1. Who is the data controller
The data controller is Bunix S.A.S. (NIT 901958981-0), with registered address at Calle 71 A # 39 - 21, Floor 2, Medellín, Antioquia, Colombia (hereinafter “Edrex”, “we”).
- Privacy email: [email protected]
- Support email: [email protected]
- Website: www.edrex.pro
Data protection officer: data protection contact point: [email protected].
If Edrex offers its service to people in the European Union from outside it, we will appoint a representative in the Union under article 27 GDPR.
2. Plain-language summary
- What we keep: your email and name, and what you record: transactions, goals, debts, assets, agenda, lists, challenges and your conversations with the assistant.
- What for: so the app works and the assistant can answer with your figures. We do not run ads, sell your data, or use analytics or tracking tools.
- AI: only if you accept, we send your messages and a summary of figures (without your name or email) to Google Cloud (Vertex AI, European Union) to generate the answer.
- Your bank (optional): only if you decide to connect it, an open-banking provider (Enable Banking, under the PSD2 Directive) reads your account transactions with your consent, read-only. Edrex never sees your bank credentials and cannot move money. You can remove the connection at any time (section 6 bis).
- Control: you can download your data and delete your account from the app, and withdraw your AI consent whenever you want.
3. What data we handle and where it comes from
| Category | Examples | Source |
|---|---|---|
| Account data | Email, name, password (only its encrypted hash is stored), user ID, chosen language and currency and, only if you add it, your phone number (optional: only shown on your profile; we do not use it to sign in, recover your account or send you text messages) | You provide it when signing up or in Settings |
| Financial data | Transactions (income, expenses, savings, debts), accounts (never the full number: only optional “last digits”), assets, debts and payments, goals and challenges | You enter or import it |
| Content you create | Notes, lists, agenda events and reminders | You create it |
| Conversations with the assistant | Your questions and the answers, saved in your account so you can pick them up again | You generate it when using the chat |
| Statements you import | PDFs or photos of a statement or receipt. We do not store the file: it is analyzed and only the transactions you confirm are kept | You upload it |
| Your bank data (only if you connect it) | Bank name, name and currency of your accounts, last 4 digits of the IBAN and a technical identifier, and the transactions (date, amount, merchant or person and description). We do not store the full IBAN and we never receive your bank credentials | Obtained from your bank by Enable Banking, with your consent |
| Consents and AI usage | Date and version of the consent; a log of each AI use (date, type, technical amount of text processed and cost), without its content | Generated when you use AI |
| “Your habits” progress (only if you turn it on) | Days with an action and its type (without amounts or content), suggested and completed missions, points, level, streak, chosen days per week, pause and time zone | Generated when you use the app with the feature on (section 6 ter) |
| Minimal technical data | IP address and request data when the app talks to our servers; session data | Generated automatically |
We do not collect: ID document, location, contacts, photos or files on your device (except those you choose to upload to import), or advertising identifiers. Edrex only connects to your bank if you decide so (section 6 bis) and never receives your bank login credentials.
Financial data is not a “special category” of data, but we know it is sensitive and we treat it with particular care.
4. What we use your data for and the legal basis
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Create and manage your account and provide the service (recording transactions, goals, agenda, summaries) | Performance of a contract: art. 6.1.b | While you have the account. Deleted when you delete it (see section 9) |
| Send you account emails (confirm email, reset password) | Performance of a contract: art. 6.1.b | As long as needed to send them; the provider’s logs as per section 9 |
| AI assistant and statement import (sending to Google Cloud) | Your explicit consent: art. 6.1.a. You can withdraw it at any time | Chat history until you delete it or delete the account. The imported file is not stored |
| Connect your bank and bring your transactions into Edrex (optional) | Your explicit consent: GDPR art. 6.1.a, in addition to the authorization you give at your bank under the PSD2 Directive. You can withdraw it at any time | While the connection is active (permission of 90 days at most, renewable); imported transactions, like the rest of your data |
| Show you your progress in “Your habits” (optional: streak, missions and level) | Performance of a contract: art. 6.1.b (a feature you turn on) | Detail: 120 days; counters, while you keep the feature or the account. Deleted with “Delete my progress” |
| Limit daily AI usage and control service cost (usage log without content) | Legitimate interest in the service’s sustainability and security: art. 6.1.f | While you have the account |
| Security: prevent abuse and unauthorized access, and detect failures | Legitimate interest in the security of the service: art. 6.1.f | General logs: 30 days; security logs: 90 days |
| Handle your support requests and the exercise of your rights | Legal obligation (art. 6.1.c) and performance of a contract | As long as needed and during the limitation period for possible liabilities |
| Comply with legal obligations that apply to us | Legal obligation: art. 6.1.c | The period set by the applicable law |
For legitimate interest we carried out a balancing test: the processing is the minimum necessary, does not use the content of your data and you have the right to object (section 10).
5. Artificial intelligence: what is sent and what is not
Edrex’s assistant and the statement import use Google Cloud (Vertex AI) models hosted in the European Union multi-region. We ask for your permission before the first sending, and the server requires it: without it these features do not work. The full text is in Consent to the use of AI.
- Sent: your message, the recent conversation and a summary of figures from your finances (month totals, categories, goals) without your name, email or notes; or the file you upload to import.
- Not sent: your password, your email, your name, your IP address as conversation data, or the rest of your account.
- You are talking to an artificial intelligence system, not to a person. We say so expressly to meet the transparency obligations of Regulation (EU) 2024/1689 on artificial intelligence (art. 50). The assistant is not meant to assess your creditworthiness or to make decisions about you; we do not classify it as a high-risk system.
- Limitations: it is a support assistant, not a professional. It does not give financial, tax, legal or investment advice; it can make mistakes or invent data.
- Legal basis for AI processing: your explicit consent (GDPR art. 6.1.a), which you can withdraw at any time without affecting what has already been done.
- Google acts as a data processor. It does not train its models on this data and may keep requests temporarily only to detect abuse.
- Automated decisions: the assistant only offers information and suggestions; it does not make decisions with legal effects on you. When you ask it to prepare a transaction it only proposes it: nothing is saved until you confirm with a button.
- Usage limits: we apply a daily maximum number of requests per person and a cap on service spending.
- AI can make mistakes. Always double-check what matters; Edrex is not financial advice (see Terms).
6. Voice dictation
If you use the chat microphone, speech-to-text is done by the speech recognition service of your device or browser (on mobile, the operating system’s: Apple or Google; on the web, your browser’s: Google in Chrome, Microsoft in Edge, Apple in Safari). Depending on your device and settings, the audio may be sent to that provider’s servers.
Edrex neither receives nor stores the audio: it only receives the resulting text, which you see before sending. Dictation is manual: it starts when you tap and ends when you stop it. You can type instead. To use it, the app asks for microphone and speech recognition permission, which you can withdraw in your device settings.
6 bis. Connecting your bank (optional)
If you decide so, you can connect your bank so that your transactions appear in Edrex without typing them. This is an optional feature and may not be available yet in all versions or countries. It relies on open banking under Directive (EU) 2015/2366 (PSD2): an authorized provider accesses your account information only with your consent.
- Who does what: the connection is made by Enable Banking, which accesses your bank and gives us the information; Edrex does not access your bank directly. For that access, Enable Banking also applies its own terms and privacy policy.
- How you authorize: we take you to your bank’s page, where you identify yourself. Edrex never sees or stores your bank login, passwords or codes.
- What is read: information about your accounts (name, currency, last 4 digits) and their transactions. Read-only: Edrex cannot make payments or transfers or move money.
- How long it lasts: the permission expires after 90 days at most (your bank may set a shorter period). After that we stop reading your bank until you renew it.
- Automatic sync: once connected, Edrex brings in your new transactions by itself every 6 hours (and when you tap “Sync now”), while the permission is valid. It only reads: it makes no payments.
- Categories: Edrex assigns a category to each new transaction. It first applies your rules (for example, “if the description contains ‘Mercadona’ → Food”). Only if you turn it on (Available money → “Categorize with AI”, off by default), what your rules do not cover is sent to Google Cloud (Vertex AI, EU): the merchant or description, the amount and the date of the transaction —never your IBAN, your name or your email— only to assign it a category. If you turn it off, only your rules are used. Legal basis: your consent (GDPR art. 6.1.a).
- How you remove it: in Available money → “Remove” (we revoke the access at Enable Banking), or from your bank’s app or website. Transactions already imported remain yours and you can delete them from Transactions.
- Legal basis: your explicit consent (GDPR art. 6.1.a). We do not use your bank data for advertising or sell it. If you use the AI assistant, imported transactions are summarized like the rest of your data (section 5).
6 ter. “Your habits” (optional)
“Your habits” is an optional feature to help you build the habit of looking after your money: a weekly streak, small missions (for example, reviewing today’s transactions or setting something aside for a goal) and a progress level. It is off until you turn it on, and you can pause it, switch it off or delete your progress at any time (Settings → Your habits).
- What data it uses: the days on which you took an action in the app and what type it was (for example, “log a transaction” or “review the day”), without amounts or content; the missions we suggested and which ones you completed; your points, level and streak; the number of days per week you chose, whether it is paused and your device’s time zone (to know which day it is for you).
- Where it comes from: it is generated automatically from what you already do in Edrex. Transactions your bank brings in on its own do not count.
- What for: only to show you your own progress. We do not use it for AI, advertising, commercial profiling or automated decisions, we do not compare you with other people and there are no prizes or draws.
- Legal basis: performance of a contract (GDPR art. 6.1.b): it is a feature of the service that you decide to turn on.
- How long: the detail of days and missions is kept for 120 days; after that only the counters remain (points, streak and total days). Everything is deleted with “Delete my progress” or when you delete your account, and it is included in “Download my data”.
6 quater. “Edrex notifications” on your phone (optional)
If you turn them on and allow them on your phone, Edrex sends you at most 2 notifications a week to celebrate your progress (for example, that you are close to reaching a goal or that you are spending less than last month). You can turn them off at any time in Settings → Preferences → Edrex notifications or in your phone settings.
- What we use to choose the message: the progress of your goals and debts, how your spending and savings compare with the previous month (as a percentage), your “Your habits” streak and whether you have gone a few days without logging transactions. The message is written by rules on our servers: your data is not sent to any artificial intelligence for this.
- What the notification shows: a title and an encouraging sentence, sometimes with the name you gave a goal or debt and a percentage. Never amounts. Depending on your phone settings, notifications may be visible on the lock screen.
- Who delivers it: Google Firebase Cloud Messaging (and, on iPhone, Apple’s notification service). They receive your device’s technical identifier and the notification text (section 7).
- What we keep: the technical identifier of your devices (while notifications are on and you are signed in on them) and a history of the notifications sent for 90 days, so as not to repeat them or send too many.
- Legal basis: your consent (GDPR art. 6.1.a), which you give by turning them on and allowing notifications on your phone, and which you can withdraw at any time.
7. Who we share your data with
We do not sell your data or give it away for advertising. We only disclose it to providers that process it on our behalf (data processors), under a contract (data processing agreement, DPA, or equivalent mechanism under GDPR art. 28) obliging them to follow our instructions and protect the information, and to authorities when the law requires us to.
| Provider | What for | Data it receives | Where |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication (sign-in) and server functions | Account data, financial data, chat history, consents and AI usage log | Project hosted in the European Union (eu-west-1 region, Ireland) |
| Google Cloud — Vertex AI (Google Cloud EMEA Limited / Google LLC) | Process the assistant’s requests and statement imports with artificial intelligence, only if you accept | Chat messages and a summary of your figures without your name or email; the file (PDF or image) you upload to import | Processing in the European Union multi-region |
| Enable Banking | Connect your bank and read your accounts and transactions with your consent (open banking, PSD2), only if you decide to connect it | Your authorization, the connection identifier and the data of your accounts and transactions that your bank gives it; never your bank credentials (you type them on your bank’s website) | Per its privacy policy |
| Cloudflare (Cloudflare, Inc.) | Serve the web version of Edrex and these pages (content delivery network) | IP address and technical data of each web request (not financial content) | Global network |
| Resend (Resend, Inc.) | Send account emails: confirm your email and reset your password | Your email address and the message content (access link) | |
| Google Firebase Cloud Messaging (Google LLC) and Apple Push Notification service (Apple Inc.) | Deliver “Edrex notifications” to your phone, only if you turn them on and give permission | Your device’s technical identifier for notifications and the notification text (title and sentence, no amounts); on iPhone, Firebase delivers it through Apple’s service | Per provider; may be processed outside the European Economic Area (section 8) |
| Sentry (Functional Software, Inc.) | Technical error logging | Not used in this version. If it were enabled in the future we will say so here beforehand, and it would only receive technical data without personal information | — |
| Apple and Google (app stores and system services) | Distribute the mobile app; the system’s speech recognition if you use the chat microphone | Each store’s own data; if you dictate, the audio is handled by your phone’s system (Edrex does not receive it) | Per provider |
We may add or change providers; if it significantly affects your data we will update this page (section 15).
8. International transfers
Your account and financial data are hosted in the European Union, and AI processing is done in the European Union multi-region. Some providers (Cloudflare, Resend, and the parent companies of Supabase and Google) belong to groups headquartered in the United States, so access or transfers outside the European Economic Area could occur (for example for technical support or content delivery).
When that happens we rely on the safeguards in the GDPR: an adequacy decision (EU–US Data Privacy Framework, where the provider is certified) or the standard contractual clauses approved by the European Commission, together with supplementary measures. You can ask for a copy of those safeguards by writing to the address in section 1.
In addition, Bunix S.A.S. is established in Colombia, a country with no European Commission adequacy decision.
9. How long we keep your data
- Account and financial data: while you have the account.
- Edrex notifications (if you turn them on): your devices’ identifiers, while notifications are on and you are signed in on them; the history of notifications sent, 90 days.
- “Your habits” (if you turn it on): the detail of days and missions, 120 days; the counters, until you delete your progress or your account.
- Bank connection: the permission you give your bank lasts 90 days at most (your bank may set less); when it expires we stop reading your bank and you can renew it. When you remove the connection in the app (or delete your account) we revoke the access at Enable Banking. Transactions already imported are yours and stay in your account until you delete them or delete the account.
- When you delete your account (Settings → Delete my account, or per this page): we delete your profile, financial data, chat history, consents and AI usage log. It is immediate and irreversible: there is no recovery period.
- Backups: may keep data temporarily after deletion until overwritten (maximum 30 days). They are not used for any other purpose or restored except after a serious incident.
- Technical logs of providers (access, errors): without the content of your financial information, 30 days for general logs and 90 days for security logs.
- Support and rights requests: as long as needed to handle them and show compliance, and during the applicable legal limitation periods.
- If you do not sign in for a long time:
10. Your rights and how to exercise them
You have the right to:
- Access: know what data we process and get a copy.
- Rectification: correct inaccurate data.
- Erasure: have your data deleted.
- Restriction of processing in the cases provided by law.
- Object to processing based on legitimate interest.
- Portability: receive your data in a structured, commonly used format.
- Withdraw your consent (for example, the AI consent) at any time, without affecting what came before.
- Revoke access to your bank whenever you want: in Available money (“Remove” button) or in your bank’s app or website.
- Not be subject to automated decisions with legal effects (we do not make any).
How: from the app you can download your data (Settings → Download my data), delete your account (Settings → Delete my account), delete your chat history, and edit or delete any data you recorded. For anything else write to [email protected] from your account email. We will reply within one month at most (extendable by two more months for complexity, telling you). We may ask you to prove your identity. It is free, except for manifestly unfounded or excessive requests.
Complaints: if you believe we have not handled your data properly you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid) or with the supervisory authority of your country of residence. We would appreciate the chance to help you first.
11. How we protect your data
- Encryption in transit: all communication uses HTTPS/TLS.
- Encryption at rest: the database and its backups are encrypted by the provider.
- Per-person isolation: each account can only read and modify its own data (row-level security in the database).
- Passwords: never stored in plain text, only a hash made with a secure algorithm; nobody at Edrex can see them.
- Least privilege: the AI and transaction functions act with your session, not with an administrator key. Only account deletion uses an administrator key, and only to remove your user.
- Security headers on the web (content policy, HSTS) and no third-party tracking tools.
- Abuse limits and monitoring: per-person quotas, a spending cap and a usage log without content.
- Secrets (service keys) kept in the provider’s secrets manager, never in the app.
- Backups and an incident response procedure: if there were a breach posing a risk to your rights we would notify the supervisory authority within 72 hours and you without undue delay when it implies a high risk.
No measure removes all risk. You can help too: use a long, unique password, do not share it and sign out on other people’s devices.
12. Minors
Edrex is not aimed at people under 18 and we do not knowingly collect their data. If you are a parent or guardian and believe a minor has created an account, write to [email protected] and we will delete it.
14. If you live in Colombia
If you use Edrex from Colombia, Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015) also apply: you own your data and have the right to know, update, rectify and delete your information, to revoke the authorization and to file complaints with the Superintendence of Industry and Commerce (SIC). This policy is also our personal data processing policy.
15. Changes to this policy
We may update this policy (for example if providers, features or the law change). We will show the date and version at the top. If the change is significant, we will tell you inside the app before it applies and, where the law requires, ask for your consent again. Earlier versions are available on request.
16. Contact
For any privacy question: [email protected]. For general support: [email protected] or the support page.