Privacy Policy

This policy describes how ABI handles the information you give it when you create an account and upload financial files. It is written to be read, not to be skimmed past, and it describes only what the product actually does.

When you upload a CSV or Excel file, ABI reads it while handling the request, extracts the transactions it contains, and discards the document. The file itself is never written to disk or to any file storage service.

What is saved from an upload is:

• →The transactions found in it — date, description, amount, direction, merchant and category.
• →The file's name, how many rows it had, and how many were imported, skipped or were duplicates.
• →Which columns were used for the date, description and amount, so we can explain later how a file was read.

• →Account details: your email address, the name you give at sign-up, and an encrypted password handled by our authentication provider.
• →Business details: the business name and currency you choose.
• →Subscription status: your plan, whether it is active, and the subscription identifier returned by PayPal.
• →Product usage: which pages are opened and counts such as how many transactions an import contained. These records never include your financial figures.

Your transactions are readable only by your own account. This is enforced in the database itself through row-level security on every table, so a mistake in the application cannot return one business’s rows to another.

The people building ABI have administrative access to the database and may look at data when investigating a problem you report or a fault we have detected. We do not sell your data, and we do not share it with anyone for advertising.

The written monthly analysis is generated by OpenAI’s API. ABI sends only the finished monthly figures — revenue, expenses, profit, margin, cash flow, category totals and the health score. Your individual transactions, their descriptions and the merchant names are never sent.

The same applies in reverse: the model never calculates any figure you see. Every number is computed by ABI’s own engine from your transactions, and the model is given the results to interpret.

Transactions that automated rules cannot categorize are an exception worth stating plainly: for those, the description and merchant name are sent so a category can be chosen, along with whether the money came in or went out. The amount is not sent.

• →Supabase — database and authentication. Your account, business and transactions are stored here.
• →Vercel — hosting for the application.
• →OpenAI — generates the written analysis and resolves uncategorized transactions, as described above.
• →PayPal — takes the payment. Your card details go to PayPal directly and never reach ABI.
• →Google Analytics — measures how the website is used, if enabled for this deployment.

• →A session cookie that keeps you signed in. Required for the product to work.
• →A referral cookie (abi_ref) set for 60 days when you arrive through a creator’s link, so their referral can be credited. It contains a referral code and nothing about you.
• →Google Analytics cookies, where analytics is enabled.

Your data is kept while your account exists. Deleting a business removes its transactions, imports and computed periods along with it. If you want your account and everything in it deleted, ask us and we will do it.

ABI is a beta product. It holds no SOC 2, ISO or equivalent certification, and this policy makes no claim of one. Where a specific security measure is described above, it is described because it is implemented — nothing more general should be read into it.

Signed-in customers can reach us through the feedback link in the product header, which goes directly to the team building ABI. We read every message.

If how ABI handles your data changes, this page changes with it and the effective date at the top is updated. See also the Terms of Service.