Privacy Policy

BUFI as controller. Fantasmita, LLC, a Delaware limited liability company, is the controller of the personal data we process to run our own business: your account, sign-in, identity verification, billing, security, support, analytics and marketing.

BUFI on behalf of workspaces. When a workspace uploads or connects data about other people (for example employees and contractors in payroll, customers on invoices, vendors, or people in documents), the workspace decides why that data is processed and BUFI processes it on the workspace's behalf. If you are one of those people, please contact the workspace that holds your data. We will help it respond.

You can reach us at hello@bu.finance.

Data you give us:

• Account and contact data: name, email address, phone number, company, role, profile photo, language and preferences.
• Identity verification data: legal name, date of birth, nationality, address, government ID images and numbers, tax identifiers, and a selfie or short video used for liveness and face-matching checks. Identity verification is carried out by our partner Persona, which may process facial geometry (biometric data) to compare your selfie with your ID. Persona processes the images and any face data under its own privacy policy; BUFI receives the verification outcome and the details needed to open and maintain your account.
• Business data: company documents, ownership information, authorized representatives and tax identifiers, where needed.
• Financial data: wallet addresses, balances, transaction history, payment requests, invoices, payroll and reimbursement records, bank account details for payouts (such as account and routing numbers or IBAN), and information about accounts you connect.
• Content you submit: documents, receipts and files you upload, messages and voice recordings you send to our AI assistant, notes, and contacts or customers you add.
• Communications: what you send us in support requests, emails and surveys.

Data from your workspace and other users: if someone invites you to a workspace, adds you as a payee, contractor, signer or customer, or sends you a payment, we receive the details they provide.

Data from third parties: identity verification and sanctions screening results; account and transaction data from bank and exchange connections you authorize (Plaid, Mesh, Teller, Pluggy); data from payment and on/off-ramp partners; public blockchain data; public company information used to fill in business details; and data from integrations you connect, such as Gmail or Outlook (to read the invoices and receipts in your inbox), Slack, Xero or QuickBooks.

Data collected automatically: IP address and approximate location derived from it, device and browser type, operating system, app version, pages and screens viewed, actions taken, referral and campaign parameters, crash and error diagnostics, and push notification tokens. See our Cookie Notice. We do not collect precise GPS location.

We use personal data to:

• Provide the Service: create and secure accounts and workspaces, run wallets, payments, payroll, invoices, reimbursements, swaps and savings features, and send service messages.
• Run AI features: answer your questions, read documents and receipts, draft records, remember context you share so Bu can help you later, and prepare actions for your approval.
• Verify identity and comply with law: identity and business verification, sanctions screening, fraud and transaction monitoring, record keeping, tax and accounting obligations, and responding to lawful requests.
• Keep the Service secure: detect and prevent fraud, abuse and security incidents, and enforce our Terms.
• Improve the Service: understand how features are used, fix bugs and measure performance, using analytics where you allow it.
• Communicate with you: support, product updates and, where allowed, marketing. You can unsubscribe from marketing at any time.
• Billing: manage subscriptions, credits and payments.

We do not sell personal data and we do not use it for targeted advertising. BUFI does not use customer content to train general-purpose AI models.

When you use Bu (by text or voice), document reading or other AI features, the content involved (your messages, audio, uploaded documents and the workspace records needed to answer) is sent to AI model providers that process it on our behalf to generate a response. These currently include Google (Gemini), OpenAI, Anthropic, xAI, Deepgram, Groq, ElevenLabs and LiveKit, and may be routed through Vercel's AI Gateway.

• Bu can store memories, such as facts and preferences you share, to be more helpful later. They are linked to your workspace, and you can ask us to delete them.
• We use AI providers under terms that prohibit using that content to train their general-purpose models. Providers may retain content for service delivery, security or abuse monitoring under their applicable agreements; we do not promise zero retention.
• Treasury and personal-wallet transactions require the applicable human authorization. Agent-wallet transactions may execute under a previously approved workspace grant without a separate human approval for each transaction. Those grants are enforced by BUFI's software, as explained in Section 5 of our Terms.
• Bu provides assistance and prepares actions. Identity-verification, sanctions and fraud checks may use automated processing that affects access to the Service. Contact hello@bu.finance to contest an outcome and request human review. Where legally required, we provide information about the decision process and ensure meaningful human intervention.

We share personal data only as needed for the purposes above:

• Service providers acting for us: hosting and databases (Supabase, Vercel, Cloudflare, Google Cloud), background jobs (Trigger.dev), caching (Upstash), email and notifications (Resend, Novu, OneSignal), customer support (Chatwoot, Plain), error monitoring (Sentry), analytics and attribution (OpenPanel, Layers, Vercel Analytics, Dub), AI providers (see Section 4), data enrichment (context.dev, Exa, Firecrawl), blockchain infrastructure (Alchemy), search (Typesense), real-time collaboration (Liveblocks), address lookup (Google Places) and travel booking (Duffel), when you use those features.
• Financial and verification partners: Circle (wallets and stablecoins), Bridge, Alfred Pay, Ripio and Stripe (money conversion and payments), Persona (identity verification), Rain and its issuing bank (cards), RevenueCat (app subscriptions), and the bank and exchange connection providers you choose (Plaid, Mesh, Teller, Pluggy).
• Other people in your workspace and people you transact with: for example, the name and payment details shown on an invoice or payment request, or the approvals a signer can see.
• Public blockchains: transactions you make on a public blockchain, including wallet addresses and amounts, are visible to anyone and cannot be deleted. Ghost Mode uses a privacy protocol (Hinkal) to reduce what is publicly linked, but does not make transactions anonymous to regulators or partners.
• Integrations you connect: when you connect a third-party service, we exchange data with it as you direct.
• Authorities and legal process: law enforcement, regulators and courts, when we believe in good faith that the law requires it or to protect rights, safety and property.
• Professional advisors: lawyers, auditors and insurers, under confidentiality.
• Business transfers: a buyer, investor or successor in connection with a merger, financing, acquisition or sale of assets, subject to this Policy.

Some partners, such as Circle, Persona, card issuers and on/off-ramp providers, also act as independent controllers of the data they collect to meet their own legal obligations, under their own privacy policies.

We keep personal data only as long as needed for the purposes in this Policy:

• Account data: while your account is open, then deleted or anonymized after you close it, except as below.
• Financial and verification records: we retain the records required by applicable legal obligations for the relevant statutory period. Tax and accounting records may be retained for up to seven years; verification images and biometric information follow separate, shorter schedules where applicable.
• AI content and documents: we retain these while needed for the workspace's requested service, subject to deletion instructions and applicable retention obligations. Closing an individual account does not automatically delete records the workspace independently needs to retain.
• Security and audit logs: as long as needed to protect the Service and investigate incidents.
• Public blockchain data: permanent by nature. We cannot delete it.

To close your account and request deletion, use account deletion. Deletion requests are handled manually. We delete eligible data from active systems after review and from backups when those backups expire. Data retained for a legal obligation or dispute is restricted to that purpose and deleted when that basis ends.

We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption of stored data by our hosting providers, row-level access controls in our database, passkeys and optional multi-factor authentication, multi-signature approvals for treasury payments, access controls for staff, and monitoring. No system is perfectly secure, and we cannot guarantee the security of your data. Keep your sign-in methods, PIN, recovery questions and devices safe.

BUFI is based in the United States, and most of our service providers process data in the United States. Your data may also be processed in other countries where our providers operate. These countries may not have the same data protection laws as yours.

For restricted international transfers, we use the mechanism applicable to the particular transfer: an applicable adequacy decision, approved contractual safeguards with required supplementary measures, or another legally available mechanism. These may include EU Standard Contractual Clauses, the UK Addendum or IDTA, and ANPD-approved clauses for Brazilian transfers. Contact hello@bu.finance for the mechanism applicable to your data and a copy of relevant safeguards, subject to necessary redactions.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict certain processing, including direct marketing;
• withdraw consent where we rely on it, without affecting earlier processing;
• appeal a decision we make about your request.

To exercise these rights, email hello@bu.finance or use account deletion. We will need to verify your identity, usually by confirming the email address on your account. You may use an authorized agent where the law allows, and we may ask for proof of their authority. We will not discriminate against you for exercising your rights.

You can also manage cookies in the cookie banner or in Settings, unsubscribe from marketing emails using the link in each email, and turn off push notifications on your device. Some data is required to provide the Service; if you do not provide it, some features may not be available.

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us at hello@bu.finance and we will delete it.

The Service links to and integrates with services we do not control, such as our financial partners, blockchain explorers and integrations you connect. Their privacy policies, not this one, govern how they handle your data.

We may update this Policy. We will post the new version here with a new effective date, and if a change is material we will notify you by email or in the Service before it takes effect.

This Section applies if you are in the European Economic Area, the United Kingdom or Switzerland.

Legal bases. We process personal data on these legal bases:

• Performance of a contract: to provide the Service you signed up for, including accounts, wallets, payments, AI features and support.
• Legal obligation: where the processing is required by law recognized under the applicable data-protection regime. For EU GDPR purposes, this means applicable EU or Member State law. A foreign-law or partner requirement does not automatically establish that basis; other processing, such as identity verification and sanctions screening required by our partners, relies on a separately assessed legal basis such as legitimate interests.
• Legitimate interests: keeping the Service secure, preventing fraud, improving the Service, and communicating with business customers. We balance these interests against your rights.
• Consent: optional cookies and analytics, certain marketing, and biometric face-matching during identity verification where consent is required. You can withdraw consent at any time.

Complaints. You can lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first at hello@bu.finance.

If you are in Brazil, you have the rights provided by the Lei Geral de Proteção de Dados (LGPD), including confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and revoking consent, and you may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

If you are in Argentina, you may exercise your rights of access, correction and deletion under Law 25,326, and the Agencia de Acceso a la Información Pública is the supervisory authority. If you are in Mexico, you may exercise your ARCO rights (access, rectification, cancellation and opposition) under the Federal Law on the Protection of Personal Data Held by Private Parties. Residents of other countries may have similar rights under local law.

To exercise any of these rights, email hello@bu.finance.

Residents of California and other US states with comprehensive privacy laws have the rights described in Section 9, to the extent those laws apply to us.

• In the past 12 months we have collected the categories of personal data described in Section 2: identifiers, customer records, commercial and financial information, internet and device activity, approximate location, audio (voice messages), professional information, and sensitive personal information (government ID numbers, account credentials, financial account details and biometric data used for identity verification).
• We use sensitive personal information only to provide the Service, verify identity, prevent fraud and comply with law, and not to infer characteristics about you.
• We do not sell personal information and do not share it for cross-context behavioral advertising.

Biometric data. Persona performs face matching for identity verification and may generate facial geometry from your submitted images. Before biometric collection, the verification flow identifies the collecting entities, purposes, disclosures and retention period and obtains the consent or written release required by applicable law. BUFI receives verification results and necessary identity details; any biometric information accessible to BUFI is subject to the applicable biometric retention and destruction policy. Biometric identifiers and biometric information are permanently destroyed when their collection purpose is satisfied or within three years after the individual's last interaction with the collecting entity, whichever occurs first, subject to applicable law.