Privacy Policy — Rufi
Version 1.0 · under legal review · updated 9 September 2026
1. Data controller
Maria Consuelo Maddaloni, Minturno (LT), Italy. Email for any data request: rufi@rufiway.com. No Data Protection Officer is appointed, as it is not required for this activity.
2. What Rufi is
Rufi is a personal finance app that helps you track income and expenses, understand how much you save, and discover bonuses, deductions and benefits you may be entitled to. Rufi provides information for educational purposes: it does not file applications or returns on your behalf and does not provide financial, tax or legal advice.
3. What data we process
Account data: email address, name (optional), password (stored only in encrypted form by Supabase), date of acceptance of the terms and age confirmation, app language.
Financial data you enter: accounts, balances, transactions with amount, date, category and description, budgets, savings goals, assets and net worth, recurring expenses, optional tax information (regime, indicative annual income, expenses flagged as deductible) and, if you enable the VAT-number module, invoice and set-aside data. Rufi never accesses your bank accounts and never asks for bank credentials: all data is entered manually by you.
Optional demographic profile (only with your explicit consent): country and province of residence, income bracket. Used to compare your spending with public statistics (ISTAT, Eurostat). You can withdraw consent at any time in Settings.
Website calculator data (“How much are you losing”): the answers you give are categorical and anonymous (household composition, type of home, income bracket, number of subscriptions: no real amounts, no transactions) and are saved even if you leave no email. If you tick the consent box and leave your address, we also store the email and use it for two things, both stated next to the box: sending you the report of your estimate and keeping you updated on Rufi. The report is sent once per submission. You can unsubscribe at any time by writing to rufi@rufiway.com. The calculator requires no sign-up and creates no account.
Technical data: anonymous device identifier, app version, error reports (see section 6).
Data we do not collect: tax code, IBAN, bank details, identity documents, GPS location, contacts, photos.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service (account, storing your data, calculations, reminders) | Performance of a contract (Art. 6.1.b GDPR) |
| Generating analyses and suggestions with AI (section 5) | Performance of a contract; AI features can be turned off in Settings |
| Comparison with statistical data (demographic profile) | Consent (Art. 6.1.a), revocable |
| Service emails (account confirmation, password reset) | Performance of a contract |
| Sending you the calculator report and updates on Rufi | Consent (Art. 6.1.a), revocable: it is the tick box next to the email field |
| Security, abuse prevention, error diagnostics | Legitimate interest (Art. 6.1.f) |
| Legal obligations | Legal obligation (Art. 6.1.c) |
We do no advertising profiling, we do not sell data and we show no ads.
5. Artificial intelligence
Some Rufi features (spending analysis, savings suggestions, forecasts) are generated by AI models provided by Anthropic. For this purpose we send Anthropic only aggregated and anonymised data: totals by category, ratios and trends, with no email, name, identifiers, transaction descriptions or account names. Optionally, you can allow the use of your first name to personalise messages (off by default). Anthropic acts as a processor. It does not use the data to train its models (Commercial Terms, section on use of Customer Content) and retains it for up to 30 days for security and abuse-prevention purposes, then deletes it (DPA). All AI-generated content is labelled as such. You can turn off all AI features in Settings: no data is then sent to Anthropic. AI suggestions are educational information, not advice: Rufi does not assess your creditworthiness and shares no assessment with third parties.
6. Who sees your data (processors)
| Provider | Role | Data location |
|---|---|---|
| Supabase | Database, authentication, server functions | Frankfurt, Germany (EU) |
| Anthropic | AI models (section 5) | USA — transfer under Standard Contractual Clauses (Module Two), with a documented transfer impact assessment. Not certified under the EU-U.S. Data Privacy Framework: the safeguard is the SCCs, not the DPF. The data transferred is aggregated and carries no identifiers |
| Resend (Plus Five Five, Inc.) | Service email delivery (sign-up confirmation, password reset, invitations), via Supabase Auth | USA — transfer under Standard Contractual Clauses (Module Two) and EU-U.S. Data Privacy Framework certification |
| Cloudflare | Website and content delivery | EU/global, with contractual safeguards |
| Sentry (if enabled) | Automatic app error reporting | EU (Germany). Reports are stripped of email, amounts, descriptions and IP addresses before sending |
| PostHog (if enabled) | Statistics on how the app is used | EU. We record that an action happened — for example “completed initial setup” — with a hashed identifier instead of your name. We do not record amounts, balances, descriptions, merchants or your account names, and we do not record screen contents |
| Apple / Google | App distribution and, in future, payments | Under their respective policies |
No one else receives your data. We do not share it with banks, financial institutions, tax assistance centres or authorities, unless required by law.
7. How long we keep it
- Account and financial data: as long as your account is active. On account deletion they are deleted immediately and irreversibly.
- Technical logs of AI features (metadata only: date, analysis type, cost; no content): 90 days.
- Expired AI suggestions: 30 days after expiry.
- Household invitations: deleted on acceptance, or 30 days after expiry.
- Data collected by the website calculator (email and answers): 12 months from last contact.
- Backups: 7 days, encrypted, used only for restore and nothing else. This applies from the move to the Supabase Pro plan; until then they are manual copies, kept for at most 30 days.
8. Household
If you share Rufi with a family member, the financial data entered in the household (accounts, transactions, budgets) is visible to all members.
If you leave the household or delete your account, your personal data (account, consents, notifications, progress) is deleted. The transactions you entered remain in the household, attributed to the administrator, but without descriptions, without notes and without your tax flags: the administrator sees “expense, 45 euros, Groceries”, not what you had written. If a transaction named a person outside the household, that name is replaced with a dash: someone who is not a Rufi user never chose to be in your group.
If you are the last member, the whole household is deleted.
9. Your rights
At any time you can: access your data, correct it, export it (from the app), delete it (in the app: Settings → Delete account, with a double confirmation and by typing the word DELETE, no need to contact us; deletion is immediate and irreversible), restrict or object to processing, withdraw consents. For rights not available in the app write to rufi@rufiway.com: we reply within 30 days. You may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
10. Security
Data encrypted in transit (TLS) and at rest; per-user data isolation at database level (Row Level Security); session stored in the device’s protected area (Keychain/Keystore); optional biometric lock; screen hidden in the app switcher; optional two-factor authentication. In case of a data breach posing a risk to you, we will inform you without delay and notify the Authority within 72 hours.
Protection of the text you write
If you turn on text protection, the descriptions, notes, account and asset names you write (including an IBAN, if you enter one) are encrypted on your device before they leave it. They reach our servers already unreadable: not even we can open them, because we do not hold the key.
The key is created on your phone and stays in the device’s protected area. On the server we keep only a locked copy of it, which opens solely with your recovery code — the one we show you once, when you turn the protection on.
Two consequences, stated plainly:
- If you lose the recovery code and uninstall the app, that text is gone for good. We cannot recover it for you: that is the price of real encryption. Amounts, dates and categories remain readable and exportable.
- Amounts, dates, categories and currencies are not encrypted. The app needs them to sort, total and filter without downloading your whole history to the phone on every screen. Anyone who managed to read our database would see how much you spend and when, not to whom or what for.
11. Minors
Rufi is for people aged 18 or over. We do not knowingly collect data from minors; if we become aware of it, we delete it.
12. Changes
If this policy changes substantially, we will notify you in the app and ask you to review it before continuing. The current version is always available at rufiway.com/privacy.