Capybai privacy policy
Last updated: 1 November 2026
This policy is published at https://capybai.com/privacy.
This policy explains what Capybai collects, why, who we share it with, how long we keep it and what you can do about it. Capybai is an iPhone app where an AI capybara helps you with your money.
Who we are
Capybai is run by LUCI & CO, Lucian Horvat s.p., a sole proprietor registered in Slovenia, [ADDRESS] (D-U-N-S 575684267). We are the controller of your personal data.
Contact: support@capybai.com. [TO CONFIRM: whether a UK representative (UK GDPR Art. 27) is needed.]
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | your name, email and a user ID from Sign in with Apple or Google | you, through Apple or Google |
| Onboarding answers | your money goal, what gets in the way, your pay cadence, the mode you picked | you |
| Your plan | income, must-pays, savings goal, deadline, set-aside, fun money, buffer | you, and changes you confirm in the chat |
| Bank data | account names, balances, transactions (date, amount, merchant, category) and recurring payments, for up to 12 months back and then ongoing | your bank, through Plaid (US) or Tink (EU and UK), after you link it |
| Chat | your messages, Capybai's replies and their timestamps | you and Capybai |
| Photos you send | receipts or screenshots | you |
| Capybai's memory of you | facts from your chats and a profile: your money habits, goals, what tone works for you | created by Capybai from your chats, plan and bank data |
| Notifications | a push token for each of your devices, your alert settings | your iPhone |
| Subscription status | which plan you have, trial and renewal dates | Apple's App Store. We never see your payment details. |
| Usage analytics | which screens you see and what you tap, in coarse buckets, not linked to your account | the app, through Google Analytics for Firebase |
| Crash reports | device model, iOS version, app version and what the app was doing when it crashed | the app, through Firebase Crashlytics |
| Security data | App Check results, request logs without message text | the app and our servers |
| Reports | a Capybai message you report and its text | you, when you tap "report". We read reports to improve Capybai's safety. |
We don't collect your bank login. You sign in on your bank's own screen, and Plaid or Tink handle that.
Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Run Capybai: the chat, the plan, cards, recaps and alerts | account, answers, plan, bank data, chat, photos, memory, notifications | contract (Art. 6(1)(b)) |
| Personalise how Capybai talks to you (the profile) | memory and profile | contract (Art. 6(1)(b)) [TO CONFIRM: with counsel, given the DPIA]; you can switch it off with "don't personalise me" |
| Send your data to OpenAI to write replies | chat, photos, plan, bank summary, memory | your explicit permission, asked before the first reply |
| Send push notifications | push token, alert settings | your consent through iOS's permission prompt. Notifications show Capybai's full message, also on the lock screen, unless you change iOS's Show Previews setting. |
| Usage analytics | analytics | your consent, asked in the app; you can turn it off in privacy & data |
| Crash reports | crash reports | your consent, asked in the app; you can turn it off in privacy & data |
| Keep Capybai secure and prevent abuse | security data | legitimate interests (Art. 6(1)(f)) |
| Meet legal obligations | records we must keep | legal obligation (Art. 6(1)(c)) |
How Capybai's AI uses your data
- Capybai's replies are written by an AI model (OpenAI). For each reply, our server sends the model your profile and memory facts, your plan, a summary of your bank data and your recent messages.
- Every number Capybai shows is calculated by our server from your data, not made up by the AI.
- Capybai builds a profile of your money habits so it can talk to you in a way that helps. This is profiling. It doesn't make decisions with legal or similarly significant effects on you: it can't move money, approve credit or change your plan without your tap.
- Capybai doesn't store sensitive inferences (health, religion, sexuality, politics), and never uses your profile to push spending or sell you things.
- You can see, edit and delete what Capybai remembers in settings › privacy & data.
- You can turn on don't personalise me there. Capybai then stops building and using the profile and deletes the one it has. It still uses your plan, bank data and recent chat. Turning it back off starts a fresh profile.
- Before Capybai's AI sees any of your data, the app asks your permission and names OpenAI. You can withdraw it in privacy & data; the chat then stops, because it can't work without the AI.
- OpenAI processes this data for us. OpenAI doesn't use data sent through its API to train its models. [TO CONFIRM: zero data retention is on for our account (5.7).]
- Capybai gives general money guidance, not financial advice.
Who we share it with
We don't sell your data and we don't use it for ads or tracking. We share it only with the processors that run Capybai for us:
| Processor | What for | Where |
|---|---|---|
| Google (Firebase, Google Cloud) | sign-in, database, servers, notifications delivery, analytics, crash reports | EU (Frankfurt, europe-west3) for the database and servers; analytics and crash reports may be processed in the US |
| OpenAI | writing Capybai's replies, reading photos you send | US |
| Plaid | connecting US bank accounts | US |
| Tink | connecting EU and UK bank accounts | EU |
| Apple | Sign in with Apple, push notifications, App Store subscriptions | US and worldwide |
[TO CONFIRM: signed data processing agreements with each processor.] When data leaves the EU or UK, it is protected by the EU-US Data Privacy Framework or standard contractual clauses.
How long we keep it
| Data | How long |
|---|---|
| Photos you send | deleted right after Capybai has read them |
| Account, answers, plan, mode, settings | while your account exists |
| Chat and Capybai's memory of you | while your account exists, unless you delete them sooner in privacy & data |
| Bank transactions | 24 months, then older ones are deleted. Unlinking a bank deletes its accounts and transactions at once. |
| Inactive accounts | after 24 months without use we warn you, and delete the account 30 days later if you don't come back |
| Push tokens | until you sign out on that device or delete your account |
| Server logs | 30 days. They contain no message text and no personal details. |
| Analytics | 2 months in Google Analytics |
| Crash reports | 90 days in Crashlytics |
| Backups | a deleted account is gone from the live data at once and from backups within 35 days |
Deleting your account
settings › delete account deletes everything right away and can't be undone: your chat, memory and profile, plan, onboarding answers, bank connections (we revoke them at Plaid or Tink), imported transactions, push tokens, photos and your login. We also ask Google Analytics to delete the data tied to your app install. Only anonymous counts remain.
Your App Store subscription is with Apple. Cancel it in the App Store first, because deleting your account doesn't cancel it.
Your rights
You can ask us to:
- show you the data we have about you, and give you a copy (you can also export it in privacy & data)
- correct it
- delete it
- restrict or object to how we use it
- move it to another service
You can withdraw consent at any time (for analytics, crash reports or notifications) without affecting what happened before. Write to support@capybai.com. We answer within one month.
You can also complain to your data protection authority. Our lead supervisory authority is Slovenia's Information Commissioner (Informacijski pooblaščenec, ip-rs.si). In the UK that's the ICO.
Security
Bank tokens are encrypted on our servers, and the app never sees them. Your data is only readable by you and our servers. Capybai can only read your bank data: it can't move, send or spend money.
Children
Capybai is for people aged 18 and over. It's rated 18+ on the App Store.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it applies.