Privacy Policy

1. Information We Collect

To provide the Service, we collect:

• WhatsApp / Telegram account info: your phone number or Telegram username and profile name, received when you message the BroFInAi bot.
• Messages you send: text messages and receipt photos you send to the bot for logging expenses.
• Expense data: amounts, categories, dates, merchants, and notes extracted from your messages.
• Usage data: timestamps, command usage, and error logs, used to keep the Service running and to improve it.

We do not intentionally collect sensitive information such as your national ID, bank account numbers, or passwords. Please avoid sending these to the bot.

2. How We Use AI Processing

Messages and receipt photos you send may be processed by an AI model to auto-scan receipts and extract expense details — amount, category, and merchant. This happens automatically to power real-time expense logging and dashboard tracking.

3. How We Use Your Information

• To record and organize your expenses
• To generate dashboards, summaries, and reports you request
• To send daily, weekly, or monthly summaries you've opted into
• To respond to your messages and provide customer support
• To detect, prevent, and fix technical issues or abuse

4. Sharing of Information

We do not sell your personal data. We may share information with:

• WhatsApp / Meta and Telegram: as the messaging platforms through which the Service operates, subject to their own terms and privacy policies.
• AI & infrastructure providers: to process messages and host data, under contracts requiring them to protect your data.
• Payment processor (Paddle): for handling subscription payments, if you upgrade to a paid plan.
• Legal authorities: if required by law, regulation, or valid legal process.

5. Data Storage & Security

Your data is stored on secure servers with reasonable technical and organizational safeguards. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your expense data for as long as your account is active, or as needed to provide the Service. You can request deletion at any time (see Section 7).

7. Your Rights & Self-Service Tools

Depending on your location, you may have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Export your expense data
• Request deletion of your data

You don't need to email us to exercise the export or deletion rights — they're self-service. Log in to your dashboard → Settings → Privacy & Data to instantly download a CSV of every transaction and account detail we hold, or to permanently delete your account (transactions, budgets, and bot connection included). Account deletion is irreversible and typically takes effect immediately.

For anything else — correction requests, questions about what we hold, or if self-service isn't working for you — contact us at support@brofinai.com. We respond to verified requests within 30 days (or sooner where local law requires it).

7a. EEA / UK Users — Your GDPR Rights

If you're located in the European Economic Area or the UK, the General Data Protection Regulation (GDPR) / UK GDPR gives you additional, specific rights over your personal data, and requires us to tell you the legal basis we rely on to process it.

Legal basis for processing:

• Contract — processing your messages, receipts, and transaction data is necessary to provide the expense-tracking Service you signed up for.
• Consent — for optional features you opt into, like daily/weekly/monthly summary messages, which you can withdraw at any time.
• Legitimate interests — for fraud prevention, abuse detection, and improving the Service, balanced against your privacy interests.
• Legal obligation — where we must retain or disclose information to comply with the law (e.g. tax records related to payments).

Your GDPR rights:

• Right to access — a copy of the personal data we hold about you.
• Right to rectification — correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — deletion of your data, self-service via the dashboard (Section 7 above).
• Right to restrict processing — limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a portable format (CSV export, Section 7 above) or have it transferred to another provider where technically feasible.
• Right to object — object to processing based on legitimate interests, including profiling.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint — with your local data protection supervisory authority if you believe we've mishandled your data.

International transfers: our infrastructure and AI/hosting providers may process data outside the EEA/UK (e.g. the United States). Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism.

7b. California Residents — Your CCPA/CPRA Rights

If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the following rights over your personal information:

• Right to know — what categories of personal information we collect, use, and disclose, and for what purpose (see Sections 1–4 above).
• Right to delete — request deletion of your personal information, self-service via the dashboard (Section 7 above).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale/sharing — we do not sell or share your personal information for cross-context behavioral advertising, so there's nothing to opt out of.
• Right to limit use of sensitive personal information — we don't use your financial transaction data for anything beyond providing the Service itself.
• Right to non-discrimination — we won't deny you the Service, charge you differently, or provide a lower quality of service for exercising any of these rights.

To exercise any CCPA/CPRA right, use the dashboard self-service tools (Section 7) or email support@brofinai.com — we'll verify your identity via your registered phone/email before acting on the request.

8. Payment Information

Subscription payments for Bro Core and Bro Max are processed by Paddle.com, our payment processor and Merchant of Record. We do not store your card details — Paddle handles payment processing, billing, and applicable tax collection directly. See our Refund Policy for details on refunds.

9. Children's Privacy

The Service is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of material changes via the bot or by updating the "Last updated" date above.

11. Contact Us

Questions about this Privacy Policy, or about your data? Message the bot or email support@brofinai.com.