Your money, your data.

1. Who Clara is and who is responsible for your data

Clara is an AI financial assistant, open source under the MIT license and self-hostable. This policy applies to the version hosted at clara.trefolio.com.

The data controller is Marcos Suarez, maintainer of Clara as a personal open-source project. If you self-host Clara on your own infrastructure, you (or your organization) are the controller, not us.

To exercise any privacy right or ask a question, use the public form at /contact and pick the reason "Privacy / GDPR". We do not publish a personal email — the form lands in the controller's inbox and we reply from the address you provide there.

2. What we collect

Account and authentication: email, hashed password (bcrypt), optional name and avatar synced from Google if you sign in with Google, email-verified flag, passkeys (WebAuthn) you register, preferred language, country declared during onboarding.

Account kind (`User.kind`): REGULAR by default. If you joined Clara by accepting a shared-trip invite without creating an account, your account is a GUEST: it only holds your display name, the linked Telegram chat, and access to that one trip. It has no password, no required email, and no access to the dashboard or to your own months; you can convert it to REGULAR at any time at /upgrade-guest.

Financial data: banks you register, expense and income templates, monthly lines (amount, description, category, date, currency, frozen FX rate) and, for expenses logged inside a shared event wallet, which participant paid that line (`paidByUserId`); the global savings pile and its movement ledger, agent instructions.

Shared event wallets: if you invite someone to a trip via a share-link, we store per participant their event-scoped display name, their role (organiser or guest) and, for fresh Telegram-only invitees, a single-use code to bind the bot. Share-links are stored as a sha256 hash — never the plaintext link — and you can revoke them from the trip screen at any time; revocation, expiration and last-use timestamps are visible to you.

Conversations: web chat messages (text + structured attachments as JSON), Telegram messages if you link the bot, agent usage counters and per-day model usage.

Telegram reminder preference and the timestamp of the last reminder we sent (only applies if you linked Telegram; used to avoid more than one outbound message per day and so you can turn reminders off whenever you want from Settings).

Payments (only if you subscribe or donate): a Stripe customer id, subscription status and current period end, a record of each donation (Stripe id, amount, date).

AI access tokens (MCP): name, 12-character prefix, creation date, last use, expiration and revocation. The full token is hashed with SHA-256 before storage; the plaintext is shown only once.

Minimal technical metadata: truncated IP and user-agent in error and rate-limit logs (no profiling), last-seen date, daily activity row for DAU/WAU.

If you self-host, the data lives in whatever database you configure.

3. What we use it for and the legal basis (Art. 6 GDPR)

Performance of the contract (Art. 6(1)(b)): operating your account, persisting your expenses, incomes and messages, processing PDFs/audio/screenshots you send us, running the agent with your tools, charging the Supporter subscription or donations you choose to make.

Legal obligation (Art. 6(1)(c)): keeping payment and donation records for the period required by applicable tax law, verifying your email before enabling password sign-in.

Legitimate interest (Art. 6(1)(f)): protecting Clara and its users from abuse (Cloudflare Turnstile, IP rate-limits), monitoring errors (Sentry if configured), auditing administrative access.

Consent (Art. 6(1)(a)): explicit acceptance of these Terms and this Policy at signup (stored in `User.acceptedTermsAt` with the version). Linking Telegram is itself a voluntary action that activates the two-way channel with the bot — including the daily proactive reminders Clara sends at 20:00 local time when you haven't logged anything that day. You can turn these reminders off any time from Settings → Integrations → Telegram without breaking the link.

We never sell data. We do not run behavioural analytics. We do not use your financial data to train models.

4. Sub-processors

Vercel Inc. (US) — application hosting, managed Postgres database (via Marketplace), Vercel Blob for TTS audio, Vercel Runtime Cache, AI Gateway routing model calls. Receives all persisted data as infrastructure.

OpenAI (US) — Whisper for voice transcription, OpenAI TTS for audio replies, GPT-* through AI Gateway. Under zero data retention.

Anthropic (US) and Google (US) — additional model providers routed by AI Gateway when applicable, also under ZDR.

Cloudflare Inc. (US) — Turnstile (captcha) on signup and login. Receives IP and browser metadata to evaluate the challenge; never receives email, password or financial data.

Resend Inc. (US) — transactional emails (email verification, alerts). Receives only your email and the message content, no balance data.

Stripe Inc. / Stripe Payments Europe Ltd (US/IE) — payment processing if you subscribe or donate. Receives email, country, card details. Clara never sees the card number.

Upstash Inc. (US) — Redis for rate-limits. Receives IP and counters; no message content.

Telegram FZ-LLC (AE) — Bot API, only if you link Telegram. Receives the messages you send to the bot.

Google LLC (US) — OAuth 2.0, only if you sign in with Google. Standard authentication flow.

Sentry GmbH (DE) — error aggregation, only if the operator configured `SENTRY_DSN`. Receives stack traces and technical context, no message payloads.

When you self-host, you choose which sub-processors to use (all are optional and degrade gracefully).

5. International transfers

Several sub-processors are based in the United States or in jurisdictions outside the EEA. Where applicable, transfers are covered by Standard Contractual Clauses (SCCs, EU 2021/914 decision) and, where the processor is certified, by the EU-US Data Privacy Framework. Telegram FZ-LLC operates from the United Arab Emirates; data is sent to it only if you link the bot.

6. Retention periods

Account and financial data: until you delete the account. When you ask for deletion the account is queued for 30 days during which you can recover it with one click; after 30 days the deletion is permanent and cascades.

TTS audio on Vercel Blob: up to 7 days.

Application logs (Vercel/Sentry): 30 days.

Stripe webhook idempotency: 18 months.

Donation and subscription receipts: 7 years (EU tax obligation).

MCP tokens: until you revoke them; revoked tokens are purged after 30 days.

Shared-event share-link tokens: until expiration or revocation; revoked or expired ones are purged after 30 days. Guest accounts (User.kind = GUEST) created from one of those links follow the general rules: they live until you delete them, or are purged in cascade when the trip's organiser deletes the event or their own account.

Chat messages (web and Telegram): until you delete the account or ask the agent to purge them.

Contact form messages: 24 months; technical metadata (IP / user-agent of the submission) max 90 days or until the message is archived, whichever comes first.

7. Your rights

Access (Art. 15): download all your data in JSON from Settings → Your data and account.

Portability (Art. 20): the JSON above is structured and machine-readable.

Erasure / right to be forgotten (Art. 17): delete your account from Settings. It's queued for 30 days during which you can reverse it by signing in and tapping "Restore my account"; after that window the deletion is permanent and cascades. Donations remain on Stripe for tax obligations.

Rectification (Art. 16), restriction (Art. 18), objection (Art. 21) and withdrawal of consent (Art. 7(3)): send us a message via /contact picking "Privacy / GDPR". We respond within 30 days.

8. Right to lodge a complaint

You have the right to complain to the supervisory authority of your country of residence: AEPD in Spain, CNIL in France, Garante per la Privacy in Italy, BfDI in Germany, etc. The list of European authorities lives at https://edpb.europa.eu/.

9. Visibility inside a shared trip

When you accept a share-link to a trip, the other participants (including the organiser) see your display name and, for every expense you log inside the trip, the line's data (date, description, amount in the organiser's currency and category). They don't see anything else from your account: not your other expenses, not your balance, not your real identity beyond the name you picked when joining.

If you were invited via Telegram only (GUEST account), your Telegram identity (user id) is bound to that account so the bot knows it's you. That identity is NOT shown to the other participants — they only see your display name.

The organiser can remove you from the trip at any time. The lines you already logged stay in the trip (if you want to delete them, do so before being removed); from removal onwards you cannot log more.

If you delete your GUEST account, the expenses you logged for the trip stay in the organiser's books (you logged them inside their book as part of the shared trip); your name stops appearing and the settlement is recomputed without you.

10. Strictly necessary cookies

We only use two cookies, both necessary for Clara to work and exempt from prior consent under the ePrivacy directive:

`next-auth.session-token` (signed JWT, 30 days, HttpOnly Secure SameSite=Lax) — keeps you signed in.

`NEXT_LOCALE` (1 year, SameSite=Lax) — remembers your preferred language so the server-render starts in the right language without flicker.

We don't load analytics, ad pixels or fingerprinting.

11. Minimum age

Clara is intended for people aged 16 or older. In the European Union Art. 8 GDPR sets that threshold by default; in jurisdictions where the applicable threshold is lower, verifiable parental consent is required. If we discover an account from a minor without that consent, we delete it.

12. Data breach notifications

If a breach affects your personal data with reasonable risk, we notify you by email as soon as possible and always within the 72 hours required by Art. 33-34 GDPR, and report to the supervisory authority where applicable.

13. Changes to this policy

When we change this policy in a material way, we bump `CURRENT_PRIVACY_VERSION` and ask you to accept the new version on your next visit. Minor changes (typos, broken links) do not force re-acceptance.

14. Contact

For any question or right exercise: use the form at /contact, reason "Privacy / GDPR". The controller is a natural person; there is no formal DPO.