Privacy notice
Pilot draft · last updated 9 September 2026 · final wording pending compliance review
Aubi is a personal-finance service run from the United Kingdom. This notice explains what we hold about you, why, and what you can do about it. It is written for the pilot: if anything here is unclear, ask before you sign in.
What we hold
Your sign-in identity — the email address and name on the Google account you sign in with. We do not store a password.
The financial records you give us — bank and card statements you import, valuations you enter, payslip figures you type in, and the categories and notes you add. We hold these only because you chose to build your picture from them.
An audit trail — a permanent record of the actions taken in your account (for example, a consent you gave, an invite you accepted, a statement you imported). This is what lets us show you what changed and when.
Why we hold it
To provide the service you signed up for (the contract between us), to keep the accounts you build accurate, and — only where you have switched it on — to suggest categories using an AI model. We do not sell or rent your data, and we do not use it for advertising.
Where it lives and who processes it
Your data is stored with Supabase in the European Union and served through Vercel. Invitation emails are sent through Resend. When you switch AI suggestions on, the text of the transactions being categorised is sent to Anthropic to produce the suggestion; nothing is sent when the setting is off.
Each of these providers acts on our instructions under a written agreement. Google is used only to confirm who you are when you sign in.
Sharing with a partner
Nothing in your own books is visible to anyone else unless you choose to share it. If you join a household, you and your partner both see the shared book. Your personal book stays private unless you explicitly switch sharing on, and you can switch it off, or leave the household, at any time from Settings.
How long we keep it
For as long as you have an account. You can export everything, reset your data, or delete your account from Settings → Your data. Deleting your account removes your records; backups are cycled out on a fixed schedule afterwards.
Your rights
Under UK data-protection law you can ask for a copy of what we hold, have it corrected or deleted, object to how it is used, and complain to the Information Commissioner's Office (ico.org.uk). The export and delete tools in Settings are the quickest route; anything else, contact us at the address on the sign-in page.