PerFinAI — Privacy Policy
Last updated 21 August 2026.
PerFinAI is an AI-native personal finance assistant. It reads bank statements you upload
and, optionally, your bank's transaction-alert emails, and turns them into a ledger you
can ask questions about.
What we collect
-
Account identity from Google or Facebook sign-in: email address, name, profile picture.
-
Documents you upload (CSV, Excel, PDF, images) and everything extracted from them:
dates, amounts, descriptions, balances, and account numbers as printed.
- Email transaction alerts, only if you connect Gmail.
- A PDF open-password, stored encrypted, if you configure a protected e-statement.
- Your chat messages and any categorization corrections you make.
- Operational logs, to keep the service working.
No analytics, no advertising pixels, no third-party trackers.
Gmail access
Optional, and off until you explicitly grant it. We request a single read-only scope,
gmail.readonly — we can read, and can never send, modify, archive or
delete anything in your mailbox. We do not scan your inbox: you supply a sender address
and a subject line per source, and only messages matching those filters are ever
retrieved. Your refresh token is encrypted at rest. Revoke any time at
myaccount.google.com/permissions.
PerFinAI's use and transfer to any other app of information received from Google APIs will
adhere to the
Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Gmail is never used for
advertising, never sold, and never used to train generalised machine-learning models.
Who else sees it
We do not sell your data or share it for advertising. Processors acting on our behalf:
Anthropic (document and alert text is sent to the Claude API to infer layouts, categorize
transactions and answer your questions; Anthropic does not train on API data), Amazon Web
Services (hosting), Cloudflare and Grafana Cloud (domain and operational logs), and
Google or Meta for authentication only.
Storage, security and deletion
Data lives on a single AWS Lightsail instance in a PostgreSQL database not exposed to the
internet, plus a local search index. Backed up daily. Note that this is a single-tenant
early-access deployment: access control is not yet enforced on the server, so every
account resolves to the same records — do not put another person's financial data
into it. To delete your account and its records, email
info@perfinai.com and we
will confirm when it is done.
This is the no-JavaScript summary of the full policy. Enable JavaScript for the complete
text, or email
info@perfinai.com for a
copy.