Mullineauxs family portal at themullineauxs.co.uk handles personal data. It is operated privately for invited family members.
Who is responsible
The portal is managed by James Mullineaux. For privacy questions or requests, contact james.mullineaux@gmail.com.
What we collect
- Account data: name, email address, password hash, role, sign-in sessions, device and IP information, and security events.
- Security data: two-factor authentication settings, hashed one-time codes, recovery-code hashes and audit records.
- Financial data you add: transactions, balances, categories, budgets, targets, savings goals, debts and payments.
- Connected-bank data: account names, balances, transactions and consent status from Monzo when you choose to link an account. Lloyds data comes from statement files you upload.
- Notifications: your check-in preferences, notification records and whether reminder emails were delivered.
- Backups and logs: encrypted database backups and short-lived operational logs needed to run and secure the service.
Why we use it
- To provide the portal, tools, budgets, debt tracking and family features you ask for.
- To authenticate you, protect your account and detect misuse.
- To sync accounts you explicitly connect and to categorise their transactions.
- To send security codes and, if you enable them, reminder emails.
- To maintain encrypted backups and recover from failures.
We rely on performing the service you requested, your consent for optional connections and emails, and our legitimate interest in keeping the service secure.
Open banking
Monzo access uses Monzo's own OAuth consent and is read-only. Lloyds transactions are imported from CSV, OFX or QIF statement files that you upload; the portal does not connect to Lloyds through an open-banking provider. The portal cannot move money or initiate payments for either bank.
Bank access tokens and open-banking session identifiers are encrypted at rest. Disconnecting a bank closes the provider session. Transactions already imported into the portal remain until you delete them or remove the account.
Service providers
- Monzo for Monzo account connectivity.
- Resend for security codes and optional reminder emails.
- OpenRouter when you choose to use an AI assistant. Only aggregate figures and merchant names are sent; no account numbers, individual transaction history or contact details.
- Our hosting and infrastructure provider, which stores the application and encrypted backups.
We do not sell personal data, use it for advertising, or share it for marketing. Some providers may process data outside the UK/EEA under their contractual safeguards.
Cookies and local storage
The portal uses a secure session cookie and, during two-factor authentication, a short-lived challenge cookie. The installable app caches static assets and an offline page; authenticated pages are not cached. We do not use advertising or analytics cookies.
Retention
- Account and financial records are kept while your account is active.
- One-time email codes and MFA challenges expire after 10 minutes.
- Encrypted backups are retained for up to 14 days.
- Security and login records are kept for a reasonable period to protect the service.
- Imported transactions remain until you delete them or remove the associated account.
Your rights
Under UK data protection law you can ask for access to your data, correction, deletion, restriction, portability, or object to certain processing. Email james.mullineaux@gmail.com. You can also complain to the Information Commissioner's Office at ico.org.uk.
Security
Passwords are hashed, optional two-factor authentication is available, bank tokens are encrypted, access is restricted to signed-in users, and backups are encrypted. No online service can be guaranteed completely secure, so use a strong unique password and enable two-factor authentication.
Children
The portal is intended for invited family members. Accounts for children should be managed by a parent or guardian.
Changes
We may update this notice when the service changes. The latest version is always published on this page.