Controller and Scope

This Privacy Policy explains how 7br.uno ('FinCo,' 'we,' 'us') collects, uses, stores, and shares personal data when you use the FinCo application (the 'App'), a personal finance and wealth-tracking tool that can link to your bank accounts, apply automated analysis to your transaction history, and optionally grant access to an external AI assistant over your financial ledger. It is written in plain language and is a real, operative document, not filler text — but it is informational content the App ships, not a substitute for independent legal advice.

The data controller under the EU/UK General Data Protection Regulation ('GDPR') and the data controller ('controlador') under Brazil's Lei Geral de Proteção de Dados ('LGPD') is 7br.uno, registered at R. Moacir Guimarães, 37 - Sacoma, São Paulo - SP, 04256-390, Brazil, registration number 41.077.742/0001-00. Questions about this Policy, or about how your data is handled, can be directed to dev@7br.uno.

This Policy applies to all personal data processed through the App and its supporting backend services, including data you enter directly, data obtained from a linked bank via Plaid, data generated by our own systems such as computed forecasts or category suggestions, and data shared with or generated by an AI client connected through the Model Context Protocol ('MCP') integration described below. It covers the EU/EEA and UK jurisdictions (GDPR) and Brazil (LGPD) side by side throughout — where a right or obligation differs between the two frameworks, this Policy says so explicitly rather than assuming they are identical.

This Policy should be read together with FinCo's Terms of Service. Where the Terms describe the contractual relationship between you and us, this Policy describes what personal data that relationship involves and how it is handled.

Categories of Data We Collect

FinCo collects several distinct categories of personal data, depending on how you use the App. Not every category applies to every user — bank-linked data only exists if you connect an account, and AI-access data only exists if you grant an external client access to your ledger.

• Identity and account data: your name, email address, authentication identifiers issued by Firebase Authentication, and any profile photo you upload.
• Financial ledger data you create directly: wallets, wealth accounts, transactions, recurrences, contacts, tags, categories, assets (including stocks and bonds), allocations, and budget or investor-profile settings you configure.
• Bank connection data obtained through Plaid: institution and account metadata, an encrypted bank access token, a Plaid item identifier, and the transaction and balance history Plaid returns once a connection is authorized.
• AI/MCP access data: OAuth authorization records, issued access and refresh tokens, and a log of the individual tool calls made against your ledger by any AI client you have authorized (see 'AI and MCP Access' below).
• Device and local application data: cached preferences, in-progress form drafts, and offline-queued state stored in your browser's local storage.
• Technical and usage data collected via Firebase Analytics: app interaction events, feature-usage signals, and coarse device/browser information (see 'Analytics' below).

Sign in with Google

FinCo offers 'Sign in with Google' as an authentication option, powered by Firebase Authentication. This section describes specifically what Google account data we receive, use, and store when you choose it — in addition to the general categories already described in 'Categories of Data We Collect' above.

When you sign in with Google, we receive only your name, email address, profile photo URL, and the unique Google account identifier associated with your Google session. We do not request, and cannot access, your Gmail, Drive, Calendar, Contacts, or any other Google service or content — the sign-in flow requests only the openid, email, and profile scopes.

This data is used exclusively to authenticate you, create and identify your FinCo account, and keep you signed in across sessions — the same identity information any 'Sign in with' option needs to function. It is not used for any other purpose.

In line with Google's own requirements for this feature, we never sell your Google account data, never share it with data brokers, never use it for advertising or ad personalization, and never use it to train or improve any artificial intelligence or machine-learning model, generalized or otherwise.

Your Google account data is stored in Firebase Authentication, alongside the rest of the identity information described in 'Categories of Data We Collect' above. Deleting your account deletes it, subject to the same 30-day service level described in 'Retention and Deletion' below.

How We Obtain Your Data

Most of your ledger data comes directly from you: when you create a transaction, add a contact, configure a wallet, or fill in your investor profile, you are typing that data into the App yourself. We do not infer or purchase this category of data from anywhere else.

Bank and transaction data is obtained from your financial institution via Plaid, a third-party account-linking provider, once you complete Plaid's own authorization flow and grant FinCo read access to the selected account(s). We do not see or store your online banking credentials — Plaid handles that exchange and gives us back an access token instead.

Some data is generated by FinCo itself from data you already provided: computed balances, category suggestions, cashflow projections, and stock forecasts (see 'Automated Processing and Forecasts' below) are all derived, not entered directly. This derived data is still personal data about you, even though you never typed it in yourself.

Where the App shows price history, candle charts, or forecast evidence for a stock or other traded instrument, the underlying price and market data is obtained from third-party market-data providers, not generated by us. See 'Recipients and Subprocessors' for how that data is sourced and used.

Purposes and Lawful Bases for Processing

We process your personal data for a limited set of purposes, and — because this Policy covers both the GDPR and the LGPD — each purpose below is paired with the legal basis that applies under each framework. This lets you see not just what we do with your data, but why it is lawful for us to do it under whichever framework applies to you.

We use your data to provide the core ledger, budgeting, and wealth-tracking functionality you sign up for, and to maintain your linked bank connections so transaction data stays current. We also use it to generate automated forecasts, suggestions, and projections; to operate the AI/MCP access you choose to grant; to secure the App against fraud and misuse; and to understand aggregate feature usage so we can improve the product.

Under the GDPR, our lawful bases are performance of a contract (Art. 6(1)(b)) for core ledger, bank-linking, and AI/MCP functionality you actively use, and legitimate interests (Art. 6(1)(f)) for security monitoring, audit logging of AI tool calls, and product analytics, balanced against your interests in each case. We also rely on consent (Art. 6(1)(a)) where we ask for it explicitly, such as before enabling analytics in jurisdictions that require opt-in consent for that specific purpose.

Under the LGPD, the equivalent bases are execution of a contract (Art. 7, II) for the same contract-performance purposes, and legitimate interest (Art. 7, IX) for security, audit logging, and analytics, applied with the same balancing test. We rely on consent (Art. 7, I) under the LGPD wherever we rely on it under the GDPR. We do not use special-category or sensitive personal data, as defined under either framework, for any purpose beyond what is strictly necessary to operate the features described in this Policy.

Bank Connections via Plaid

FinCo uses Plaid, Inc. to let you link an external bank or financial account. When you connect an account, you authorize Plaid to share account metadata, balances, and transaction history with FinCo on an ongoing, read-only basis — FinCo cannot initiate payments or move money through this connection.

Once a connection is established, we store an encrypted access token, a Plaid-issued item identifier, and the transaction and balance data Plaid returns, so the App can keep your ledger synchronized without asking you to reconnect every time. This stored data is what lets the App show up-to-date balances without requiring you to re-authenticate with your bank on every visit.

You can disconnect a linked bank from within the App at any time. Disconnecting stops future data from being pulled from that institution and records a disconnection marker on the connection, but it does not delete anything: the encrypted access token, the Plaid item identifier, and every transaction already imported from that account remain stored, in the same way as any other soft-deleted record described in 'Retention and Deletion' below. If you want that data actually removed, you need to make a manual deletion request as described in that section.

We never receive or store your online banking username or password. Plaid's own authorization flow handles that exchange directly with your bank or its aggregator, and only issues us a token scoped to the accounts you selected.

AI and MCP Access to Your Ledger

FinCo can be connected to an external AI assistant or agent (an 'MCP client') through the Model Context Protocol, an open standard for letting AI tools call into an application's data on a user's behalf. If you choose to connect one, you complete an OAuth authorization flow and the client is issued an access token scoped to your account.

Two scopes are available: finco:read, which lets the connected client read data across your entire ledger — transactions, recurrences, contacts, assets, wallets, wealth accounts, forecasts, and related settings — and finco:write, which additionally lets it create, modify, or execute actions on that same data, for example logging a transaction or adjusting a setting on your behalf. Granting either scope gives the client access to the whole ledger, not just a subset of it; there is currently no way to scope access to a single wallet, category, or narrower slice of your data.

You can revoke a connected client's authorization from within the App. Revocation is not instantaneous, however: access tokens are self-contained, cryptographically signed credentials that we do not maintain a deny-list for, so a client that already holds a valid token can continue to make calls against your ledger for up to roughly one hour after you revoke access, until that token naturally expires. There is also currently no in-app screen listing which MCP clients are actively connected to your account at a given moment — treat any client you have authorized as active until its token has had time to expire.

Every tool call an authorized AI client makes against your ledger — what was called, with what parameters, and when — is logged for security and audit purposes in a dedicated audit record kept separately from your regular per-user data. These audit logs are retained indefinitely; we do not currently apply an automatic expiry to them, and we do not delete them when you disconnect a client or delete other data. We keep it this way so that, even after other data has been deactivated, there remains a reliable record of what an AI client actually did on your ledger.

Because MCP access is a relatively new part of the App, some of the operational controls a more mature integration would have — such as a live list of connected clients or instant token revocation — are not yet built. We are describing the system as it actually works today, not as we intend it to work eventually, and we will update this Policy if that changes.

Automated Processing and Stock Forecasts

FinCo applies automated processing to your financial data in several places: computing balances and cashflow projections, suggesting categories or contacts based on patterns in your own transaction history, and generating stock forecasts for tickers you hold or watch, based on candlestick-pattern detection and related market-check models. These are the main places where a model, rather than a person, decides what to surface to you.

Stock forecasts are built by combining your own holdings and watchlist data with price and candle data obtained from third-party market-data providers (see 'Recipients and Subprocessors'). That third-party data is about the instrument, not about you, but the resulting forecast — which tickers it covers, how it scores them, and what it suggests — is generated using your personal portfolio and watchlist as an input, so the output is treated as your personal data.

Forecasts and suggestions are informational model output, not investment advice, and no automated decision made by FinCo has a legal or similarly significant effect on you in the sense contemplated by GDPR Art. 22 or LGPD Art. 20 — the App does not autonomously execute trades, deny you a benefit, or make any binding decision about you. Every suggested action, including any suggested trade size, requires your own review and action to take effect.

If you have questions about how a specific forecast or suggestion was produced, or want a human explanation of the automated processing applied to your data, you can contact us at dev@7br.uno. We will explain the general logic and data inputs behind the model in plain terms, though we may not be able to disclose every proprietary scoring detail in full.

Cross-User and Community Statistics

Some features of FinCo compare your data against aggregate patterns drawn from other users — for example, a community-derived category suggestion or benchmark statistic. These aggregates are computed across many users' data, not from any single individual's ledger.

The aggregate statistics themselves are not designed to identify, or be traced back to, any specific user, and we do not display another user's individual transactions, balances, or identity to you through this feature.

At present, there is no mechanism — in the App or via a support request — for you to opt your data out of contributing to these cross-user aggregate statistics; using the underlying features means your data is included in the aggregate on the same basis as every other user's. We are stating this plainly as a current limitation, not as a feature we are promising to build.

Recipients and Subprocessors

We share personal data with a limited set of third parties, each engaged to provide a specific part of the service. We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.

• Google Firebase (Authentication, Firestore database, Cloud Storage, Cloud Functions, and Firebase Analytics): our core backend and hosting infrastructure. Firebase stores your account credentials, your ledger data, uploaded files, and the technical/usage events described in 'Analytics.'
• Plaid, Inc.: our bank-linking provider, described in 'Bank Connections via Plaid' above. Plaid receives what is necessary to authorize and maintain your bank connection and returns account, balance, and transaction data to us.
• Third-party market-data providers: suppliers of stock price and candle (OHLCV) data used to power stock forecasts. These providers receive ticker/symbol requests to return public market data; they do not receive your personal ledger data.
• AI/MCP clients you personally authorize: an external AI assistant or agent you connect via OAuth (see 'AI and MCP Access'). Unlike the other recipients on this list, this recipient is chosen and authorized by you, not by us, and the scope of what it can access is exactly what you granted.
• Infrastructure and operational service providers who support hosting, deployment, and error monitoring for the App, bound by contractual confidentiality and data-processing terms.

International Data Transfers

Our primary data stores are hosted on Google Cloud infrastructure, with our Firestore database in the southamerica-east1 region and file storage in the southamerica-east1 region. Depending on where you are located, using FinCo may involve transferring your personal data outside your own country or region.

Where personal data of an EU/EEA, UK, or Brazilian resident is transferred to a country that the relevant authority has not recognized as providing an adequate level of protection, we rely on appropriate safeguards with our processors — such as the European Commission's Standard Contractual Clauses (and the UK's International Data Transfer Addendum, where applicable) for GDPR purposes, and the equivalent standard contractual clauses approved under the LGPD for transfers from Brazil. These safeguards are contractual commitments from the recipient to protect your data to a standard equivalent to what GDPR or LGPD would require at home, regardless of where the processing physically occurs.

FinCo has not yet designated a representative in the EU/EEA or the UK under Art. 27 GDPR (or the equivalent UK GDPR requirement), because we do not yet have users based in either jurisdiction. This Policy will be updated to name a representative once we do. Until then, any question about international data transfers — for the EU, the UK, or any other jurisdiction — can be directed to dev@7br.uno.

Retention and Deletion

We retain your personal data for as long as your account is active, plus a further period afterward to meet operational, security, and legal-record needs. There is no single universal retention period across every data category — retention depends on the type of record, as described below.

When you remove something in the App — a transaction, a wallet, a contact, a linked bank connection — the App does not, in almost all cases, actually erase the underlying record. Instead, it is marked with a deletedAt (or equivalent) timestamp, which deactivates it: it is hidden from your normal views and excluded from ordinary calculations, but the record itself remains fully stored and, internally, remains readable. This is deliberate — it lets us recover from mistaken deletions and preserve an accurate financial history — but it means that removing something in the App is not the same as erasing it.

As described in 'Bank Connections via Plaid,' disconnecting a linked bank writes a disconnection marker but does not delete the encrypted access token, the Plaid item identifier, or the transactions already imported from that account. This mirrors the soft-deletion approach used for your other ledger data generally.

The audit log of AI/MCP tool calls described in 'AI and MCP Access' is retained indefinitely and is not subject to the same deletion process as your other ledger data, including a full account-deletion request — it is kept as a lasting security and accountability record of actions taken against your ledger. We keep it this way so that, even after an account is otherwise deactivated, there remains a trustworthy record of what an AI client actually did on that ledger.

There is currently no self-service option in the App to permanently delete your account or export your data yourself. If you want data actually erased, rather than merely deactivated and hidden, or if you want a copy of your personal data for portability purposes, you must send a request to dev@7br.uno. We will action a verified deletion or portability request within 30 days, and we will tell you plainly if any category of data — such as the AI audit log, or records we are required to keep for legal or accounting reasons — cannot be erased even on request.

Your Rights Under the GDPR and LGPD

If you are located in the EU/EEA or UK, the GDPR gives you a set of rights over your personal data. If you are located in Brazil, the LGPD gives you a closely equivalent set of rights, and we handle requests under either framework the same way, through dev@7br.uno (our data protection contact for GDPR purposes) or through our Encarregado de Dados (Data Protection Officer under the LGPD), the 7br.uno data protection team.

To exercise any of the rights below, email dev@7br.uno (or dev@7br.uno directly), describing what you want and identifying your account. Because most of these requests are handled manually today rather than through an automated self-service tool, we may ask you to verify your identity before we act, and requests involving deletion are actioned within 30 days.

None of these rights are absolute. We may decline or narrow a request where an exception applies under the GDPR or LGPD — for example, where we must keep a record for legal, tax, or security-accountability reasons (the AI/MCP audit log is a case in point), or where honoring the request exactly as asked isn't technically possible today, such as instant token revocation for a connected AI client. Where we decline or partially fulfil a request, we will explain why.

• Access: ask us to confirm what personal data we hold about you and get a copy of it.
• Rectification: ask us to correct inaccurate or incomplete personal data — though for most ledger data, you can already edit it directly in the App.
• Erasure: ask us to delete your personal data. As explained in 'Retention and Deletion,' most deletion in the App is a manual, request-based process rather than an automated one, and some categories, such as audit logs, may be retained even after a deletion request.
• Portability: ask for a copy of your data in a structured, commonly used format so it can be moved elsewhere. There is no in-app export or download-my-data feature today — this is handled as a manual request to dev@7br.uno.
• Restriction and objection: ask us to limit certain processing, or object to processing based on legitimate interests, including profiling used to generate forecasts or suggestions.
• Withdraw consent: where we rely on your consent for a specific purpose, withdraw it at any time without affecting processing that already happened before the withdrawal.
• Lodge a complaint: contact your local data protection authority — in the EU/EEA, UK, or Brazil's ANPD — if you believe we have mishandled your data; see 'Contact and Complaints' for how to reach us first.

Security

We apply technical and organizational measures to protect your data. These include encryption of Plaid bank-access tokens at rest, access-control rules that scope most of your ledger data to your own authenticated account, and an authorization layer around AI/MCP access so that a connected client can only act within the scopes it was granted.

Your ledger data is stored in a Firestore database in the southamerica-east1 region, and files you upload are stored in Cloud Storage in the southamerica-east1 region. These regions are chosen for operational reasons and do not change based on where you personally are located.

We are disclosing a known limitation directly rather than glossing over it: current storage access rules do not fully restrict uploaded profile photos to their owner, and it is currently possible for another signed-in user to read a profile photo that is not their own. We are aware of this and treat it as an open issue we intend to fix; if you would prefer not to have a photo exposed under this limitation, the safest option today is not to upload one.

No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse of data will never occur. If we become aware of a security incident affecting your personal data that we are required to notify you about, we will do so by the means available to us at the time — see 'Changes to This Policy' for how we communicate updates generally, since we do not currently have a dedicated security-notification email channel beyond the transactional emails your account already receives, such as password-reset emails, from Firebase Authentication.

Device Storage and Cookies

FinCo stores some data locally in your browser rather than only on our servers: cached preferences, in-progress form drafts, and session state used to keep the App responsive. This local storage lives on your device and is not automatically synced anywhere unless the App explicitly saves it to your account.

We do not use third-party advertising cookies or cross-site tracking. The only tracking-adjacent mechanism in the App is Firebase Analytics, described in the next section, which uses its own identifiers rather than third-party ad cookies.

FinCo is a Progressive Web App and precaches its core application shell so that already-visited parts of the App can keep working with a poor or absent connection. This Policy and the Terms of Service, however, are loaded as separate, lazily-fetched pages rather than being part of that precached shell, and the App does not use server-side rendering — so if you are visiting this page for the very first time with no connection at all, it may not load until you have had a connection at least once.

Analytics

FinCo uses Firebase Analytics, part of Google Firebase, to understand how the App is used in aggregate. It is loaded lazily and only initializes in browser environments that support it, so a session that never triggers a tracked event never loads it at all.

Firebase Analytics collects app-interaction events, feature-usage signals, and coarse device/browser information. It is used here to understand product usage patterns, not to build an individually targeted advertising profile of you, and we do not otherwise combine it with advertising networks.

We rely on legitimate interests (GDPR Art. 6(1)(f)) or legitimate interest (LGPD Art. 7, IX) as the basis for this analytics processing, or on your consent where local law requires an opt-in for this specific kind of processing. Firebase Analytics data is subject to Google's own data-handling terms as our subprocessor for this purpose, in addition to this Policy.

Children's Privacy

FinCo is not directed at children and is not intended for use by anyone under 18 years old. By using the App, you confirm that you meet this minimum age requirement.

We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will take steps to address it, subject to the same manual, request-based deletion process described in 'Retention and Deletion.' If you believe a child has provided us with personal data, contact us at dev@7br.uno.

Changes to This Policy

We may update this Policy from time to time to reflect changes to the App, the data we process, or applicable law. The version in effect is the one published in the App, dated as set out below.

We do not currently send an email notification when this Policy changes — beyond the transactional emails Firebase Authentication itself sends you, such as a password-reset email, FinCo has no general email notification channel today. Instead, we give notice of any change by posting the revised Policy with an updated 'last updated' date; material changes will be flagged as clearly as we can within the App itself. This Policy was last updated on 2026-09-15 and took effect on 2026-09-14. We encourage you to review it periodically.

Contact and Complaints

For any question about this Policy, or to make a request described in it — including deletion, portability, or another rights request — contact us at dev@7br.uno. Requests that require action, such as deletion, are handled within 30 days of a verified request.

For GDPR-specific matters, you can also reach our data protection contact at dev@7br.uno. For LGPD-specific matters, our Encarregado de Dados (Data Protection Officer) is the 7br.uno data protection team, reachable through the same dev@7br.uno address.

If you believe we have not resolved your concern appropriately, you have the right to lodge a complaint with your local supervisory authority — the data protection authority of your EU/EEA member state, the UK Information Commissioner's Office (ICO), or Brazil's Autoridade Nacional de Proteção de Dados (ANPD), as applicable to your location. We would appreciate the chance to address your concern directly first, at dev@7br.uno.