Privacy Policy

Last updated 12 August 2026

Tovi reads a bank statement and tells you what it found. This page says exactly what happens to that statement, what stays on your phone, what reaches our servers and for how long. We have tried to write it so you can actually check it.

Who we are

Tovi is made by ZETA TECH CONSULTING LTD, a company registered in England and Wales under company number 15723443.

We are the data controller for the personal data described on this page. For anything to do with your data — questions, requests, complaints — email rabi@finai.cc.

The short version

The same three things the app tells you on its “Your data” screen:

On this phone. Your transactions, the months built from them, and a record of each statement read. All of it lives in a database on your device.
Not kept anywhere. The statement documents themselves. Each one is read once, checked to the penny, and discarded.
On Tovi’s servers. No transactions, no balances, no documents.

What we will not tell you is that your data never leaves your device, because that is not true. Analysing a statement means sending its text to an AI model. What we can do is set out precisely what happens to it, which is the rest of this page.

What stays on your phone

Tovi keeps a database on your device holding:

your transactions — date, description, amount and category
the months built from them, including the recap and report text written for each
a record of each statement read: its dates, its totals and whether it reconciled
a cache of merchant names, so the same shop is recognised next time

None of this is sent to us as a whole. It is stored in your app’s data directory, which means it is included in your iCloud backup if you have iCloud Backup switched on. That backup is Apple’s, encrypted, and tied to your Apple Account; we have no access to it.

You can remove all of it at any time with Delete all data in Settings → Your data, or by deleting the app. To remove your account as well, see Deleting your data and your account below.

What happens when you upload a statement

Your phone opens the PDF and extracts its text locally, on the device.
That text — usually not the file — is sent to our server over an encrypted connection.
If the PDF has no text layer, because it is a scan or a photo, the file itself is uploaded to encrypted storage so it can be read visually. It is deleted as soon as it has been parsed. A storage rule deletes anything a failure left behind within 24 hours, and interrupted uploads are cleared on the same schedule.
The statement is structured, reconciled against its own printed balances, and categorised.
The result is held in an encrypted store for 15 minutes and deleted the moment your phone collects it. Backups that would resurrect deleted results are deliberately switched off.
Your phone saves the result. Our copy is gone.

AI processing

Working out that TESCO STORES 2847 is Tesco, and writing the sentences in your recap, is done with AI models provided by OpenAI. Statement text and computed figures are sent to OpenAI’s API, which is in the United States.

OpenAI does not use data submitted through its API to train its models.
Under OpenAI’s standard API terms, inputs may be retained for up to 30 days for abuse monitoring and then deleted.
The transfer out of the UK relies on the standard contractual clauses and UK addendum in OpenAI’s data processing agreement.
We send statement text and computed figures. We do not send your name, your email address or your Tovi account identifier alongside them.

What is on our servers

Analysis results — encrypted, for 15 minutes, deleted when your phone collects them.
Your account, if you create one — an account identifier and your email address. If you sign in with Apple, that identifier is the one Apple gives us, and we only get your email address if you chose to share it. No financial data of any kind.
Usage counters — how many analyses you have run, for fair use and billing.
A merchant dictionary — mappings such as “TESCO STORES 2847 → Tesco, Groceries”. These are descriptors, not transactions: no amounts, no dates, and no link to you or any other user.

All of it is hosted with Amazon Web Services in their London region.

Analytics and cookies

This website sets no cookies and runs no analytics. Nothing is stored on your device by visiting it.

In the app we use Amplitude to count things like how many uploads finish successfully, so we can tell whether the product works. Those events never contain transaction contents, amounts, or merchant names.

Payments

Subscriptions are sold through Apple, and entitlements are managed for us by RevenueCat. Your payment is handled entirely by Apple — we never see your card details.

Why we are allowed to do this

Tovi is available worldwide. We are based in the United Kingdom, so we apply the UK GDPR to everybody, and the EU GDPR as well where you are in the European Economic Area. If the law where you live gives you more than this page describes, you keep it.

Our legal bases:

Performance of a contract — analysing the statements you give us and running your account.
Legitimate interests — keeping the service secure and working, understanding whether features are used, and improving the merchant dictionary.
Consent — where we ask for it. You can withdraw it at any time.

How long we keep things

What	How long
Statement documents	Until parsed; a storage rule clears any remainder within 24 hours
Statement text	Held only while the analysis runs
Analysis results	15 minutes, or until your phone collects them — whichever is sooner
Account record	Until you delete it in the app, or ask us to
Usage counters	For the life of the account and up to 12 months after
Merchant dictionary	Indefinitely — it is anonymous and not linked to you
Everything on your phone	Until you delete it

Deleting your data and your account

You do not have to ask us, and you do not have to email anybody. Both of these are in the app, under Settings → Your data:

Delete all data — every transaction, month and statement record comes off this device, along with the merchant memory learned from your statements. Your account stays.
Delete account — the above, plus the account record and usage counters on our servers. This cannot be undone, and it is not reversible by signing in again.

Deleting the app on its own removes the data on your phone but leaves your account record with us, so use Delete account if you want both gone.

Deleting your account does not cancel your subscription. Subscriptions are billed by Apple, and only Apple can stop them — cancel in your Apple Account settings first, or you will keep being charged for an account that no longer exists.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Email rabi@finai.cc and we will respond within one month.

In practice most of your data is on your phone and not ours, so the two buttons above are usually faster than asking us.

If you think we have handled your data badly, please tell us first. If that does not settle it, you can complain to a regulator: in the UK, the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113; elsewhere in Europe, your national data protection authority.

Children

Tovi is for adults. It is not intended for anyone under 18 and we do not knowingly collect their personal data.

Changes to this policy

If we change this policy we will update the date at the top, and if the change is significant we will tell you in the app rather than hoping you re-read this page.

Contact

ZETA TECH CONSULTING LTD (company number 15723443). Email rabi@finai.cc.