Privacy Policy

Information We Collect

Information You Provide Directly

• Account registration data — name, email address, and password
• Profile information — date of birth, occupation, and income range (used to personalize financial insights)
• Financial goals and milestones you set within the app
• Messages sent to the Capira AI coach
• Support communications, feedback, and survey responses

Information Collected Automatically

• Device identifiers — device ID, operating system type and version, app version
• Usage data — features accessed, screens viewed, session duration, button interactions
• IP address and approximate location (country and region level only)
• Crash reports, error logs, and performance diagnostics
• Push notification tokens (only if you grant permission)

Financial Information (via Plaid)

• Tokenized bank account references (we never store raw account or routing numbers)
• Transaction history — merchant names, amounts, dates, and categories
• Account balances — checking, savings, investment, and loan accounts
• Payroll and income data where you grant access
• Account holder name for identity verification

AI-Generated Data

• Financial insights, summaries, and personalized recommendations generated by our AI systems
• Chat history with the Capira AI coach, retained to maintain conversation context and continuity

How We Use Your Information

To Provide the Service

• Create and maintain your account and authenticate your identity
• Aggregate and categorize your financial transactions
• Generate personalized financial insights, spending summaries, and AI recommendations
• Power the Capira AI financial coach and maintain conversation context
• Track your progress toward financial goals and send milestone notifications
• Detect and alert you to anomalies such as duplicate charges, unusual spending, or suspicious activity

To Improve and Develop the Service

• Analyze usage patterns to improve features, performance, and user experience
• Train and improve our AI models using anonymized, aggregated data only — individual financial data is never used to train models in identifiable form without your explicit consent
• Diagnose and fix technical issues and crashes
• Develop and test new features

To Communicate with You

• Send transactional and account notifications — unusual spending alerts, goal milestones, and security alerts
• Respond to your support requests and inquiries
• Send important updates about the Service or changes to this Privacy Policy
• Send marketing or promotional communications — only with your consent, and you may opt out at any time

For Legal and Security Purposes

• Comply with applicable laws, regulations, and court orders
• Detect, investigate, and prevent fraud, abuse, and unauthorized access
• Enforce our Terms of Service and other agreements
• Protect the rights, property, and safety of Capira, our users, and the public

Financial Data and Plaid

Capira integrates with Plaid Technologies, Inc. to securely connect your financial accounts to the Service. Plaid is a regulated financial data infrastructure company used by leading financial applications worldwide.

How Plaid Works

When you choose to connect a bank or financial account, you are directed to Plaid's secure authentication interface to log in directly with your financial institution. Capira never sees, receives, stores, or transmits your banking username or password. Where supported by your institution, Plaid uses OAuth — meaning your credentials stay entirely with your bank.

What We Receive from Plaid

• Read-only access to account balances, transaction history, and account metadata
• Tokenized account references — not raw account or routing numbers
• Account holder name for identity verification purposes
• Investment holdings and portfolio data (where you grant access)

Revoking Access

You may disconnect any financial account at any time within the Capira app under Settings → Connected Accounts. You may also revoke Plaid's access directly through Plaid's Consumer Portal at my.plaid.com.

AI Features and Generated Insights

How Our AI Works

Capira's AI financial coach analyzes your linked account data — including transactions, balances, stated goals, and spending patterns — to generate personalized recommendations and answers to your financial questions. This analysis is performed using automated machine learning systems.

Important Disclaimer — Not Financial Advice

AI-generated insights are not reviewed by licensed human financial advisors in real time. Capira's AI is a personal finance management tool and does not constitute professional financial, investment, tax, or legal advice. All financial decisions remain yours. We strongly encourage you to consult a qualified professional for significant financial decisions.

AI Model Training

We may use anonymized, aggregated, and fully de-identified data to improve, evaluate, and train our AI models. Identifiable personal or financial data is never used for model training without your explicit, separately-obtained consent. You may opt out of contributing anonymized data at any time in Settings → Privacy → AI Improvement.

Data Storage and Security

Where Your Data is Stored

Your data is stored using Firebase services (provided by Google LLC), with infrastructure located primarily in the United States. For users in the EEA, UK, or Switzerland, international data transfers are conducted under appropriate legal safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

Security Controls We Implement

• Encryption at rest — all stored data is encrypted using AES-256
• Encryption in transit — all data transfers use TLS 1.2 or higher
• Authentication security — multi-factor authentication (MFA) supported and encouraged
• Access controls — role-based internal access; employees access your data only on a need-to-know basis
• Security monitoring — continuous monitoring for unauthorized access and anomalous activity
• Regular audits — periodic security assessments and penetration testing
• Vendor security — all third-party processors are contractually required to maintain appropriate security standards

Cookies and Analytics

In-App Analytics

The Capira mobile application uses Firebase Analytics and Firebase Crashlytics to collect usage and performance data. Data collected includes session information, screen views, device type, and crash logs. This information is used exclusively for product improvement and does not include the content of your financial data.

No Advertising Tracking

We do not use your data for third-party behavioral advertising. We do not participate in cross-app or cross-website advertising networks, and we do not share your data with advertising platforms for targeting purposes.

Opting Out of Analytics

You can opt out of in-app analytics data collection at any time by navigating to Settings → Privacy → Analytics within the Capira app.

Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Your Rights

Rights Under GDPR — EEA, UK, and Switzerland

• Right of AccessRequest a copy of the personal data we hold about you.
• Right to RectificationRequest correction of inaccurate or incomplete personal data.
• Right to ErasureRequest deletion of your personal data, subject to legal exceptions.
• Right to RestrictionRequest that we limit the processing of your data.
• Right to PortabilityReceive your data in a structured, machine-readable format.
• Right to ObjectObject to processing based on legitimate interests or direct marketing.
• Right to Withdraw ConsentWithdraw consent at any time without affecting prior lawful processing.
• Right to ComplainLodge a complaint with your local data protection supervisory authority.

Rights Under CCPA — California Residents

• Right to KnowRequest disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to DeleteRequest deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of SaleWe do not sell your personal information. If this ever changes, we will update this policy and provide a prominent opt-out before any sale occurs.
• Right to Non-DiscriminationWe will not discriminate against you for exercising any CCPA rights.

Third-Party Services

Capira uses the following third-party service providers, each bound by confidentiality and data processing agreements where required by law.

We do not sell, rent, or broker your data to any third party. We may disclose personal information to law enforcement or regulators when required by applicable law or valid legal process.

Children's Privacy

The Capira Service is intended for users who are at least 18 years of age. We do not knowingly collect, solicit, or process personal information from children under the age of 13 (or under 16 in the European Economic Area).

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@capirafinance.com. Upon verified notification, we will promptly delete such information from our systems.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, or legal requirements. When we make material changes, we will update the “Last Updated” date, notify you by email, and display a prominent in-app notice for at least 30 days before changes take effect.

Your continued use of the Service after the effective date constitutes your acknowledgment of the changes. If you do not agree, you may request account deletion by contacting support@capirafinance.com. Prior versions of this policy are available upon request.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us. We aim to acknowledge all privacy inquiries within 2 business days and resolve them within 30 days.

For EEA/UK users not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EEA authorities is available at edpb.europa.eu. For UK residents: ico.org.uk.