Legal

Privacy Policy

Last updated: May 31, 2026 · Effective immediately

1. Who we are

ProFinanceCast is a personal finance forecasting application operated at profinancecast.com. When this policy says "we", "us", or "ProFinanceCast", it refers to the team behind this product.

2. What data we collect

We collect only the information you choose to enter:

• Account data: your name, email address, and password (stored as a salted hash — we never see your actual password)
• Financial data: income, expenses, savings, debts, and goals that you enter manually
• Usage data: which features you use and when, to improve the product (no personal financial data included)
• Device data: browser type and timezone, used only to format dates and currencies correctly

We do not connect to your bank accounts, request your bank credentials, or store any payment card details (payments are handled entirely by PayPal).

3. How we use your data

• To generate your 12-month financial forecast
• To power Sage AI — your financial data is sent to the AI model only to answer your questions and is not retained by the AI provider
• To send you the email digest you opted into (you can turn this off any time in Settings)
• To improve ProFinanceCast features using anonymised, aggregated usage patterns

4. How we protect your data

• AES-256-GCM at rest and TLS 1.3 in transit — industry-standard ciphers
• Your financial data is stored in isolated, access-controlled databases
• We conduct regular security reviews and follow industry best practices
• Staff access to user data is logged and restricted to what is necessary to provide support

5. What we never do

• We never sell your personal or financial data to any third party
• We never share your financial data (income, expenses, savings, debts, goals) with advertisers — those figures never leave your device for ad targeting
• We never use your financial data to train AI models — yours or anyone else's
• We never send unsolicited marketing without your explicit opt-in

6. Third-party services (sub-processors)

We use the following trusted third parties to operate the service. Each is bound by a Data Processing Agreement (DPA) where applicable under GDPR Article 28:

• Supabase — database, authentication, and file storage. GDPR-compliant, SOC 2 Type II. DPA: supabase.com/legal/dpa. Data hosted in EU region.
• PayPal — payment processing and, for Pro/Premium subscriptions, storage of the recurring billing agreement linked to your account. We never see or store your card details. PayPal acts as an independent controller for payment data under their privacy statement. For recurring subscriptions, PayPal retains your billing agreement until you cancel it (either via our Settings or directly in your PayPal account).
• Vercel — hosting and serverless functions (SOC 2). DPA: vercel.com/legal/dpa.
• Upstash — Redis-backed rate-limiting cache for payment endpoints. Stores only short-lived counters keyed by your user ID; no financial or personal data. DPA: upstash.com/trust/dpa.pdf.
• Resend — transactional email delivery (account verification, billing notifications, operational alerts). Receives your email address and message content. DPA: resend.com/legal/dpa.
• Groq — primary AI model provider for Sage AI responses (Llama 3.3 70B). Each Sage call sends Groq your query text, the recent conversation context from that session (up to 10 prior turns), and your financial profile figures (income, expenses, savings rate, debt — as entered in your dashboard) so it can produce a relevant answer. Per Groq's published API terms, prompts and the responses generated for you are retained only for the time needed to deliver the response and are not used to train Groq's models. US-hosted; international transfers are covered by standard contractual clauses. Privacy policy: groq.com/privacy-policy.
• Google (Gemini) — fallback AI model provider for Sage AI, used only when Groq is rate-limited or unavailable. The data scope is the same as for Groq above (Sage query, recent conversation context, and your financial profile figures); under the API terms we operate under, prompts and completions are not used to train Gemini. US-hosted; international transfers are covered by standard contractual clauses. DPA: cloud.google.com/terms/data-processing-addendum. Privacy policy: policies.google.com/privacy.
• Cloudflare Web Analytics — privacy-respecting analytics; no cookies, no IP fingerprinting, no PII; we use the JS-beacon variant. More info.
• Plausible — privacy-respecting analytics (EU-hosted, no cookies, no cross-site tracking, no PII).
• Sentry — error monitoring; PII-scrubbed via beforeSend filter so financial figures, user IDs, and emails never leave the browser.
• Google AdSense — advertising on our public, signed-out pages (blog, calculators, marketing). Google and its partners set advertising/measurement cookies and may personalise ads based on your browsing; Google never receives your financial data. See section 8a for details and opt-outs. Google advertising policy.

6a. Payment data flow

When you subscribe to a paid plan or buy Founders Lifetime, the following data flow occurs:

• You are redirected to PayPal's hosted approval page (we never see your card or PayPal credentials).
• PayPal returns to us a transaction or subscription identifier, the amount paid, the currency, and your PayPal payer ID. We store these in our subscriptions and subscription_events tables to grant entitlement and produce billing history.
• For recurring subscriptions, PayPal stores a billing agreement linked to your payment instrument and re-uses it for renewals. You can review and revoke this agreement at any time in your PayPal account (Activity → Recurring payments).
• We receive a webhook from PayPal on each capture, refund, dispute, or renewal event. PII fields (payer name, email, addresses, free-text dispute reasons) are stripped before being persisted to our audit log.
• We do not share your financial usage data (income, expenses, etc.) with PayPal — only the transaction itself.

7. Your rights

You have the right to:

• Access all data we hold about you — request it via Settings → Data → Export
• Correct any inaccurate data — edit it directly in your dashboard at any time
• Delete your account and all associated data — Settings → Data → Delete account (processed within 24 hours)
• Withdraw consent for optional processing (e.g. email digest) — Settings → Notifications
• Data portability — export everything as CSV or JSON from Settings → Data
• Object to processing based on legitimate interests — write to privacy@profinancecast.com
• Restrict processing while a request is being resolved — write to privacy@profinancecast.com
• Lodge a complaint with your national data protection authority — see the European Data Protection Board's directory for your supervisory authority

8. Cookies and similar technologies

Inside the logged-in app we use only essential cookies required to keep you logged in, and our analytics (Plausible, Cloudflare) are cookie-free. On our public, signed-out pages (blog, calculators, marketing) we also display ads via Google AdSense, which sets advertising and measurement cookies — see section 8a below. You can clear cookies at any time in your browser settings.

For full transparency, the following non-cookie technologies are used:

• Plausible and Cloudflare Web Analytics issue a single page-view beacon per visit. Neither sets cookies. Neither retains your IP address beyond aggregated, anonymised statistics.
• Sentry (error monitoring) may write a short-lived localStorage key on your device to correlate errors within a single browsing session. We have configured Sentry to scrub personally identifiable information (financial figures, user IDs, email addresses) before any data leaves your browser. The library is loaded on every page; if you wish to disable it, blocking the script source js.sentry-cdn.com via your browser will not affect product functionality.
• Our own application uses localStorage and IndexedDB on your device to store your forecast data locally, encrypted with AES-256 before any server contact. This is essential to the product and cannot be disabled while the app is in use.

Our analytics, error monitoring, and on-device storage are never used for advertising. Advertising cookies are set only by Google AdSense, and only on public pages — see section 8a.

8a. Advertising (Google AdSense)

To keep our free calculators and articles available at no cost, the public, signed-out pages of this site (the blog, the calculators, and marketing pages) display advertising served by Google AdSense (provided by Google LLC and its partners). Ads do not run inside the logged-in app (dashboard, scenarios, and other account pages).

• Cookies and data. Google and its advertising partners use cookies and similar technologies to serve ads, measure their performance, and — where permitted — personalise ads based on your prior visits to this and other sites. Google may therefore set advertising and measurement cookies on your device when you view our public pages.
• Your financial data is never used for ads. The figures you enter (income, expenses, savings, debts, goals) stay on your device and in your access-controlled account; they are never sent to Google or used to target ads. Ads are contextual to the page content, not to your finances.
• Opting out. You can turn off personalised advertising at any time at Google Ads Settings, and opt out of third-party vendor cookies at aboutads.info/choices (US) or youronlinechoices.eu (EU). Blocking ad cookies does not affect any product functionality.
• More information. See Google's advertising policy and how Google uses data from sites that use its services.

9. Data retention

We keep your data for as long as your account is active. If you delete your account, all personal data is permanently removed within 24 hours. Anonymised, aggregated usage statistics (with no link to your identity) may be retained indefinitely to improve the service.

10. Children

ProFinanceCast is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, please contact us and we will delete it immediately.

11. Changes to this policy

If we make material changes to this policy, we will notify you by email and display a notice in the app at least 14 days before the change takes effect. The date at the top of this page always reflects the most recent update.

12. EU representative

If we are required to appoint an EU representative under Article 27 of the GDPR, their contact details will be published here. Until then, EU users may contact us directly at privacy@profinancecast.com for any GDPR-related request.