Legal
privacy policy.
Version 1.0 · Effective 1 September 2026
Caveat: This page summarises our current practices and does not constitute legal advice. If you have specific legal questions about data protection in your jurisdiction, consult a qualified legal professional. Data protection laws change, and this summary may not capture every local requirement — where anything here differs from our full Privacy Policy, the full policy governs.
🚫 Never stored
Statements are parsed in memory, then discarded
🔒 Encrypted
TLS in transit · encrypted at rest by our providers
🇺🇸 US infrastructure
Servers, database and AI processing in the US
🗑️ Yours to delete
Export or erase everything, without asking us
General Policy
1. Who we are, and who this covers
UburuIO, a Maple & Chen Company ("Uburu", "we", "us") is formed under the laws of the State of Wyoming, United States, with its registered address at 5830 East 2nd St, Suite 99333, Casper, WY 82609, USA. We are the data controller for the personal data described here. This policy covers the Uburu web application, the mobile applications, and our marketing site, and applies to everyone who uses Uburu anywhere in the world. Contact: privacy@uburu.io.
1.1 EU and UK users — Article 27 representative, in process
We currently operate a waitlist in the EU and UK: we hold your email address, but we do not yet process financial data for EU or UK residents. Because we have no establishment in the EU or UK, Article 27 of the GDPR requires us to appoint a local representative before we begin processing EU/UK financial data. We have not yet appointed one, and we will do so before EU/UK launch. We would rather tell you that than imply a compliance posture we do not yet hold.
2. What we do not do
We never ask for your bank login — no account linking, no credentials, ever. We do not sell your data, to advertisers, data brokers, or anyone. We do not show third-party advertising and we do not use retargeting or behavioural ad-tracking cookies. We do not train any model of our own on your financial data.
3. What we collect
Documents you upload are processed in memory and never stored: a statement or paystub is read, parsed, and discarded within the same request. There is no copy on our servers, in any bucket, or in any backup. What we do keep is the information inside them — your transactions, and details such as your bank name and the last four digits of an account. That is the product, and we are explicit about it. We also hold what you give us directly (name, email, account credentials, profile and goals), technical information (IP address, browser and device identifiers, session tokens, usage logs), and, only with your consent, product-analytics events.
4. Who processes your data, and where
Our servers, database and AI processing are in the United States. Our processors include cloud hosting and database providers, Stripe for payments, Resend for email delivery, Clerk for authentication, Anthropic for AI processing, and — only if you opt in — Mixpanel for product analytics, on their EU-hosted project. Each acts under a data processing agreement. Where personal data is transferred out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses and, for UK data subjects, the UK International Data Transfer Addendum.
4.3 AI processing — what the model sees
Uburu uses Anthropic's Claude models to read uploaded documents, extract transactions, categorise spending, and generate written insights. What is sent: the document contents at parse time, and transaction data when generating insights. What is not sent: your name, email address, authentication credentials, or payment details. Written terms with our AI provider are in process — we are finalising an agreement with Anthropic confirming that your financial data is not used to train their models and is not retained beyond the period required to process your request. That agreement is not yet concluded, and until it is we state only what we can stand behind today. Transaction categorisation is automated but has no legal or similarly significant effect, and you can override any category or request human review at privacy@uburu.io.
5. Sharing with a partner — the Pair feature
Uburu Pair links exactly two accounts. Everything starts private: no transaction or statement reaches your partner until you take a deliberate action to share it. Your partner can see only what you explicitly share — transactions you mark shared, accounts you designate joint, shared goals, recurring bills, and comments on shared items. Your partner can never see your balances, your unshared transactions, your statements, your income unless you share it, or your private goals and notes. When either of you disconnects, all sharing is revoked at that moment, independent of any billing arrangement.
6. How we protect your data
Encryption in transit (TLS). Encryption at rest, as provided by our database and hosting providers. Row-level isolation between users. Access to production data restricted on a need-to-know basis. Rate limiting on sensitive endpoints. We hold no security certification: we make no SOC 2, ISO 27001 or equivalent claim, because we have none, and we would rather state that plainly than imply an audit posture we do not hold. The strongest protection here is architectural — we never hold your banking credentials, so there is nothing of that kind to steal.
7. How long we keep it
We keep your account and the information extracted from your documents for as long as your account is active. Uploaded files themselves are never stored, so there is nothing to retain. On account deletion, your data is permanently purged within 30 days, save for records we must keep by law. You may request deletion of specific data at any time by emailing privacy@uburu.io.
8. Your rights, and how to use them
You can export everything you have in Uburu, and delete your account and its data, from within the app, without asking us. You may also request access, rectification, erasure, restriction, portability, or object to processing, by emailing privacy@uburu.io. We respond within 30 days. We will not terminate an account or degrade the service merely because you exercised a privacy right.
9. Children
The Service is not directed to individuals under 18 and we do not knowingly collect personal information from children. If we learn that a minor has provided personal information, we will delete it promptly. If you believe a child has created an account, contact privacy@uburu.io.
10. Changes to this policy
We may update this policy. We will notify you of material changes by email and in-app at least 14 days before they take effect. The version and effective date at the top of this page reflect the current revision, and continued use after that date constitutes acceptance.
12. Contact
Privacy and data protection: privacy@uburu.io · General support: support@uburu.io · Postal: UburuIO, a Maple & Chen Company, 5830 East 2nd St, Suite 99333, Casper, WY 82609, USA.
Your rights by country and region
🇪🇺 European Union / EEA — GDPR
Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. Lawful bases: performance of contract, consent (analytics and marketing email), legitimate interests (security, fraud prevention, service improvement), and legal obligation. You may withdraw consent at any time and complain to your national supervisory authority. Transfers to the US rely on Standard Contractual Clauses. We have not yet appointed an Article 27 representative — see section 1.1 above.
🇬🇧 United Kingdom — UK GDPR / DPA 2018
The same rights as under the GDPR. You may complain to the Information Commissioner's Office (ico.org.uk). Transfers rely on the UK International Data Transfer Addendum. A UK representative will be appointed before UK launch.
🇺🇸 United States — CCPA/CPRA and state laws
California residents: the right to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not in the preceding 12 months. Financial account information is "sensitive personal information" and we use it solely to provide the service. Equivalent rights apply in Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Uburu is established in Wyoming, which has no comprehensive consumer privacy statute of its own — that does not narrow your rights, because the protections above attach to where you live, not to where we are formed. Requests: privacy@uburu.io, subject line "Privacy Rights Request".
🇨🇦 Canada — PIPEDA and Quebec Law 25
Access, correction, and withdrawal of consent. You may complain to the Office of the Privacy Commissioner (priv.gc.ca). Quebec residents additionally have portability, de-indexation, and the right to be informed of automated decisions. Your data is processed in the United States.
🇳🇬 Nigeria — NDPR 2019 / NDPA 2023
Access, rectification, erasure, objection, portability, and withdrawal of consent. You may complain to the Nigeria Data Protection Commission (ndpc.gov.ng). Cross-border transfers to the United States are made under NDPA safeguards. Contact: privacy@uburu.io.
🇿🇦 South Africa — POPIA
The right to be notified that your personal information is being collected, to access it, to request correction or deletion, to object to processing, and to complain to the Information Regulator (inforeg.org.za). Contact: privacy@uburu.io.
🇧🇷 Brazil — LGPD
Confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, deletion of data processed on consent, information about sharing, and withdrawal of consent. You may complain to the ANPD (gov.br/anpd).
🇰🇪 Kenya — Data Protection Act 2019
Access, rectification, erasure, restriction of processing, portability, and objection. You may complain to the Office of the Data Protection Commissioner (odpc.go.ke).
🇸🇬 Singapore — PDPA
Access, correction, withdrawal of consent on reasonable notice, and portability for selected categories of data. You may complain to the Personal Data Protection Commission (pdpc.gov.sg).
If your country is not listed, you may still contact privacy@uburu.io to exercise any right available to you under local law, and we will honour it where the law requires.
Privacy questions? Email us at privacy@uburu.io. We respond to data subject requests within 30 days.