MonitorSpend Privacy Policy
Last updated: October 8, 2026
This policy explains what Doxa Holdings, LLC, a Kansas limited liability company that operates MonitorSpend ("MonitorSpend", "we"), collects and why. MonitorSpend is a business service: our customers are companies, and they decide whose data goes into it. For data about a customer's employees, the customer decides how it is used and we process it on their behalf.
What we collect
- Account details: names and work email addresses of the people who use MonitorSpend, their passkeys' public keys (never a password), sign-in records and the device and IP address used.
- Company directory: people's names, emails, managers, departments and roles, as the customer enters them.
- Transactions: card and bank transactions the customer connects: date, amount, merchant, category, and at most the first 6 and last 4 digits of a card. We never store full card numbers.
- Receipts and explanations: receipt photos and PDFs; receipt emails people forward to their own MonitorSpend receipt address (the message and its attachments, accepted only from their sign-in address); what was read from them; and notes people write.
- Policies: the customer's travel and expense policy, including documents they upload.
- Billing: the subscribing company's billing contact. Stripe handles card details; we never see them.
- Messages to us: emails people send to monitorspend.com addresses.
How we use it
To provide the service (checking charges against the customer's policy, matching receipts, routing approvals, sending the emails the service needs), to keep it secure, to bill the customer, and to meet legal obligations. We don't sell personal data, use it for advertising, or use customers' data to train AI models.
Who we share it with
Only the service providers we need, under contract:
| Provider | What for |
|---|---|
| Hostinger | Server hosting (Boston, Massachusetts, United States) |
| Cloudflare | Network security and delivery; storage of our encrypted backups (R2) |
| Amazon Web Services | Encryption keys; AI reading of documents and receipts (Amazon Bedrock, which doesn't use them for training); receiving the receipt emails people forward (Amazon SES), kept at most a day |
| Plaid | Reading bank and card transactions, when the customer connects an account |
| Stripe | Subscriptions and payments |
| Resend | Sending email |
| Zoho | Our email inbox |
We disclose data when the law requires it, and tell the customer first where allowed.
How we protect it
Sign-in is by passkey only. Personal fields and files are encrypted with a key that belongs to each customer company, held in AWS Key Management Service. Each company's data is kept separate in the database, every change is recorded in a tamper-evident audit trail, and access is limited to what each person's role allows.
How long we keep it
Expense records, receipts, approvals and the audit trail are kept for 7 years after the end of the fiscal year they relate to (customers can set 3 to 10 years), because tax and audit rules often require it. When a customer closes their account, we delete or return their data within 90 days, except what we must keep by law.
Your choices and rights
Employees should contact their employer first: the employer controls their data in MonitorSpend and handles requests to see, correct or delete it, with our help. Depending on where you live (for example California), you may have rights to know, access, correct and delete personal data. Contact us at [email protected] and we'll help or pass the request to the right company.
Changes and contact
We'll post changes here and tell customers by email of material changes. Contact: [email protected], 12702 W 131st St., Overland Park, KS 66213.