Privacy Policy

This Privacy Policy describes how Fylo collects, uses, and protects your information when you use our cash-flow forecasting service. Fylo helps you predict your bank balance, spot danger days, and plan ahead by analyzing the financial data you choose to connect or upload.

Information We Collect

Account Information

When you create an account, we collect your name, email address, and (if you sign in with a password) a securely hashed password.

Financial Account Data via Bank Data Providers

Fylo connects to your bank and card accounts through third-party account aggregation providers: Teller, Plaid, and SimpleFIN. Which provider is used depends on how you link an account. With your authorization, we receive account balances, transaction history, and account metadata from the provider you connect through. Fylo never sees or stores your online banking username and password — those credentials are handled directly by the provider.

Documents and Files You Upload

If you upload bills, receipts, bank statements, or other financial documents (such as PDFs, images, spreadsheets, or CSV files), we collect and store those files along with the financial details we extract from them (for example, biller name, amount, and due date).

Optional Email Access via Gmail

If you choose to connect Gmail, Fylo requests access to your email (the gmail.modify scope) so it can detect bills, receipts, and expected income to improve your forecasts. We only read messages to extract transactional and bill-related signals, and we store the extracted details and, where needed to provide the feature, the relevant message content and attachments. After Fylo has processed an email, it applies a "Fylo" label and archives the message and marks it read to keep your inbox tidy; Fylo never sends, deletes, or modifies the content of your email. This access is entirely optional and can be revoked at any time from your Fylo settings or your Google Account permissions.

How We Use Your Information

We use the information we collect to:

• Forecast your upcoming balance and cash flow
• Identify recurring bills, expected income, and potential danger days
• Extract financial details from documents and emails you choose to provide
• Provide, maintain, and improve the Fylo service
• Communicate with you about your account and important changes
• Ensure security and prevent fraud
• Comply with legal obligations

AI Processing

Fylo uses AI models (large language models) to read the documents, email content, and transaction data described above and to extract structured financial details (for example, biller name, amount due, and due date) and categorize transactions. Depending on your settings and how your Fylo instance is deployed, this processing is performed by one of the following:

• AI providers reached through Plexo, our affiliated AI gateway, if you connect Plexo to your account
• An AI provider you connect yourself using your own API key
• A locally hosted model running on the Fylo server, where enabled

Content is sent to these model providers only as needed to provide the features described in this policy. We do not use your data — including any Google user data — to train generalized AI or machine-learning models, and we do not permit model providers acting on our behalf to do so.

Google API Limited Use Disclosure

Fylo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide user-facing features of Fylo: detecting bills, receipts, and expected income to improve your forecasts.
• We do not transfer Gmail data to third parties except as necessary to provide those features (for example, sending message content to an AI model provider for extraction, as described under "AI Processing"), to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use Gmail data for advertising.
• We do not allow humans to read your Gmail data unless we have your affirmative agreement, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
• We do not use Gmail data to train generalized AI or machine-learning models.

Data Storage and Security

Uploaded documents and email attachments are stored in Cloudflare R2, an S3-compatible object storage service. Account, transaction, and forecast data is stored in our application database. Data is encrypted in transit using TLS (HTTPS); uploads go directly to storage over short-lived signed URLs. We implement appropriate technical and organizational measures to protect your financial information against unauthorized access, alteration, disclosure, or destruction. Access to your data is restricted to systems and personnel that need it to operate the service.

Data Retention and Deletion

We retain your data for as long as your account is active. You can disconnect any bank connection or Gmail access, delete individual uploads, or delete your financial data or your entire account at any time from your settings. When you delete your account, your financial data is deleted and your account is closed; we may retain limited records where required by law.

We Do Not Sell Your Data

Fylo does not sell, rent, or trade your personal or financial information to third parties. We do not use your financial data for advertising.

Third-Party Services

We rely on third-party providers to deliver Fylo, including Teller, Plaid, and SimpleFIN (bank connectivity), Google (optional Gmail access and sign-in), Cloudflare (object storage for uploaded documents), AI model providers (document and transaction processing, as described under "AI Processing"), and Stripe (payment processing, only where paid billing is enabled). These providers process data under their own privacy policies and terms.

Your Rights

You have the right to:

• Access the personal and financial data we hold about you
• Export your data in a portable form
• Correct inaccurate data
• Disconnect any connected bank account or Gmail access at any time
• Request deletion of your account and associated data

To exercise these rights, contact us using the details below.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us.