Privacy Policy

Last updated: April 18, 2026

Who we are

Proxivo ("we", "us") is operated by Widurki Labs, a sole trader based in Dublin, Ireland. Contact: privacy@widurki.net

What data we collect

Data	Purpose	Stored where	Retention
Email address	Account identification, billing	Stripe	Until account deletion
API key	Authentication	Cloudflare KV (encrypted)	Until account deletion
OAuth tokens	Bank API access	Cloudflare KV (AES-256 encrypted)	Until consent expiry or revocation
Bank account IDs	Mapping connected accounts	Cloudflare KV (encrypted)	Until disconnection
Transaction data	Serving get_transactions and spending tools	Cloudflare D1 (encrypted)	Rolling 12 months, or until deletion
Payment info	Subscription billing	Stripe (never touches our servers)	Per Stripe policy

What we do NOT collect or store

Bank login credentials — we never see your username or password. Authentication happens directly with your bank via PSD2 open banking.
Full account numbers — we store only IBANs and account identifiers provided by the open banking API.
Payment card details — handled entirely by Stripe. We never process or store card numbers.

How we access your bank data

We use PSD2-regulated Account Information Service Providers (AISPs) to access your bank data. Currently, our provider is Enable Banking, a licensed aggregator operating under EU PSD2 regulation.

Access is read-only — we can view balances and transactions but cannot initiate payments, transfers, or any account modifications. This restriction is enforced at the banking API level.

Your consent is valid for a maximum of 90 days (per PSD2 regulation), after which you must re-authorize. We will notify you before expiry.

Legal basis (GDPR)

Contract performance (Art. 6(1)(b)) — processing your bank data is necessary to deliver the MCP tools you signed up for.
Consent (Art. 6(1)(a)) — you explicitly authorize bank access through the PSD2 OAuth flow.
Legitimate interest (Art. 6(1)(f)) — service monitoring, security, and fraud prevention.

Data sharing

We share data only with:

Enable Banking (AISP provider) — to access your bank's open banking API
Stripe — for payment processing
Cloudflare — infrastructure hosting (data processing agreement in place)

We do not sell, rent, or share your data with advertisers, data brokers, or any third party not listed above.

Data location

Data is processed and stored within the EU (Cloudflare EU data centers). Bank API calls are routed through Enable Banking's EU infrastructure.

Your rights

Under GDPR, you have the right to:

Access — request a copy of all data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of all your data ("right to be forgotten")
Portability — receive your data in a machine-readable format
Revocation — withdraw consent and disconnect bank access at any time
Complaint — lodge a complaint with the Irish Data Protection Commission (DPC)

To exercise any right, email privacy@widurki.net. We respond within 30 days.

Data deletion

When you disconnect a bank or delete your account:

OAuth tokens are deleted immediately
Transaction data is deleted within 24 hours
Account metadata is purged within 24 hours
Billing records are retained by Stripe per their legal obligations

Security measures

AES-256 encryption at rest for all sensitive data
TLS 1.3 for all data in transit
API keys hashed with bcrypt before storage
No plaintext credentials stored anywhere in our infrastructure
Infrastructure on Cloudflare Workers (SOC 2 Type II, ISO 27001 certified)

Changes to this policy

We'll notify you via email before making material changes. Continued use after notification constitutes acceptance.

Contact

Data controller: Widurki Labs (Wojciech Widurek)
Email: privacy@widurki.net
Address: Dublin, Ireland
Supervisory authority: Irish Data Protection Commission