Privacy Policy

• Desktop app: your model data stays on your device. We do not collect or store it. If you choose a cloud AI key or an integration, your inputs go to that third party, never to us.
• Hosted web workspace: we store your account and your scenarios on our infrastructure so we can run the service, and we send assistant prompts to AI providers you select.
• We never sell your data, and we don’t use your financial model content to train our own models.

This policy explains how Replafin (“we”, “us”) handles personal data across both products. Because the desktop app and the hosted workspace are technically different, we call out which one we mean throughout.

The desktop app stores your models and assumptions locally on your device. We do not receive that data. We may collect minimal, anonymised diagnostics (such as app version and crash reports) only if you opt in; you can use the app fully without them.

If you connect a cloud AI provider by pasting your own key, your prompts and the model context you send are transmitted directly from your device to that provider under their privacy terms. If you run a local model instead, nothing leaves your device at all.

On the hosted Starter and Pro plans we process:

• Account data: name, email, authentication details, and workspace/team membership.
• Your model content: the scenarios, assumptions, and figures you create, stored so you can return to them.
• Billing data: plan, credit usage, and invoices. Card details are handled by our payment processor; we do not store full card numbers.
• AI usage: prompts and model context are sent to the AI provider you select to generate assistant responses.
• Integration data (Team): if you connect QuickBooks, Xero, Stripe, or a bank, we receive the financial actuals needed to sync your model.
• Usage analytics: product analytics to understand how features are used and to improve the service.

We use data to:

• Provide, secure, and operate the service and your account.
• Process payments and meter AI credit usage.
• Generate AI assistant responses you request.
• Sync actuals from integrations you connect.
• Provide support and send service-related messages.
• Understand usage and improve the product.

We do not sell personal data, and we do not use your model content to train our own or third parties’ AI models.

On the hosted workspace we share data with vetted service providers only as needed to run the service. These typically include:

• Hosting & database: Supabase (Postgres storage) and our cloud hosting provider.
• AI providers: the provider you select (for example OpenRouter or OpenAI) receives your prompts to generate responses.
• Payments: Stripe for subscription billing.
• Analytics: PostHog (EU) for product analytics, error monitoring and session replay. Everything you type is masked in replays and the assistant prompts themselves are not sent to analytics.
• Integrations: only the accounting/bank services you explicitly connect.

We keep this list current; material additions will be reflected here.

We keep hosted account and model data for as long as your account is active. After you cancel, you can export your data for a reasonable period, after which we delete or anonymise it, except where we must retain records (for example, billing records for tax and accounting).

Depending on where you live (for example under GDPR or the CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise these rights from your account settings or by contacting us. We will not discriminate against you for exercising them.

We use reasonable technical and organisational measures to protect hosted data, including encryption in transit and access controls. No system is perfectly secure; we cannot guarantee absolute security, and you are responsible for keeping your credentials and any AI keys safe.

Your data may be processed in countries other than your own, with appropriate safeguards where required. The service is not directed to children under 18, and we do not knowingly collect their data.

We may update this policy; material changes will be posted here with a new “last updated” date. For privacy questions or requests, contact us at privacy@replafin.com.