Legal

Privacy Policy

Effective October 13, 2026

This Privacy Policy explains how Brixa, operated by ZATECH sp. z o.o. (“we”, “us”), collects, uses, and protects your information when you use the Brixa personal finance application (the “Service”). We are committed to handling your financial data responsibly.

1. Information We Collect

  • Account information: your name, email address, and authentication data.
  • Financial data: account details, balances and transaction history retrieved from banks you connect (through Enable Banking under PSD2 in Europe, and through Plaid in the United States and Canada), and data from statement files you import. We only ever have read-only access: we cannot move money or make payments. In the United States, if you agree to it on Plaid's screen, we also read the terms of the credit cards and loans you connect through Plaid (interest rates, statement balances, minimum payments, due dates and when a loan is scheduled to be paid off), to date your plan and show what your card costs; only you see them.
  • Preferences: settings such as base currency, language, categories, and rules you create.
  • Technical data: limited logs and device/session information used to operate and secure the Service.
  • Advertising measurement data: if, and only if, you allow tracking when iOS asks, an advertising identifier and app events such as install, launch, sign-up, and bank connected. Never your transactions, balances, accounts, or merchants. See "Advertising Measurement" below.

2. How We Use Your Information

  • To aggregate, categorize, and display your transactions and financial summaries.
  • To categorize transactions automatically using AI, while AI categorization is on for your account (see "AI categorization" below for when it is on and how to switch it off).
  • To operate, secure, and support the Service, and to communicate with you about it.
  • To analyze usage with first-party product analytics so we can improve the app (we do not track you across other companies' apps or websites).
  • To record how the app is used, as replayable sessions, so we can see where it confuses people. These recordings show layout, taps, scrolling and navigation. They do not show your numbers: every piece of text, every amount and every image is masked before the recording leaves your device, so a balance or a shop name is never readable in one.
  • To send push notifications and product emails when you opt in.
  • To measure which of our advertising campaigns bring new users, on the terms described in "Advertising Measurement" below.

3. Sharing & Processors

We do not sell your personal data. We share data only with service providers who process it on our behalf, including:

  • Enable Banking (Enable Banking Oy, a licensed open-banking provider regulated under PSD2): to securely connect to your bank and retrieve your account and transaction data on your behalf. See enablebanking.com.
  • Plaid (Plaid Inc.): in the United States and Canada, to securely connect to your bank and retrieve your account, balance and transaction data on your behalf. When you connect a bank through Plaid, Plaid's own handling of your data is described in the Plaid End User Privacy Policy, and you can review or remove the connections Plaid holds at my.plaid.com.
  • Anthropic (Anthropic PBC, our AI provider): to categorize transactions automatically, while AI categorization is on for your account. See "AI categorization" below for when that is and exactly what is sent.
  • PostHog (product analytics and session replay, hosted in the EU): to understand how the app is used and improve it. Replays are masked on your device before they are sent, so text, amounts and images are never readable in them, and app logs are not attached. Recordings are kept for 30 days and then deleted. We use this only for first-party analytics; we do not use it to track you across other companies' apps or websites.
  • OneSignal: to deliver push notifications and product emails when you opt in.
  • RevenueCat: to manage subscriptions and validate purchases.
  • Meta (Meta Platforms Ireland Ltd): to measure which advertisements led people to install Brixa. See "Advertising Measurement" below for exactly what is sent under each answer to Apple's tracking prompt.
  • Hosting & database providers: to run the Service and store your data. Your data is stored on servers in the European Union (Germany).
  • Stripe (through RevenueCat Web Billing): to take payment when you subscribe on our website rather than in the App Store. We never see or store your card number.

We do not store your bank login credentials.

Connecting your bank through Plaid

In the United States and Canada, Brixa uses Plaid Inc. (“Plaid”) to gather your data from financial institutions. By using the Service and connecting a bank account, you grant Brixa and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

Through Plaid we receive your account names and masked numbers, balances, and transaction history. We use this data only to provide the Service (showing your spending, categories, budgets and insights); we never move money from your accounts and we never sell your data. You can disconnect a bank at any time in the app, and review or remove the access Plaid holds at my.plaid.com.

AI Categorization

Brixa can sort your transactions automatically using an AI model operated by Anthropic PBC. If you set up Brixa in the iPhone app in Europe, we ask you during onboarding and it stays off unless you turn it on. For accounts set up on our website, and for accounts in the United States and Canada, AI categorization is on by default. Either way you can switch it off or on at any time in Settings (on iPhone: Settings, Advanced). While it is off, no transaction data is sent to Anthropic and you can categorize transactions manually or with rules.

When enabled, the following data is sent to Anthropic for processing only:

  • Transaction details: description, merchant/counterparty name, counterparty account number as it appears in the transaction, amount, currency, and date.
  • Your account display names and the account holder name as it appears on transfers.
  • The names of your spending categories.

We never send your bank login credentials (we do not have them), your email address, or your bank access tokens. Under our commercial agreement, Anthropic does not use this data to train its models and processes it solely to provide categorization results back to us, subject to confidentiality and security obligations consistent with this policy. Individual merchant names (not linked to you) may also be looked up via Google's Places service and Anthropic to identify unknown merchants; these lookups contain no amounts, dates, or account information.

Advertising Measurement

We advertise Brixa on Meta's platforms (Facebook and Instagram). To know which advertisements are worth paying for, we can tell Meta that an install, a registration or a purchase happened, and that it came from one of our ads.

This happens only if you allow tracking when iOS shows Apple's App Tracking Transparency prompt, which Brixa shows you once, shortly after you first open it. If you choose "Ask App Not to Track", nothing is sent to Meta at all, not even an anonymous count, and nothing else about the app changes.

When you allow it, Meta receives:

  • Your device's advertising identifier, which Apple provides for this purpose.
  • That the app was installed and opened, that an account was created, and that a subscription or trial started.

Meta never receives your transactions, balances, account numbers, merchant names, bank credentials or the contents of anything you keep in Brixa. Your financial data is not used for advertising, by us or by anyone else, and we do not sell it.

You can change your mind at any time in iOS Settings, under Privacy & Security, Tracking. Turning Brixa off there stops any further data reaching Meta.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. You may delete your account, after which we will delete or anonymize your personal data except where retention is required by law.

5. Your Rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to withdraw consent for bank connections at any time. To exercise these rights, contact us at the address below.

Deleting your data

You can delete your account and everything in it yourself, from inside the app. You do not need to ask us and you do not need a reason.

  1. Open Brixa and go to Settings.
  2. Scroll to the Account section and tap Advanced.
  3. Tap Delete account and confirm.

Deleting the account does all of the following, immediately and permanently:

  • Withdraws your open-banking consents with Enable Banking and removes your bank connections at Plaid, so no further data can be retrieved from your banks.
  • Deletes your transactions, accounts, balances, card and loan terms, categories, rules, budgets, goals, plans and sharing invitations.
  • Deletes your profile: your name, email address and authentication records.

It cannot be undone, and we cannot restore a deleted account. Your subscription is billed by Apple rather than by us, so if you have one, cancel it separately in Settings, Apple ID, Subscriptions on your device; deleting your Brixa account does not cancel an Apple subscription.

If you cannot reach the app, for example because you have already removed it or cannot sign in, email andrew@usebrixa.com from the address on the account and we will delete it for you. We may keep a minimal record of the deletion itself, and anonymous, non-identifying usage counts that can no longer be linked to you, where we are required or permitted to do so by law.

United States residents

This section applies to you if you live in the United States, including California, and supplements the rest of this policy. It describes our practices under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and under the consumer privacy laws of other states such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon.

What we collect, in the categories those laws use: identifiers (name, email address, account ID); customer records and commercial information (your subscription); financial information from the banks you connect, which the CCPA treats as sensitive personal information; internet and app activity (product analytics and masked session replays); and, only if you allow it, an advertising identifier. We collect it from you, from your device, and from the banks you connect through Plaid. We use it for the purposes in section 2 and keep it for the period in section 4.

No sale, and sharing only with your permission. We do not sell personal information and have not done so in the past 12 months. We use your sensitive personal information only to provide the Service you asked for. The only "sharing" for cross-context advertising is the advertising measurement described above: in the app it happens only if you allow tracking when iOS asks, and on our website we honor the Global Privacy Control signal as a request to opt out, so a browser that sends it is never measured.

Your rights. You can ask to know what personal information we hold and how we use it, to get a copy of it, to correct it, and to delete it (you can also delete everything yourself, see "Deleting your data"). You can opt out of sharing at any time as described above. We will not treat you differently for using any of these rights. Email andrew@usebrixa.com from the address on your account; we verify requests by that address and answer within 45 days. You may use an authorized agent, who must show us your signed permission. If we decline a request, you can appeal by replying to our answer, and we will respond to the appeal within the time your state's law requires.

Children. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18.

Canadian residents

This section applies to you if you live in Canada and supplements the rest of this policy, under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.

Where your information goes. Your information is stored in the European Union (Germany) and processed by the service providers listed in section 3, some of which are in the United States. It may therefore be accessible to courts and authorities in those countries. We protect it there by contract and by the measures described in this policy.

Your rights. You can ask to access and correct your personal information, to receive it in a structured, commonly used technology format, and to withdraw your consent (withdrawing consent to bank connections means disconnecting the bank or deleting your account). You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Person responsible. The person in charge of the protection of personal information at Brixa is Andrew Zacker, reachable at andrew@usebrixa.com.

Commercial email. We send marketing email to people in Canada only with their consent, and every such email lets you unsubscribe.

6. Security

We use technical and organizational measures to protect your data, including encryption in transit, encryption of bank access tokens at rest, and access controls. No method of transmission or storage is completely secure, but we work to safeguard your information. If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law, including the EU GDPR, US state breach-notification laws (such as New York's SHIELD Act and California's breach law) and Canadian law.

7. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service.

8. Contact

For privacy questions or requests, contact Brixa at andrew@usebrixa.com.

Terms of Service