Privacy policy

Ferrario holds payslips, bank statements, tuition letters, contracts and tax returns, and the things you tell its assistant about your life. This page says exactly what happens to all of it, in the order the questions actually get asked. It is written to be read, not to be survived — where the law requires a term of art, the plain sentence comes first.

Who is responsible

Ferrario is operated by Giorgio Vittorio Ferrario ("we"). We are the controller for the personal data described here: we decide what is collected and why. If Ferrario is moved into a company, this page will name it, with its registered address, before it takes over that role.

Contact for anything on this page, including every right below: privacy@ferrario.ai. The postal address and the establishment details that fix which supervisory authority supervises us are added here before public launch.

This is a pre-launch document. Ferrario is not open to the public and has not been deployed. It runs on development machines with invented people's data, and a closed test with a small group of students is being prepared. This page is committed now so that it is reviewed before anyone's real documents are in it, and so that the product and the policy are written together.

What we hold, and why

Your account. Your email address, a hashed password (we never see the password itself), and, if you turn it on, the secret behind your second sign-in factor.

What onboarding asks. When you create an account, Ferrario asks about your life as a student: the name you want to be called, where you live and study, your year and course, how your housing and tuition are paid, what family covers, where your income comes from, one goal, and anything else you want to add in your own words. Every question can be skipped or answered "not sure". You also choose the assistant you want to talk to — an animal, its voice and its personality — which changes wording only.

Your profile and preferences. Name, date of birth if you give it, whether you are studying or working, language, theme, text size, motion and the assistant you chose. Your date of birth is not decoration: the lifetime net-worth curve begins at it.

The documents you upload. Whatever you choose to give us. We store the file itself and a fingerprint of its contents, used to notice when you upload the same file twice.

The figures in your file. Every figure carries where it came from, and there are four kinds:

• From a document — the page and the exact sentence it was read from, a confidence score, and whether you have confirmed it. Nothing read by the AI enters a figure you see until you have.
• Told to Ferrario — an amount you typed yourself, with the sentence you wrote and when.
• Estimated — clearly marked as such, and never shown as evidence.
• From a bank — when you choose to connect a bank through Plaid, Ferrario sends Plaid a stable, pseudonymous Ferrario user identifier. In Sandbox, accounts and transactions are synthetic. When the service is configured for Plaid Production, your bank authorises Plaid to provide the accounts, balances and transactions it supports. Savings funds and investment holdings may not be available through that connection. Ferrario stores the Plaid access token encrypted in a server-only table; it is never sent to your browser. A connected balance may be cached rather than live. You can disconnect the bank in Your Info; imported financial history stays in Ferrario until you delete your account or its records.

What the assistant remembers. Ferrario's assistant remembers what you tell it anywhere in the app — your studies, your plans, who helps you — so you do not have to repeat yourself. A memory never holds an amount; an amount you state becomes a Told to Ferrario figure instead, and only if it appears in your own words. You can see what it remembers and ask it to forget (the What do you want the assistant to forget? control in Your Info). Forgetting can be undone until you delete the account.

What you write. Notes, messages to the assistant, goals, forecasts and scenarios you create, and support requests.

Sharing records. If you share part of your file with someone, who they are, what you allowed, and every time they looked.

Records of what happened. An append-only log of changes to your documents and figures, and of every access by someone you shared with. It records that something happened, never what the money was.

Security and operations records. Failed sign-in attempts and rate-limit counters, errors, and blocked-content reports from your browser. They contain no document contents.

Model usage. For each AI call: which feature, which model, how many tokens, what it cost and how long it took — so per-person limits can be enforced. It contains none of your document contents.

Activity. The days on which you used Ferrario (a date, not a trail of clicks), so we can tell whether the product is used at all.

We do not collect browsing history, advertising identifiers, location or contacts. We do not buy data about you from anyone.

Why we are allowed to hold it

• Performing our contract with you (GDPR Article 6(1)(b)) — reading your documents, building your figures, remembering what you told the assistant, showing you your own financial picture and keeping your account working. This is the basis for almost everything Ferrario does. It is not consent: you cannot withdraw consent for the thing you asked the product to do, but you can delete your account and take everything with you, at any time.
• Your explicit consent (Article 9(2)(a)) — where a document happens to reveal something in a special category. A payslip can show a trade-union subscription; an insurance letter can imply health information. Ferrario will ask for this consent separately, before your first upload, and it can be withdrawn — withdrawing it deletes those documents. This step is being built before the first real upload; until it is live, Ferrario does not accept real documents.
• Our legitimate interests (Article 6(1)(f)) — keeping the service secure: the audit log, the attempt limits on sign-in, bot protection and abuse controls. We consider these unsurprising to anyone who wants their financial documents kept safe.
• Legal obligation (Article 6(1)(c)) — where the law requires us to keep or produce something.

Who else sees it

The list is short on purpose. Each is our processor, bound by a data processing agreement, and may use your data only to provide its service to us.

• Supabase — database, sign-in and file storage, in the European Union (Frankfurt).
• Plaid — only when you choose to connect a bank. Plaid handles the bank authorisation and provides the account and transaction data that the bank makes available.
• Anthropic — the AI (Claude) that reads your documents and writes the assistant's words. Content is sent only for the task at hand: one document per request for reading, and the confirmed figures and memories a given answer needs. Under Anthropic's commercial terms your data is not used to train models, and it is kept only for the limited period those terms allow. Anthropic processes data in the United States — see Where it goes.
• OpenAI — only when you request suggestions in the Savings & Goals transaction review. Ferrario sends the unresolved transaction descriptions, dates, amounts, currency, direction and account type needed to propose a purpose. It does not send the statement file for that task. The suggestions do not change your figures until you confirm them.
• The hosting provider that runs the application — planned: Vercel, in its Frankfurt region.
• Cloudflare — planned: domain name service and bot protection on the sign-up and sign-in forms.
• An email provider — planned, for sign-in and account emails. Named here before it sends any.

Before launch, every "planned" entry above is either confirmed or replaced. The optional OpenAI review must have appropriate provider terms and data-transfer documentation before wider release.

We use no advertising networks, no analytics that identify you, and no data brokers. We do not sell your data, and we never will.

People you choose to share with see only what your grant says they may: a helper you invite can see the parts you tick and nothing else, and every one of their accesses is written to your log.

An organisation you joined through an invitation link (a university, for example) sees only how many people joined and reached each step — never your documents, balances, spending or chats.

Where it goes

Your file — the database, your documents and your backups — is held in the European Union.

AI processing is an exception to EU-only file storage. Document reading and assistant answers send the content needed for that task to Anthropic in the United States. The optional Savings & Goals review sends only the transaction context described above to OpenAI when you request suggestions. Before this feature is offered beyond local development, its processing location and transfer terms must be checked and documented here. If an EU-only option becomes available and practical, we will review it and update this paragraph.

How long we keep it

• While your account exists, we keep what you have given us — because that is the product: your financial history stays reconstructable.
• When you delete your account, your files are removed from storage first, then every record. Nothing is kept and nothing can be recovered afterwards. It happens while you wait.
• Demo worlds start with an invented student's figures and are private to one visitor. If you add anything, it stays in your copy until you reset it or it is removed. Reset deletes the previous copy. On the hosted service, a daily cleanup removes demo copies once they are at least a day old; removal can wait until the next run. Do not put real documents in a demo. Before hosting, cleanup is run manually by the operator.
• Backups may hold a copy for up to 30 days before rotating out. This is the one place where "deleted" briefly means "unreachable, pending rotation".
• Audit and security records are kept for 12 months, because a breach investigation that cannot look back is not an investigation.

Automated decisions

Ferrario does not make automated decisions that produce legal effects for you or similarly significantly affect you (Article 22). The AI proposes; you confirm. A figure the AI read and you have not confirmed does not enter a single number on any screen, and there is no scoring, ranking, eligibility or pricing decision made about you anywhere in the product.

More on how the AI works, and what it may never do, is on the AI page.

Your rights

You can exercise most of these yourself, in the product, at Settings → Your data:

• See it (Article 15) — one file with every record we hold about you, plus links to your original documents.
• Take it elsewhere (Article 20) — the same file, in JSON, made when you ask for it.
• Correct it (Article 16) — figures are corrected by superseding them, so what a document said stays on record and the correction is visible rather than silent. Anything the assistant remembers can be made to forget.
• Erase it (Article 17) — deleting your account destroys everything.
• Restrict or object (Articles 18 and 21) — write to us and we will act on it.
• Withdraw consent (Article 7(3)) — for special-category data, at any time, with the effect described above.
• Complain — to your data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens). We would rather you wrote to us first, but that right does not depend on us.

We answer within one month.

Security

In short: every table is isolated per person by the database itself rather than by application code; documents live in a private store reachable only through short-lived signed links; the parts of a document the AI read and the sentences figures were quoted from are encrypted again, with our own key, on top of the platform's disk encryption; sign-in has attempt limits and supports a second factor; and the service is tested against its own attacks on every change.

We do not claim your files are encrypted with a key only you hold. The original files are protected by the platform's disk encryption and the access controls above. When that changes, this paragraph changes.

If something goes wrong with your data, we will tell the supervisory authority within 72 hours where the law requires it, and tell you directly where the risk to you is high.

Children

Ferrario is for people aged 18 and over. We do not knowingly hold data about anyone younger; if we learn that we do, we delete it.

When this page changes

Material changes are shown to you in the product and you are asked to acknowledge them; the version at the top of this page is what we record when you do. Nothing changes retroactively for data already collected.