Privacy policy

1. Controller

The controller responsible for personal data processing for the SaaS offering and marketing website is:

Westara GbR, partners Marco Graf and Olga Graf
Mittelweg 26
60318 Frankfurt am Main
Deutschland
Email: legal@westara.io

Managing partners: Marco Graf, Olga Graf.
Legal form: GbR (partners are jointly and severally liable under German law).

2. Scope

This policy covers the public marketing website (e.g. westara.io / www.westara.io) and the SaaS product (e.g. app.westara.io) where we act as controller.

Self-hosted / Sovereign deployments store data on the instance operator’s server. That operator is additionally or primarily the controller there; this policy applies to such instances only where we ourselves process data (e.g. optional telemetry you explicitly enable — off by default).

3. What data we process

Depending on use, the following categories may apply:

• Account data: email, display name, hashed passwords, session/auth metadata, optional profile and onboarding fields
• Session and security data: For each sign-in we store a session identifier, the time of sign-in and of last activity, a device label (e.g. "Firefox · macOS") and the approximate location (city and country) that our hosting provider derives from your IP address. We do not store your IP address itself for this. Under "Account & security" you can see your active sessions and sign out individual or all other devices. If you sign in from a new device or a new country, we send you a security email.
• In-app content (highly sensitive): household budget, actual spending and income, portfolio/transaction data, cash positions, Bitcoin balances (watch-only / zpub only — no private keys) that you enter or import
• Integration secrets: API keys for optional services (e.g. market data, xAI, eToro Read keys) — stored encrypted
• Payment and billing data: via Stripe (we do not store full card numbers); invoice metadata for commercial/tax purposes
• Communications: support/feedback messages you send us; with explicit consent, the record and delivery of optional notes (education, product, news); feedback you send in the app, with the page it came from and whether you want a reply
• Technical data: IP address, timestamps, user agent, access/error logs as needed for operations and security
• Website preferences: language and theme (essential cookies / local storage)
• Optional website analytics: usage and performance measurement only with consent (see Cookies)
• Sign-up source: If you create an account via a link on our website, we store with your account which link and campaign you came from (chosen plan, link position, campaign parameters). Purpose: measuring how well our website and campaigns work. Legal basis: Art. 6(1)(f) GDPR; you may object (Art. 21 GDPR). Retention: 12 months from sign-up.
• AI context: for Ask Westara and AI insights, the context prepared for the request; for the automatic AI insights on the Overview, only the type of note, a standard category, the month and calculated values (see section 10); for other automatic AI features, the data needed for that task (e.g. booking texts, categories); never a full export of your household or portfolio picture. Westara never puts keys or a vault export into the content of an AI request. Anything you type or paste yourself goes to the AI provider as written. IBANs we detect are removed first; this doesn't work in every case
• Bank import / open banking (AIS): only if you actively connect; the AISP sees raw bank lines for the read; Westara then stores the account list, IBAN and holder where the bank provides them, balances, and booked lines via finAPI GmbH or BANKSapi Technology GmbH
• Broker API (eToro): only if you paste Read keys on a depot — keys encrypted, trades and cash/crypto snapshots in your workspace; Write keys are refused. Not PSD2 AIS
• Broker-rail (WealthAPI): shipped, env-gated, not PSD2 AIS — same honesty as eToro; refresh encrypted; write and orders refused
• Broker API (Interactive Brokers): only if you paste a Flex Web Service token and query ID on a depot — token encrypted, trades and cash snapshots in your workspace; not PSD2 AIS and not MCP. Orders are refused
• Referral data: your referral code, the link between the referring and the new account, and the time of signup (see section 22)

4. Heightened care for household and financial data

Household budgets, transactions, portfolios and related content are economically and personally highly sensitive. We apply heightened care:

• Your account and financial data is encrypted in transit using TLS and stored encrypted by our hosting and database providers. We run anonymous usage statistics (Umami) on our own server; they contain no account or financial data.
• Tenant isolation and row-level security where implemented
• No use of this content data for advertising, third-party profiling, or sale
• Staff access only for legitimate support and only as needed
• Bitcoin: non-custodial only (watch-only / zpub); we neither request nor store private keys or seed phrases

5. Purposes and legal bases

We process data only where a legal basis applies:

• Art. 6(1)(b) GDPR — performance of a contract and pre-contractual steps (account, app features, subscription, support, data export); requests made with your own xAI key (see section 10); handling your feedback and, if you wish, replying to it ((b) and (f)).
• Showing and managing your active sessions and sending security emails on new sign-ins (Art. 6(1)(b) GDPR; additionally (f), protecting your account against unauthorised access)
• Art. 6(1)(c) GDPR — legal obligations (e.g. commercial/tax retention of invoices)
• Art. 6(1)(f) GDPR — legitimate interests in secure operation, abuse prevention, error analysis, and product improvement in aggregate/anonymised form (balanced against your rights; minimal logging); automatic AI features such as phrasing the “New for you” notes on the Overview (objection under Art. 21 GDPR per member in the app under Integrations → AI) and sorting new bank transactions or the daily watchlist summary (objection under Art. 21 GDPR for the household at legal@westara.io)
• Art. 6(1)(a) GDPR — consent, in particular for optional analytics cookies, optional email notes (education, product, news) after double opt-in and voluntary integrations where not already required for the contract; withdraw anytime with effect for the future
• Attributing referrals and preventing abuse in the referral programme (section 22); legal basis Art. 6(1)(f) GDPR

6. Hosting, recipients and processors

Logo.dev. We fetch company logos for your holdings from Logo.dev (Logodev, Inc., USA) through our own server and cache them. No personal data about you, including your IP address, is sent to Logo.dev.

We use carefully selected service providers. Where they process personal data on our behalf, we rely on Art. 28 GDPR processing agreements or the providers’ standard Data Processing Agreements (DPAs) and maintain an internal register of processors in use. Typical recipients:

Audience measurement (Umami, self-hosted). To count page views and selected usage events (clicks on designated marketing buttons), we run the open-source software Umami on a Start9 instance we operate (EU/DE), reachable at stats.westara.io. Public access is provided via a tunnel server of Hetzner Online GmbH (Germany; processor; data-processing agreement in place). We record in particular paths visited or event names, timestamps and coarse technical attributes (e.g. browser or device type, approximate country) and, where applicable, coarse event properties (e.g. marketing-button id). Where enabled, we also record aggregated page-performance metrics (Core Web Vitals, e.g. load and interaction timings such as LCP, INP, CLS). We do not transmit email addresses, user or household identifiers, names, IBANs, bank names as free text, filenames, raw import data or advertising-tracking parameters. We do not use cookies for this measurement; search parameters and URL fragments are not collected. “Do Not Track” and “Global Privacy Control” signals and the local opt-out setting umami.disabled are honoured. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in audience measurement and product improvement). Objection: Art. 21 GDPR (contact in section 13) or opt-out via umami.disabled. Retention in Umami: indefinitely, until the instance is deleted.

Turn off audience measurement in this browser

• Vercel Inc. — hosting and delivery of website/app (edge/CDN); optional Web Analytics and Speed Insights only with consent
• Neon, Inc. — PostgreSQL database for the SaaS product; production data is hosted in the EU (typically AWS eu-central-1 / Frankfurt or another configured EU region)
• Stripe, Inc. / Stripe Payments Europe Limited — card payments and subscriptions (partly independent controller for payment data)
• Resend (email delivery) — To send emails, we use Resend, Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Through it we send transactional emails (e.g. sign-in, confirmations, account notices; Art. 6(1)(b) GDPR) and – only with your consent – our newsletter, which is the optional notes in section 21 (Art. 6(1)(a) GDPR). We process your email address, your name where applicable, and technical delivery data. We have a data processing agreement with Resend (Art. 28 GDPR); transfers to the USA are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Resend is certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Processing takes place mainly in the USA; after the end of the contract, Resend deletes the data within 90 days.
• xAI — AI features: when you use Ask Westara or AI insights, and automatically for certain AI features (e.g. phrasing the “New for you” notes on the Overview, sorting new bank transactions, the daily watchlist summary); only the data needed for each task. Each member can object to the automatic AI insights on the Overview for themselves in the app under Integrations → AI; you can object to the other automatic features at legal@westara.io, and we will then switch them off for the whole household.
• xAI (your own key) — only if you store your own xAI API key: we pass requests that contain only data you manage yourself in Westara to xAI on your instruction. For these, xAI does not act as our processor; your own agreement with xAI and its terms apply, including on retention.
• Sentry (Functional Software, Inc.) — application error monitoring; events are scrubbed; no session replay
• Google LLC — optional Google sign-in on Cloud (SaaS) only; the provider sees that you use Westara
• Apple Inc. — optional Sign in with Apple on Cloud (SaaS) only; Hide My Email may share a relay address instead of your mailbox
• finAPI GmbH or BANKSapi Technology GmbH (BaFin-supervised AISPs, EEA) — optional PSD2 bank read only if you connect it and the plan enables it; the AISP sees raw bank lines for the read; file import (CSV/CAMT) does not use an AISP
• eToro — optional depot connect (Read keys only) if you set it up; eToro remains responsible for the broker account; we store the portfolio data returned
• WealthAPI — shipped, env-gated broker-rail (not PSD2 AIS) if you connect it; refresh stored encrypted; write and orders refused; we store the returned portfolio data
• PostHog (product analytics) — To improve Westara, we analyse how the app is used, e.g. which features are used. For this we use PostHog, PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, with data storage in the EU (Frankfurt). We only transmit pseudonymous usage events with an pseudonymised (hashed) identifier – no email address, no name, no IP address and no transaction contents. The legal basis is our legitimate interest in a working, user-friendly app (Art. 6(1)(f) GDPR). We have a data processing agreement with PostHog (Art. 28 GDPR); for any possible access from the USA, the EU Standard Contractual Clauses apply (Art. 46 GDPR). The data is deleted after 12 months, or earlier if your account is deleted. You can object to this analysis at any time (Art. 21 GDPR) by email to legal@westara.io.

7. International transfers (especially US / xAI)

Some providers are established or use sub-processors in the United States or other third countries outside the EEA. Where an adequacy decision does not apply, we rely on appropriate safeguards under Art. 46 GDPR — in particular EU Standard Contractual Clauses (SCCs) — plus supplementary technical and organisational measures (encryption, access restriction, data minimisation).

Our AI provider (xAI) processes data in the US. Data goes there when you use Ask Westara or AI insights, and automatically for certain AI features, for example phrasing the “New for you” notes on the Overview, sorting new bank transactions or the daily watchlist summary. For each task we send only the data it needs — never a full export of your household, budget, or portfolio picture. Booking texts and payee names may be included. Each member can object to the automatic AI insights on the Overview for themselves in the app under Integrations → AI; you can object to the other automatic AI features at any time by emailing legal@westara.io, and we then switch them off for your household. With your own key, we pass requests to xAI on your instruction under your own agreement with xAI. Sub-processor details appear in the providers’ DPAs.

Error monitoring (Sentry) may involve a US processor; events are scrubbed and session replay is not used.

Optional Google or Apple sign-in on Cloud (SaaS) is a transfer to a US identity provider, only when you choose that button. Self-hosted / Sovereign does not offer social login.

Optional broker APIs (eToro, WealthAPI) call the vendor’s public API when you connect. The broker or rail remains independently responsible for that account and may use infrastructure outside the EEA, under its own terms.

8. Bank import, open banking (AIS), and broker APIs

The primary bank import is a file you upload (CSV/CAMT). File import does not use an AISP — it is a private path with no licensed reader. Optional live read (PSD2 AIS) uses finAPI GmbH or BANKSapi Technology GmbH, licensed account information service providers (AISPs) in the EEA supervised by BaFin, only on your initiative and bank authorisation, and only when the plan enables it.

Westara is not an AISP. We do not hold PSD2 certificates, do not perform strong customer authentication with your bank, and do not store online-banking passwords, PINs, or TANs. The AISP that performs the read (finAPI GmbH or BANKSapi Technology GmbH) sees the raw bank lines needed for that read. After you approve access at the bank, we receive and store in your tenant workspace: the account list and metadata (including IBAN and account-holder name where the bank provides them), balances, and booked lines (counterpart and remittance). Lists in the product show last four digits; you can export or delete your data. Payment accounts land in Actuals. When the bank also exposes a securities account on the same login, positions and trades land in Activity, not Actuals. The first live fetch covers about 90 days; later fetches add new days only.

Live Open Banking on Cloud or on a self-hosted / Sovereign install is not a “Westara-blind” path: the AISP still sees raw lines, and Westara still stores the approved list, balances, and booked lines. Self-hosted / Sovereign stays file-based unless you attach live AIS yourself.

Disconnecting the bank in the app stops new fetches and revokes the live login. Stored Actuals, Activity rows, and Westara accounts remain unless you choose the optional wipe of imported Open Banking rows on those accounts, or until you delete them in the app, or until you delete your Westara account. File import stays available.

The AISP that performs the read (finAPI GmbH or BANKSapi Technology GmbH) is independently responsible for the bank interface and consent under its AISP licence. Processing of data delivered into Westara follows the contractual and privacy terms agreed with the provider (including Art. 28 GDPR where the provider acts as processor). Household members you invite may see the same books according to household sharing.

Optional broker connect (eToro) is not PSD2 AIS. You paste Read keys (Public / Private) from eToro on a depot. Write keys are refused and never stored. We encrypt the Read keys and call eToro’s public API on your initiative. We store the returned trades, cash snapshots, and crypto-wallet snapshots in your workspace for Activity and Holdings. eToro remains independently responsible for the broker account. Disconnect always deletes the stored keys and stops further fetches. Imported eToro rows stay unless you choose the optional wipe on that depot. Keys and raw eToro history are not sent to xAI. CSV import stays available and uses the same row identity.

Optional broker-rail (WealthAPI) is shipped, env-gated, and not PSD2 AIS — the same honesty shape as eToro. Refresh tokens are stored encrypted. Write access and orders are refused. Disconnect always deletes the stored refresh and stops further fetches. Imported rows stay unless you choose the optional wipe on that depot. WealthAPI remains independently responsible for the broker connection.

BANKSapi Technology GmbH is a second licensed EEA AISP behind the same adapter; it is offered only when operators enable it.

Typical data flow: the app runs on Vercel; books are stored in Neon in the EU (typically Frankfurt). You either upload a file (no AISP) or connect AIS (finAPI GmbH or BANKSapi Technology GmbH sees the raw lines). Ask Westara and the automatic AI features send the data each task needs to xAI. Price vendors supply marks.

Typical data flow

Cloud books live in the EU. That is residency plus a household envelope for leftover IBANs, holder names, account notes, and booking payee when the envelope is on. It is not a promise that nobody can read the books, and it is not immunity from foreign lawful access. Self-hosted / Sovereign is the only non-access promise: we do not operate that database.

• App (Vercel) — website and captain app
• Books (Neon, EU, typically Frankfurt) — tenant workspace; leftover IBANs / account holder / notes / payee sealed with a per-household key when the envelope is on
• File import (CSV / CAMT) — private path; no AISP
• Optional live AIS — finAPI GmbH or BANKSapi Technology GmbH see the raw bank lines
• Ask Westara and automatic AI features — the data each task needs, to xAI; booking texts and payee names may be included
• Price vendors — marks only

9. Cookies and similar technologies (TDDDG)

On the marketing website we store:

• Essential: language preference (captain-locale-preference) and display mode (captain-theme-preference / local storage) — required for the experience you request; § 25(2) TDDDG / Art. 6(1)(f) or (b) GDPR
• Optional (consent only): Vercel Web Analytics and Speed Insights — reach and performance measurement; § 25(1) TDDDG / Art. 6(1)(a) GDPR. Optional analytics cookies are not loaded without consent
• We store your choice locally (captain.marketing.cookie-consent) as essential or all; you can change it anytime via Cookie settings in the banner or footer
• The cookieless Umami audience measurement (section 6) is distinct from the optional Vercel web analytics and Speed Insights, which load only after consent.

10. AI features

AI chat help and AI insights are plan-dependent. When you use them, the context prepared for the question is sent to our AI partner (xAI). We never send a full export of your household or portfolio picture.

Automatic AI insights on the Overview (“New for you”).
Westara calculates up to three short notes from your data in the view you have selected (Me, one person or All), for example how far a spending category was over your plan last month, what your subscriptions cost per year. Our application does this calculation itself, without AI. Only so that these finished notes can be phrased as a sentence, we send xAI the following, at most once a day per view: the type of note, the name of a standard category, the month and the calculated amounts or percentages. We do not send transactions, names of payees, contracts, securities or people, category names you created yourself, or account data for this. We do not use categories that may reveal health, religion, political opinions, trade-union membership or sex life for these notes. In the All view, the notes refer to the data of all members that view covers.

The legal basis is our legitimate interest in presenting your own figures clearly (Art. 6(1)(f) GDPR). Each member can object at any time (Art. 21 GDPR) for themselves, directly in the app with the “Automatic AI insights” switch under Integrations → AI. We will then still show the notes, but only as fixed text, and send nothing to xAI for them. Your objection also covers your data in other household members’ All view. This switch only covers the notes on the Overview, not the other automatic features in the next paragraph. We keep the phrased sentences as a cache in your workspace and replace them at the next refresh; they are deleted with your account.

Other automatic AI features.
Sorting new bank transactions, suggestions for budget rules and for matching connected bank accounts, assigning leftover receipt items, and the daily watchlist summary send the data needed for that task; transaction texts and payee names may be included. The legal basis is also Art. 6(1)(f) GDPR. These features are one setting for the whole household: if you object at legal@westara.io, we switch them off for your household.

Your own xAI key.
If you store your own xAI API key, we use it only for requests with data you manage yourself in Westara (not other household members’ data and not accounts you have marked as joint or partner). All other requests never use your own key. Requests made with your key are governed by your own agreement with xAI (see section 6); the legal basis is Art. 6(1)(b) GDPR.

We label AI-generated text in the app. See Help (Grok / privacy) for more. You may clear chat history in the app where the feature allows. AI outputs are non-binding assistance only — not financial, investment, tax, legal or insurance advice.

11. Retention

We retain personal data only as long as needed for the purposes:

• Account and app content: while the account exists and features require it
• Session and security data: while the session is active, then 30 days after sign-out or last activity
• Records of security emails sent: at most 90 days
• After account deletion: delete or anonymise within operational windows (typically within 30 days), unless legal retention applies
• Invoices and payment records: typically 6–10 years under commercial and tax law
• Security and access logs: short-term (usually days to a few weeks) unless an incident requires longer retention
• Open Banking (AIS) bookings: remain with app content after you disconnect the bank, unless you later confirm a separate delete of imported Open Banking rows on those accounts, or until you delete the lines in the app or delete the account
• eToro Read keys: deleted on Disconnect. Imported eToro rows stay unless you choose the optional wipe on that depot
• WealthAPI refresh: deleted on Disconnect. Imported WealthAPI rows stay unless you choose the optional wipe on that depot
• IBKR Flex token: deleted on Disconnect. Imported IBKR rows stay unless you choose the optional wipe on that depot
• Cookie consent: until withdrawn or local storage is cleared
• Optional notes consent: the proof record (time, wording version, source, status) while the account exists and afterwards within operational windows where we must demonstrate lawfulness
• In-app feedback: until handled, at most 12 months
• Public help pages: only the article and yes or no, plus a hash of the IP address instead of the address. A new vote on the same article replaces the old one.
• AI note cache: until the next refresh, at the latest when your account is deleted
• Referral data: while both accounts exist (see section 22)

12. Your rights

Under the GDPR you have the right to:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — structured, commonly used, machine-readable format
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent with effect for the future (Art. 7(3))

13. Exercising your rights

Export and delete controls are available in product account settings where possible. You may also contact us at legal@westara.io. We respond within statutory timeframes (typically within one month). We may request suitable proof of identity.

14. Complaints to a supervisory authority

You may lodge a complaint with a supervisory authority, in particular in your Member State of habitual residence, place of work, or place of the alleged infringement. For the controller’s seat in Hesse (Germany), the competent authority includes:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
https://datenschutz.hessen.de

15. No sale for advertising

We do not sell your personal data to third parties for advertising. Household and portfolio content is processed to provide the service to you — not to build advertising profiles and not to sell to data brokers.

16. Obligation to provide data and consequences of not providing

Without certain data (e.g. email and authentication) we cannot provide an account or contract. Optional data (AI, bank import, analytics cookies) is not required for basic free use of the marketing website. Not providing optional data only limits the respective optional features.

17. Automated decision-making

We do not make solely automated decisions under Art. 22 GDPR that produce legal effects or similarly significant effects. AI outputs are assistance only and are not binding financial or legal advice.

18. Personal data breach

In the event of a personal data breach we notify the competent supervisory authority under Art. 33 GDPR and — where required — affected individuals under Art. 34 GDPR if the breach is likely to result in a high risk to your rights and freedoms.

19. Data protection impact assessment (DPIA)

For processing of highly sensitive household and financial data in the SaaS context we maintain a data protection impact assessment (Art. 35 GDPR) and update it when processing changes materially, where the risk to natural persons’ rights and freedoms is likely to be high. Outcomes feed technical and organisational measures. A summary may be provided on request to the imprint address where trade secrets do not preclude disclosure.

20. Self-hosted / Sovereign

Self-hosted / Sovereign is an alternative deployment of the same app, self-hosted from source (technical setup today; a ready-to-run Docker image and the Start9 package are in progress). Books Westara does not host stay on your server — that mode is the non-access promise for those books. Optional outbound connections (live prices, AIS, AI) are your choice; live AIS on a home server still shares raw bank lines with the AISP. The instance operator is usually the primary controller for content data stored there. Our responsibility is limited to the software we provide and — if any — optional services we operate that you deliberately connect.

21. Optional notes by email

If you expressly consent, we send you occasional notes on family wealth, the product, and education to your account email address. These notes are the newsletter in this policy. There is no second consent for them. Your account also works without this consent; the box is not pre-ticked. We send the notes only after you have confirmed that the email address belongs to you: if your address is not yet confirmed, that happens through the confirmation link in the account-verification email, which then includes a notice of your signup; if your address is already confirmed by that link, your tick in the signed-in account is enough (double opt-in). If the address was marked confirmed without that link, we send one email with a confirmation link, and the notes start only after that click. To prove your consent we store your user id, the time, the place of signup in the app, the version and the wording of the consent text shown, and the confirmation method (Art. 7(1) GDPR), for as long as you receive the notes and afterwards until the limitation period for possible claims ends (usually three years, to the end of the year). Transactional emails (verification, sign-in, invoices, security, invites) and Radar notifications are separate from this. You may withdraw your consent at any time in your profile or via the unsubscribe link in such an email, with effect for the future. These notes do not contain household or portfolio figures.

Usage statistics in the app

To see where new households get stuck, we analyse data we already store to provide your account: when you signed up, whether and when you made a first import or created a first account, whether you logged in again in the first days, and whether the trial turned into a paid plan. We use only our own database, no third-party tracking services. We look only at aggregated weekly figures, not individual households, and do not share them.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is improving our product. Retention: as for the underlying account data; the weekly figures contain no personal data. Objection: at any time by email to legal@westara.io (Art. 21 GDPR); we then exclude your household from the analysis.

22. Referral programme ("Recommend Westara")

You can recommend Westara with a personal referral link. The link contains a randomly generated code; it does not contain your name or email address. You share the link yourself, for example through your device's share menu, WhatsApp, your own email app, or by copying it. Westara does not send any messages for this. We do not receive the names or contact details of the people you send the link to, and we do not access your address book.

When someone opens the link, the code is passed on only in the page address (URL) and shown visibly in the "Invitation code" field at signup. We do not store the code on the device: no cookies, no local storage and no similar technologies. If the field is cleared before signing up, no referral is recorded.

When someone signs up with a valid code, we store the code, the link between the referring and the new account or household, and the time of signup. We use this to attribute and count referrals and to prevent abuse. The referrer only sees how many signups were recorded through their link. They do not see the invited person's name, email address or any other data. We do not show the invited person who invited them. The households stay separate; a referral does not share any household or financial data.

The legal basis is our legitimate interest in attributing referrals, measuring their effect and preventing abuse (Art. 6(1)(f) GDPR). We do not use any content from your household for this. You can object at any time (Art. 21 GDPR), as referrer or as invited person, by emailing legal@westara.io. We will then delete the link.

We keep the link for as long as both accounts exist. If either account is deleted, we delete the link within the time frames in section 11.

MCP interface for your own AI tools

On your request we give an AI tool you choose read access to data in your household.

• Purpose: on your request, give your chosen AI tool read access.
• Legal basis: Art. 6(1)(b) GDPR for performance of the contract, on your instruction. For joint data of co-members: Art. 6(1)(f) GDPR (joint budget).
• Special categories (Art. 9 GDPR): By default, bookings that may reveal special categories (including health, religion, trade-union membership, political party, sex life) are hidden in MCP output and excluded from every total. After a separate, revocable consent (Art. 9(2)(a) GDPR) in the app, we may transmit such data to the AI clients you grant. In version 1 the consent covers your own accounts only; joint accounts stay hidden until each co-account holder gives their own consent. This consent is not part of merely enabling MCP.
• Data categories: depending on the areas you grant — accounts with shortened IBAN, bookings, categories, budgets and totals; Portemonnaie / cash (balances, currency, last activity); investments (positions and home-currency values as shown in the app); illiquid assets / Sachwerte (name, category, value, ownership) if you use Sachwerte in the app. Free-text notes and receipts are not included in this version. Other members' private accounts are not transmitted.
• Recipient: the AI provider you choose, as an independent recipient and not our processor.
• Third countries: possible depending on the provider. Westara does not transfer to the third country itself; the transfer is made by you or on your instruction to your provider. Safeguards are the provider's matter.
• Token: we store only a hash. Expiry is at most 90 days, and you can revoke it in the app.
• Audit log: time, scope and token id, with no IP (or IP kept for at most 7 days); retention 12 months.
• Rights: Art. 15 et seq. GDPR. Access ends when you revoke the token.