Acceptance and Scope

These Terms of Service ("Terms") govern access to and use of FinCo (the "Service"), operated by 7br.uno, registered at R. Moacir Guimarães, 37 - Sacoma, São Paulo - SP, 04256-390, Brazil under registration number 41.077.742/0001-00 ("we", "us", "our"). By creating an account, linking a bank connection, authorizing an AI or MCP client, or otherwise using the Service, you ("you", "the user") agree to be bound by these Terms.

FinCo is a personal finance and wealth-tracking application. It lets you record income, expenses, transfers, and recurring transactions; link external bank and investment accounts through Plaid; review stock forecasts built from third-party market data; and, if you choose, grant an external AI assistant access to your ledger through our MCP integration. These Terms apply to every part of the Service, including features added after the date you first accepted them.

A separate Privacy Policy describes in more detail how we collect, use, and retain personal data. Where these Terms and the Privacy Policy both address a data-handling topic — such as bank connections, AI access, or account deletion — the two documents are meant to be read together, and neither overrides the factual limits described in the other.

Eligibility and Your Account

You must be at least 18 years old and legally capable of entering into a binding contract in your place of residence to use the Service. If you are located in the European Economic Area, the United Kingdom, or Brazil, you also confirm that using the Service and providing the personal data it requires complies with applicable data protection law in your jurisdiction (GDPR or LGPD, as relevant).

You must provide accurate registration information and keep it current. Authentication is handled by Firebase Authentication; if you request a password reset or receive a security notice, it is sent by that underlying authentication system, not by a separate FinCo mailing list.

You are responsible for keeping your account credentials confidential and for all activity that happens under your account. If you believe your account has been accessed without authorization, contact us immediately at dev@7br.uno.

License

Subject to your compliance with these Terms, we grant you a personal, non-exclusive, non-transferable, revocable license to access and use the Service for your own personal financial record-keeping. The Service remains privately owned, and every right not expressly granted to you here is reserved by us.

Access is limited to you and to any other individual we have explicitly authorized in writing; you may not share your account, or let anyone else use it, without that authorization. You may not copy, modify, distribute, reproduce, reverse engineer, sublicense, resell, or otherwise exploit the Service or its underlying software beyond this personal-use license, and any unauthorized use immediately terminates the license granted here.

Consistent with this personal-use license, the Service is provided to you as is, without warranties of any kind; the full disclaimer applicable to your use is set out in Disclaimer of Warranties below. This reflects that the Service is offered to support your own personal use, not as a commercially warranted product.

Acceptable Use

When using the Service, you agree that you will not do any of the following. A breach of this section is grounds for suspension or termination under the Suspension and Termination section below.

• Attempt to access another user's ledger, account, or bank connection, or probe, scan, or test the Service's security.
• Interfere with or disrupt the Service, its APIs, or the infrastructure it runs on, including by introducing malware or attempting to bypass rate limits.
• Use the Service for any unlawful purpose, including money laundering, fraud, or tax evasion, or to record transactions you know to be false.
• Impersonate another person, or misrepresent your affiliation with any person or entity, when using the Service or any AI client connected to it.
• Authorize an AI or MCP client to act beyond the scope you actually intend to grant it, or share the credentials of an AI/MCP authorization with anyone else.

Not Financial Advice

FinCo is a record-keeping and informational tool. Nothing in the Service — including balances, projections, budget suggestions, or any other feature — constitutes financial, investment, tax, accounting, or legal advice, and it is not a substitute for advice from a licensed professional.

Stock forecasts shown in the Service are informational only and are not investment advice. They are model-backed detections paired with a suggested position size, never an instruction to trade. Acting on a forecast requires you to separately review a trade preview, which defaults to a dry run, before anything is submitted, and you alone decide whether to confirm it. You are solely responsible for any investment or financial decision you make, whether or not it is informed by a forecast.

Bank Connections

FinCo uses Plaid, a third-party service, to let you connect external bank and investment accounts to your ledger. When you link an account, you authenticate directly with your bank or Plaid, not with us, and Plaid issues an access token that lets us request account and transaction data on your behalf. Your use of Plaid's own linking flow is also subject to Plaid's terms and privacy policy.

Once linked, we use that access to read account balances and transaction history so they can be reflected in your FinCo ledger. We store the access token in encrypted form together with the identifiers Plaid assigns to the connection, and the transactions already retrieved before you disconnect.

Disconnecting a bank connection in the Service stops further syncing and marks the connection as disconnected; it does not delete anything. The encrypted access token, the Plaid connection identifier, and every transaction already ingested from that connection remain stored after you disconnect. If you want that data removed rather than just disconnected, you need to make a separate deletion request as described in Your Data and Your Responsibility.

• Encrypted bank access token, the Plaid connection (item) identifier, and all transactions already imported from that account.

AI and MCP Integrations

FinCo exposes part of your ledger to external AI assistants through an MCP (Model Context Protocol) server, using OAuth to authorize a specific AI client. This is an optional feature: an AI client only gets access if you deliberately go through the authorization flow and grant it one or more scopes.

Two scopes are available, and both apply to your entire ledger rather than to individual accounts or transactions you select one at a time. Granting a scope to a client lets it act on your ledger to that extent for as long as its authorization is valid.

Access tokens issued to an AI client are self-contained, signed tokens; we do not currently maintain a deny-list that can invalidate an individual token the instant you revoke it. Practically, this means that after you revoke or remove a client's authorization, that client's already-issued token can keep working for up to about an hour, until it naturally expires, rather than being cut off immediately. We also do not yet offer an in-app screen listing every AI client currently holding access to your account, so treat any authorization you grant as active until its token would have expired, not as something you can confirm is off the moment you revoke it.

Every call an authorized AI client makes to a FinCo tool, including its full request and response payload, is logged for security and troubleshooting purposes in an internal audit record kept separately from your own account data. These logs are not deleted on a schedule and are not covered by the deactivated-not-erased handling described elsewhere in these Terms — do not treat AI tool usage as unlogged or as something that expires on its own.

• finco:read — lets the client read your ledger: transactions, recurrences, wallets, assets, contacts, and forecasts.
• finco:write — additionally lets the client create or modify ledger data on your behalf, such as recording a transaction or previewing a trade.

Your Data and Your Responsibility

For personal data processed through the Service, 7br.uno acts as the data controller under the GDPR and as the controlador under the LGPD. Questions about how your personal data is used, or requests concerning it, can be sent to dev@7br.uno; our data protection contacts are dev@7br.uno for GDPR matters and the 7br.uno data protection team as encarregado de dados for LGPD matters.

The Service processes several categories of personal data in order to work:

Deleting something inside FinCo — a transaction, a contact, a wallet, a recurrence — is a soft delete: the record is marked with a deletion timestamp and disappears from your normal views, but it is deactivated, not erased, and remains stored on our systems. There is no self-service option in the app to delete your account or export a full copy of your data. To request deletion of your account or specific data, or to request a copy of it, email dev@7br.uno; we aim to act on deletion requests within 30 days, subject to any retention we are legally required to keep (for example, financial record-keeping, fraud prevention, or an ongoing dispute).

Depending on where you live, you have rights over your personal data under the GDPR (including access, rectification, erasure, restriction, portability, and objection) or the LGPD (including confirmation of processing, access, correction, anonymization or blocking of unnecessary data, portability, and revocation of consent). We handle every one of these as a manual request to dev@7br.uno — there is no automated self-service flow for any of them, portability included, and a request for a copy of your data is compiled and sent to you rather than downloaded from the app.

Your data is stored in Google Cloud Firestore, in the southamerica-east1 region, and files you upload are stored in Firebase Storage, in the southamerica-east1 region. Depending on your location, this involves a transfer of personal data to those regions and to the other processors described in this document (Plaid, our market-data providers, Firebase/Google, and any AI client you authorize), and we rely on appropriate safeguards for such transfers where required. We have not yet designated a representative in the EU or the UK under GDPR Art. 27, because we do not yet have users based in either jurisdiction — see the Privacy Policy's International Data Transfers section for details.

Content you upload to the Service, including a profile photo, is stored in our cloud storage. Storage access for this content is not currently restricted to only you — another signed-in user of the Service may be able to access a file you have uploaded there — so do not upload a photo or file you would not want another authenticated user to see.

You are responsible for the accuracy of the information you enter or import into your ledger, and for any decision you make based on it. You are also responsible for reviewing which AI clients you authorize and what you upload to the Service, since both are described above as not fully private or instantly reversible.

• Identity and account data — your name, email address, and authentication identifiers.
• Ledger data you enter or import — transactions, recurrences, wallets, assets, contacts, tags, and budget settings.
• Bank connection data from Plaid — encrypted access tokens, connection identifiers, and the account and transaction data they let us retrieve.
• Device and usage data collected through Firebase Analytics — app events, general usage patterns, and technical/device information.
• AI/MCP access data — records of which AI clients you have authorized, the scopes granted, and logs of the tool calls they make.
• Aggregate and community data — de-identified or aggregated patterns computed across users, such as community-level suggestions; there is no per-user setting to opt out of contributing to these aggregates today.
• Access — confirmation of what personal data we hold about you and a copy of it.
• Rectification/correction — correction of inaccurate or incomplete data.
• Erasure request — a request that we delete or anonymize data we are not legally required to keep, actioned manually as described above.
• Portability request — a request for your data in a portable format, compiled and sent manually; there is no automated export.
• Objection/restriction — objecting to, or asking us to restrict, a particular processing activity.
• Complaint — the right to lodge a complaint with your local data protection supervisory authority (for example an EU/UK data protection authority, or Brazil's ANPD), independently of contacting us.

Third-Party Services and Market Data

The Service depends on a number of third-party providers to work. Using the corresponding feature means that provider processes the data that feature needs, under its own terms, in addition to ours.

Stock forecasts and the candlestick pattern detection behind them are built on price and candle (OHLCV) data sourced from third-party market-data providers. We do not control, and do not guarantee, the accuracy, completeness, or timeliness of that third-party data, and an outage, rate limit, or data error at a provider can delay or degrade forecast-related features without notice.

We use Firebase Analytics (a Google product) to understand how the Service is used and to help us improve it. It may collect device, usage, and event-level data as described in our Privacy Policy; Google's own privacy practices govern how it further processes that data on its side.

• Plaid — bank and investment account linking (see Bank Connections).
• Market-data providers — third-party price and candle data behind stock forecasts.
• Firebase Analytics (Google) — usage and event analytics.
• Any AI/MCP client you authorize — once authorized, that client's own handling of the ledger data you grant it is between you and that client's provider.

Availability and Changes to the Service

We do not guarantee that the Service will be available at all times or free of errors. Maintenance on our side, or an outage at Plaid, a market-data provider, or Firebase, can make part or all of the Service temporarily unavailable, and we offer no uptime commitment.

FinCo is a Progressive Web App with limited offline support: only the core application shell is cached in advance for offline use. Informational pages such as this one are loaded on demand rather than cached ahead of time, so they, and similar legal or secondary pages, may not open if you are offline the first time you try to view them.

We may add, change, suspend, or remove features of the Service at any time, including features described in these Terms. You should not assume a feature described here will remain available indefinitely in its current form, and such a change does not by itself require us to republish this document unless it affects what these Terms promise.

Suspension and Termination

We may suspend or terminate your access to the Service if you breach these Terms, if we reasonably suspect fraud or unlawful use, or if we are required to do so by law or by a provider such as Plaid. We will generally try to give you notice where we can do so without compromising security or legal compliance, but immediate suspension may be necessary in serious cases.

You may stop using the Service at any time. Because there is no self-service account deletion in the app, closing your account and requesting removal of your data both require emailing dev@7br.uno; we aim to act within 30 days of a verified request.

When your account is suspended or terminated, your access is disabled and your records are marked inactive rather than immediately erased — the same deactivated-not-deleted behavior described in Your Data and Your Responsibility applies, and any linked bank connection is marked disconnected rather than purged. Data may be retained afterward for legal, accounting, security, or dispute-resolution purposes until any deletion request you make is completed.

Disclaimer of Warranties

The Service, including its forecasts, analytics, and any data supplied by Plaid, our market-data providers, or an AI/MCP client, is provided "as is" and "as available", without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy, or non-infringement. We do not warrant that the Service, or any third-party data it displays, will be uninterrupted, error-free, or free of inaccuracies.

Limitation of Liability

To the maximum extent permitted by applicable law, our total aggregate liability to you arising out of or relating to the Service is limited to the greater of USD 100 or the fees you paid us in the 12 months before the claim. This cap applies regardless of the legal theory behind the claim, whether contract, tort, or otherwise.

To the same extent, we are not liable for indirect, incidental, special, consequential, or punitive damages, for lost profits or lost data, for any financial or investment decision you make based on a forecast or any other information in the Service, or for the acts, omissions, or unavailability of a third-party provider such as Plaid, a market-data provider, Firebase, or an AI/MCP client you have authorized. Nothing in this section limits liability that cannot lawfully be limited, such as liability for our own fraud or, where applicable, gross negligence.

Indemnity

You agree to indemnify and hold us harmless from any claim, loss, or expense, including reasonable legal fees, arising from your breach of these Terms, your misuse of the Service, the scope you grant to an AI/MCP client you authorize, or content you upload to the Service, except to the extent the claim results from our own breach of these Terms or applicable law. This obligation survives termination of your account.

Governing Law and Disputes

These Terms are governed by the laws of Brazil, without regard to its conflict-of-laws rules, and the courts of Brazil have jurisdiction over any dispute arising from them, except to the extent applicable law gives you the right to bring a claim in your own place of residence. Mandatory consumer-protection rules that apply to you in your place of residence, if any, are not overridden by this clause.

If a dispute arises, contact us first at dev@7br.uno so we can try to resolve it directly before either party pursues a formal claim. This does not require you to waive any right to bring a claim before a court or a data protection authority; it simply reflects that most concerns can be resolved by writing to us directly.

Nothing in this section limits a right you have under the GDPR or the LGPD that cannot be waived by contract, including the right to lodge a complaint with your local data protection supervisory authority regardless of what is agreed here.

Changes to These Terms and General Provisions

These Terms take effect on 2026-09-14 and were last updated on 2026-09-15. We may revise them from time to time as the Service changes.

We do not currently have a general email notification channel — the only automated emails we send are Firebase Authentication's own transactional messages, such as a password reset. Because of that, we give notice of a change to these Terms by posting the updated document with a new last-updated date, not by emailing you; check the date above to see whether the Terms have changed since you last read them.

These Terms, together with our Privacy Policy, are the entire agreement between you and us about the Service and replace any earlier agreement on the same subject. If a term here conflicts with an informal statement made elsewhere, these Terms control unless we have agreed otherwise with you in writing.

If any provision of these Terms is found unenforceable, the rest of the Terms remain in full effect, and the unenforceable provision is read as narrowly as needed to make it enforceable. This does not affect the validity of the remaining provisions or of these Terms as a whole.