Privacy policy

This policy explains what Personal CFO ("we") collects when you use Personal CFO, why, and the choices you have. We wrote it to be read, not skimmed past.

What we collect

• Account details: your email address and a display name.
• Financial information you provide: transactions from statements and CSV files you upload, and the accounts, debts, properties, goals and recurring items you enter.
• Documents you choose to store on the Documents page.
• Billing details: your plan and payment status. Card details are handled by Stripe; we never see or store your card number.
• Basic technical data such as error logs, needed to keep the service running and secure.

What we don't collect

• We never ask for or store your online-banking username or password.
• Statement passwords are used only to open the file in memory while it's read, and are never saved or logged. Uploaded statement PDFs are not stored — only the transactions you choose to import.
• We don't sell your data, and we don't use it for advertising.

How we use it

Only to provide the service you signed up for: showing your financial position, categorizing transactions, calculating forecasts and obligations, answering your questions in the assistant, billing you, and keeping the service secure.

Service providers

We use a small number of providers to run the service. Each only receives what its job needs:

• Supabase — database, sign-in and file storage, hosted in the European Union.
• Vercel — hosting of the web application.
• OpenAI — reading statements and documents, suggesting categories and answering assistant questions. Data is sent with storage disabled and, under OpenAI's API terms, isn't used to train their models.
• Stripe — payments and invoices.
• Cloudflare Turnstile — checks that sign-ups come from people, not bots.
• Sentry — error reports so we can fix problems quickly. Reports contain technical details, not your financial data.

Some of these providers process data outside the UAE. We rely on their contractual safeguards for those transfers, as permitted by the UAE Personal Data Protection Law.

Security

Data is encrypted in transit and at rest. Row-level security in the database means each account can only ever read its own records, even if application code had a bug.

Cookies

We only use cookies that are needed to keep you signed in and the service secure. No advertising or tracking cookies.

How long we keep it

For as long as your account exists. In Settings you can download all your data, delete it, or close your account — which deletes your data and your login straight away. Billing records are kept as long as tax law requires.

Your rights

You can ask to access, correct, export or delete your personal data, or object to how it's processed. Email support@getpersonalcfo.com and we'll respond within 30 days.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.