Privacy Policy

The short version

• We collect the information you give us and the financial data you choose to connect or import, and we use it to provide Maxint to you.
• We do not sell your personal information, share it for cross-context behavioral advertising, or use it to show you ads.
• Bank and card accounts connect read-only. Your banking credentials are normally exchanged for a secure access token; where a bank doesn’t support that, Maxint Link stores them encrypted only to keep your connection working.
• Your financial data, documents and Finsight conversations are not used to train public AI models.
• You can export your data, correct it, or ask us to delete it, and you may have further rights depending on where you live.

The rest of this policy explains the details. If anything is unclear, contact us at privacy@maxint.com.

1. Who we are and what this policy covers

Maxint Inc. ("Maxint", "we", "us" or "our") provides the Maxint app (maxint.com, the web app at app.maxint.com and the Maxint apps for iPhone, iPad, Android, Mac, Windows and Linux), Maxint Work (work.maxint.com), Orca (orca.maxint.com) and Maxint Link, together with our websites (together, the "Service"). This policy explains how we handle personal information when you use the Service or otherwise interact with us. Sections that apply to only one service say so.

For the personal information described in this policy, Maxint is the controller (or "business", under US state privacy laws). When a business customer uses Maxint to manage information about other people, we process that information on the business customer’s behalf and under its instructions, as its processor (or "service provider"). This includes the customers, vendors and employees a business manages in the Maxint app, such as names and email addresses on invoices; the content of a Maxint Work workspace; and the end users of apps that use Orca. In those cases the business customer’s privacy practices apply, our Data Processing Addendum governs our processing, and requests about that information should go to the business customer.

This policy does not cover third-party services you choose to use with Maxint, such as connection providers, AI providers you connect with your own credentials, or tools you authorize through the Model Context Protocol. Their own privacy policies apply.

2. Information we collect

Information you give us

• Account and profile information: your name, email address, organization name and type, business category, and preferences such as notification settings.
• People you invite: the name and email address of anyone you invite to your workspace, such as a partner, family member, accountant or employee, and the access you give them.
• Financial information you enter or import: accounts, balances, transactions, holdings, budgets, assets, inventory, invoices and other records you add manually or by file import.
• Documents: receipts, invoices and bank or brokerage statements you upload for text extraction (OCR) and processing.
• Finsight conversations: the questions you ask, the views and agents you create, and the instructions you give them.
• Voice input: if you use voice features, your microphone audio, which is converted to text to answer your request. We do not keep the audio after it has been converted, and we do not use it for profiling or advertising.
• Payment information: when you subscribe, payment is handled by our payment processors or by the app store you buy through. We receive confirmation of your subscription and limited billing details, but not your full payment card number.
• Communications: messages you send us, such as support requests and feedback, and your email address if you subscribe to our newsletter.

Information from accounts you connect (Maxint app)

When you connect a bank, brokerage, card or other financial account, you sign in with your banking credentials through a connection service: Maxint Link, or Stripe, Plaid or GoCardless, depending on the institution and your region. In most cases, your credentials are used only to establish the connection and are exchanged for a secure access token, and they are not stored. Some financial institutions do not issue tokens that keep a connection working over time. For those institutions only, Maxint Link stores your credentials, encrypted, so it can keep your connection working without asking you to sign in again. We use stored credentials only for that purpose, and we delete them when you disconnect the account or close your Maxint account. With your authorization, the connection then provides read-only account information such as account names and types, masked account numbers, balances, transactions and holdings. Connections are read-only, so we cannot move money from connected accounts. Stripe, Plaid and GoCardless are independent companies, and their own privacy policies apply to their handling of your information.

Information collected automatically

• Device and usage information: device type, operating system and app version, crash reports and performance data, and records of how features are used, which we use to keep the Service working and improve it.
• Log information: IP address, browser type, the pages or endpoints requested and the date and time, recorded by our servers and hosting provider for security and reliability.
• Browser storage on our website: our website stores your light or dark display preference and a flag that helps the web app load faster. These stay in your browser and are not used to track you. We do not use advertising cookies or third-party analytics on our website.
• Home screen widgets: if you add widgets on a mobile device, balance information is stored in an encrypted container on that device so the widget can display it.

Passkeys and biometrics

When you sign in with a passkey, any biometric check, such as Face ID, Touch ID or Windows Hello, happens on your device. We do not collect, receive or store biometric identifiers or biometric information. We store only the public key and credential identifier needed to verify your sign-in; your private key stays on your device.

Maxint Work

When you use Maxint Work, we collect your account and profile information and the settings your workspace’s administrators choose. The projects, tasks, documents, messages and files you and your colleagues add, and data from integrations such as GitHub, belong to the organization that controls the workspace; we process them on its behalf as described in section 1. If your organization runs Work on its own infrastructure, that content stays there, and we do not have access to it unless the organization gives us access.

Orca

When you create an Orca account as a developer, we collect your name, email address, organization and billing details, and technical information such as API keys, settings and IP addresses. Data about the end users of your apps, such as app user IDs you assign, purchase receipts, transaction and product IDs and general device information, is processed on your behalf as described in section 1. Orca does not collect end users’ full card numbers or banking credentials.

3. How we use information, and our legal bases

We use personal information for the following purposes. Where the law of the European Economic Area, the United Kingdom or Switzerland applies, we rely on the legal bases shown.

Where we rely on legitimate interests, we have balanced them against your rights and interests, and you can object as described in section 9. Providing account information is necessary to use the Service; connecting accounts and using optional features such as voice is your choice.

Finsight surfaces insights and suggestions, and agents act within the permissions you give them. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

4. Finsight and artificial intelligence

This section describes Finsight in the Maxint app. The AI features in Maxint Work use models provided through Groq under the same commitments: no training on your content, and limited provider retention as described below.

• No training of public models: your financial data, ledger entries, uploaded documents and Finsight conversations are not used to train, fine-tune or improve public or foundational AI models, by us or by the AI providers we use.
• AI providers we use: when Finsight uses models we provide, your requests are processed by model providers such as Google, Anthropic and Groq under agreements that prohibit them from using your requests to train their models. These providers may keep requests for a limited period, generally no more than 30 days, for reliability and to detect misuse, and longer only if a request is flagged as violating their usage policies.
• Providers you connect: if you connect your own AI provider with your own credentials, your requests go to that provider under its terms and privacy policy, not ours.
• Tools you authorize: if you authorize another AI tool to access your Maxint data through the Model Context Protocol, that tool receives the data you allow, under its own terms. You can revoke access at any time.

5. How we share information

We share personal information only as described here:

• Service providers, listed on our subprocessors page, that process information on our behalf and under contract, including cloud hosting and infrastructure (including Cloudflare), connection providers, AI model providers, payment processors and app stores, email delivery, and customer support tools. They may use the information only to provide services to us.
• People you invite to your workspace, who see the information you give them access to.
• Services you direct us to share with, such as an AI provider you connect or a tool you authorize through the Model Context Protocol.
• For legal reasons, when we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property or safety of Maxint, our users or others.
• In a business transaction, such as a merger, acquisition, financing or sale of assets, subject to this policy or one at least as protective.
• With your consent, or at your direction.

We may also share information that has been aggregated or de-identified so that it can no longer reasonably identify you, and we will not attempt to re-identify it.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and we have not done so in the past 12 months.

6. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Service. When you close your account or ask us to delete your data, we delete or de-identify it within a reasonable period, except where we must keep certain information to meet legal, tax or accounting obligations, resolve disputes, prevent fraud, or enforce our agreements. Deleted information may remain in encrypted backups for a limited time until they are overwritten. Newsletter subscriptions are kept until you unsubscribe.

7. How we protect information

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.3) and at rest (AES-256), passkey sign-in for users, restricted and monitored internal access, and independent auditing; Maxint is SOC 2 Type II verified. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the relevant authorities as required by law. More detail is on our Security page.

8. International transfers

Maxint is based in the United States. If you use the Service from outside the United States, your personal information is processed in the United States, and our service providers may process it in other countries where they operate. Data protection laws in these countries may differ from those where you live. We require our service providers to protect personal information consistently with this policy.

9. Your choices and rights

Everyone

• Export your data from the app at any time.
• Correct your profile and financial records in the app.
• Disconnect a connected account, remove people you invited, and revoke tools you authorized.
• Unsubscribe from the newsletter using the link in any issue. We will still send service messages about your account.
• Ask us to delete your account and data by contacting privacy@maxint.com.

European Economic Area, United Kingdom and Switzerland

You have the right to access your personal information, to rectify it, to have it erased, to restrict or object to its processing (including processing based on legitimate interests), and to data portability. Where we rely on your consent, you can withdraw it at any time without affecting processing that took place before. You also have the right to lodge a complaint with your local data protection authority.

United States

Depending on your state of residence, including California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws, you may have the right to know what personal information we collect, use and disclose; to access it and receive a portable copy; to correct it; to delete it; and to opt out of its sale, its sharing for cross-context behavioral advertising, targeted advertising and certain profiling. We do not sell or share personal information, or use it for targeted advertising or such profiling. We use sensitive personal information, such as financial account information and any stored banking credentials, only to provide the Service and for other purposes permitted by law, so the right to limit its use does not apply. We will not discriminate against you for exercising your rights. We treat Global Privacy Control signals as a valid opt-out of sale and sharing, although we do not sell or share personal information.

How to make a request

Email privacy@maxint.com with the subject line "Privacy request", or write to us at the address in section 14. We will verify your identity, usually by confirming control of the email address on your account, before acting on a request, and we will respond within the time the law requires. You may use an authorized agent to make a request on your behalf; we may ask for proof of the agent’s authority and verify your identity directly. If we decline your request, you may appeal by replying to our decision with the subject line "Privacy appeal", and we will respond within the time the law requires. If your appeal is denied, you may contact your state attorney general.

10. Information for California residents

In the past 12 months we have collected the following categories of personal information, from you, from your devices, and from the connection providers you authorize:

We use these categories for the purposes described in section 3 and keep them for the periods described in section 6. We do not sell or share any of them. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

11. Children

The Service is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it. An account holder who invites a family member under 18 to their workspace is responsible for that invitation and for the access they grant. If you believe a child has provided us with personal information, contact privacy@maxint.com.

12. Notice under the Gramm-Leach-Bliley Act (Maxint app)

To the extent Maxint is a financial institution under the federal Gramm-Leach-Bliley Act, this section and this policy serve as our privacy notice. We collect nonpublic personal information from you, such as your name, contact details and account information; from the financial accounts you connect, such as balances and transactions; and from your use of the Service. We disclose it to nonaffiliated third parties only as the law permits without giving you a right to opt out, such as to service providers working on our behalf, to provide services you request or authorize, and to comply with law. We do not disclose it to nonaffiliated third parties for their own marketing, and we have no affiliates with whom we share it. Because we limit sharing in these ways, there is nothing you need to opt out of. We protect this information with the safeguards described in section 7.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, we will notify you in advance by email or in the app.

14. Contact us

Questions or concerns about this policy or our privacy practices, and privacy requests, can be sent to:

Maxint Inc.
Attn: Privacy
1875 Mission St, Ste 103 #180
San Francisco, CA 94103
United States
privacy@maxint.com