Privacy Policy

1. Controller and scope of this Policy

1. The controller of personal data is FIZEN spółka z ograniczoną odpowiedzialnością (FIZEN), ul. Narutowicza 40/1, 90-135 Łódź, Poland, KRS 0000900414, REGON 388908954, VAT PL7252309077, registered by the Polish Financial Supervision Authority (KNF) as a provider of the account information service only (register no. AISP13/2022). Contact: [email protected]. Data Protection Officer: [email protected].
2. Sections 1 to 9 cover the fizen.com website (the Website) and contacting FIZEN. Section 10 covers the Fizen account, the Fizen MCP service and the account information service (AIS); sections 5 to 7 apply to them as well.
3. This Policy provides the information required by articles 13 and 14 of Regulation 2016/679 (GDPR). The Website Terms (fizen.com/terms-and-conditions) set out how the Website may be used.

2. Website: technical data and security

1. The Website is delivered by Cloudflare, Inc. as a processor acting for FIZEN. Each visit involves processing the IP address, browser and device information, the time of the visit and the page opened. They serve only to deliver the Website and protect it from attacks. The legal basis is FIZEN's legitimate interest (art. 6(1)(f) GDPR).
2. FIZEN keeps no server logs of its own for the Website. Cloudflare keeps this data for the short time needed for security and may process it in the United States under the European Commission decision of 10 July 2023 on the EU-US Data Privacy Framework.

3. Statistics and cookies on the Website

1. By default the Website uses only what is necessary: it remembers your cookie banner choice and language in your browser's storage.
2. Google Analytics 4 runs only on the Website and only if you accept it in the banner. The legal basis is your consent (art. 6(1)(a) GDPR and art. 399 of the Polish Electronic Communications Law). Without consent the tool does not load.
3. We collect visit statistics only: page views, approximate location (country and city derived from the IP address, which Google Analytics 4 does not store), device and browser type, and traffic source. Google Signals and ad personalisation are switched off; we collect no demographic data such as gender or age.
4. Statistics are processed by Google Ireland Limited as a processor; they may be transferred to Google LLC in the United States under the European Commission decision on the EU-US Data Privacy Framework. We keep them for 14 months.
5. You can withdraw consent at any time under Cookie settings at the bottom of the Website. Withdrawal does not affect the lawfulness of earlier processing. The Fizen account uses no analytics cookies (section 10).

4. Contact and correspondence

1. When you write to FIZEN (e.g. [email protected]), we process your email address, name, company name and the content of the message to reply and keep up the correspondence. The legal basis is FIZEN's legitimate interest (art. 6(1)(f) GDPR) and, where the message concerns entering into or performing a contract, also art. 6(1)(b) GDPR.
2. Correspondence with consumers about the contract or complaints is kept for 6 years, counted to the end of the calendar year in which that period ends (limitation of claims, art. 118 of the Polish Civil Code). Other correspondence is kept while it lasts and then for up to 3 years.
3. Email is handled by Google Workspace as a processor; Google may process data in the United States under the European Commission decision on the EU-US Data Privacy Framework.
4. We send marketing information only with your consent (art. 398 of the Polish Electronic Communications Law), which you can withdraw at any time.

5. Your rights

1. You have the right to access your data and get a copy, to have it rectified, erased, its processing restricted and to data portability, and, where we rely on legitimate interest, the right to object. You can withdraw consent at any time.
2. To exercise your rights, write to [email protected] or [email protected]. We reply without undue delay, within one month. Some data cannot be erased where the law requires us to keep it (e.g. the AIS history of events, section 10).
3. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

6. Where we keep the data

1. Fizen account data, bank account data and the history of events are kept only in the European Economic Area, in Google Cloud infrastructure provided by Operator Chmury Krajowej sp. z o.o.: the database in the europe-central2 region (Warsaw) and the backups in a Google Cloud multi-region location within the European Union.
2. The only case in which data from your bank accounts leaves the European Economic Area is delivering it to an AI assistant you choose, at your request (section 10). The assistant's provider may process it outside the European Economic Area, in particular in the United States. The email address we send sign-in links to is handled by Google Workspace, which may process it in the United States under the European Commission decision on the EU-US Data Privacy Framework. Google and Apple, when you sign in with their account, process your account data as separate controllers under their own privacy policies.
3. Website and correspondence data may be processed in the United States by our processors named in sections 2 to 4, under the European Commission decision on the EU-US Data Privacy Framework.

7. Security

1. We apply the technical and organisational measures required by the GDPR and ICT security rules (DORA): encrypted connections, tokens and codes stored only as hashes, data access limited to authorised staff, and every access recorded.

8. Links to other websites

1. The Website links to other services (e.g. LinkedIn, YouTube). Their owners process data under their own rules, which FIZEN does not control.

9. Changes to this Policy

1. We announce changes to this Policy on this page, and to Fizen account users also by email and in the account, under the Fizen MCP Terms.

10.1. What data we process and where it comes from

1. Account data: email address, name, profile picture and your account identifier at the sign-in provider. We receive them from Google or Apple when you sign in with their account, or from you when you sign in with a link sent by email. We do not verify your identity through a bank.
2. Security data: the public keys of your passkeys, the authenticator app (TOTP) secret, the phone number for backup SMS codes, hashes of recovery and one-time codes, and whether a browser is trusted. A passkey's private key never leaves your device.
3. Paid plan payment data: payment reference, amount, date received, the account number paid from, and the payer's name as the bank gives it. We receive them from the payment initiation service provider (Meest Transfer sp. z o.o.) and from the history of FIZEN's account the fee is paid to. If you want an invoice, also the data for it (for a business: tax number, name and address). We look up a business's name and address by its tax number in the VAT taxpayer register (Ministry of Finance) or in the REGON register (Statistics Poland).
4. Account data from your bank: accounts (number, name, currency, holder), balances and transaction history (dates, amounts, titles, payers and payees). We receive them from your bank on the basis of your consent to account information access (AIS consent), given in your bank for up to 180 days.
5. Operations from statements you add yourself: a file exported from online banking (XML camt.052 or camt.053). We read from it the operations of accounts linked in Fizen (dates, amounts, titles, payers and payees), mark them as from a statement, and delete the file itself right after reading it. Operations of accounts that are not linked are left out.
6. Company account data (company.fizen.com): company data from public registers (name, NIP, REGON, KRS number, address, accounts reported to the VAT taxpayer list, the representing body and manner of representation from KRS), data of the person signing the company up (name, position in the company or basis of authority, phone number), a statement on the beneficial owners (names, citizenship) and a statement whether any of these persons is a politically exposed person. Data of people invited to a company account: email address and role, and after they join, account data as above. We receive it from the person signing the company up, from the company account administrator who invites, and from registers (VAT taxpayer list, REGON, KRS).
7. People in a company account: name, email address, role (Owner, Administrator, Accounting, User), the company accounts given to a person with the User role, the role permission settings of the company, and when someone joined or was removed. We receive them from the person who joins and from the Owner or an Administrator of the company account.
8. Third parties' data: the transaction history contains payers' and payees' data (name, account number, title). We receive it from your bank with the history. We are its controller, process it only within the service for you and do not contact these people.
9. Data about AI assistants: which apps you connected, which accounts you shared with them, and when. Access tokens are stored only as hashes.
10. History of events: who did what in the Fizen account, when and from which IP address (sign-ins, consents, connections, reads by AI assistants with their request parameters).
11. Transaction history may indirectly reveal special categories of data (e.g. health or beliefs, from payee names). We do not analyse it for that and draw no such conclusions. Spending categories are assigned automatically only to show you summaries, with no legal effect on you.

10.2. Purposes and legal bases

1. Running the Fizen account and providing the account information service, including delivering information in the Fizen account and, at your request, to the AI assistants you choose through Fizen MCP, as well as handling a paid plan: performance of the contract (art. 6(1)(b) GDPR) and your explicit AIS consent under the Polish Payment Services Act.
2. Authorising an AI assistant in your Fizen account (the Authorise assistant screen) is your instruction to deliver data under the contract, not consent within the meaning of the GDPR: it tells us which assistant should receive information and from which accounts. You revoke it by disconnecting the assistant.
3. To assistants whose provider is neither the data controller in the European Economic Area nor holds an active EU-US Data Privacy Framework certification, we deliver only your own data, without counterparties' data. Transferring your data to such a provider relies on your explicit consent to a transfer to a third country (art. 49(1)(a) GDPR), which we ask for separately before authorisation, with a description of the risks. You can withdraw it by disconnecting the assistant. This does not apply to assistants running on your device (e.g. Claude Code) that connect to Fizen MCP from that device: the data then reaches your device, as in your Fizen account, and the software you chose passes it on.
4. Third parties' data from the transaction history (payers and payees) is processed and delivered to the assistant you choose on the basis of legitimate interest (art. 6(1)(f) GDPR): providing the service you ask for. We have documented the assessment of this interest. These people may object. We do not inform them individually, as that would involve a disproportionate effort (art. 14(5)(b) GDPR); this Policy is therefore publicly available.
5. Paid plan payment data and invoice data are also kept to meet tax and accounting duties, including issuing invoices in the National e-Invoicing System (KSeF): legal obligation (art. 6(1)(c) GDPR).
6. The name and address of the holder of each linked account, as the bank gives them, with the bank and the last digits of the account number, is also processed to identify and verify you as a customer under the Polish anti-money laundering and counter-terrorist financing act. We compare it with your Fizen account data, and a FIZEN employee looks into a mismatch (e.g. another person's or a business's account). Legal basis: legal obligation (art. 6(1)(c) GDPR). We keep this data apart from the name you use in your Fizen account.
7. We process company sign-up data, beneficial owner data and the politically exposed person statement to conclude and perform the contract with the company (Art. 6(1)(b) GDPR) and to meet our duties as an obliged institution under the Polish anti-money laundering act: identifying the client, the person acting on its behalf and the beneficial owner (Art. 6(1)(c) GDPR). We compare the holder of every account linked to a company account with the company name and hold back an account of another holder until it is looked into. We process the email address of a person invited to a company account to send the invitation, in the legitimate interest of the company and FIZEN (Art. 6(1)(f) GDPR).
8. We process the data of people in a company account who are not a party to the contract with FIZEN (the company's employees and associates) in the legitimate interest of the company and FIZEN: to run the company account, give access to the company data according to roles and keep it secure (Art. 6(1)(f) GDPR).
9. Legal duties of a payment service provider, including ICT security (DORA, Regulation 2022/2554 and Delegated Regulation 2024/1774), complaints and cooperation with the KNF: legal obligation (art. 6(1)(c) GDPR).
10. Security of the Fizen account and our systems, showing what you agreed to (art. 18 of the Polish Payment Services Act), and establishing and defending claims: FIZEN's legitimate interest (art. 6(1)(f) GDPR).
11. We process account data only to provide the service you ask for and for the purposes in § 6(5) of the AIS Terms. We do not use it for marketing, profiling or credit scoring, and we do not sell it.
12. We make no decisions about you based solely on automated processing that have legal effects.

10.3. Who receives the data

1. The AI assistants you connect (e.g. Claude, ChatGPT), at your request and only from the accounts you share with them. The assistant's provider is a separate controller and may process the data outside the European Economic Area, in particular in the United States, under its own privacy policy. The data is passed on because you ask for it by using the assistant you chose, and this is the only case in which data from your bank accounts leaves the European Economic Area. The assistants we name on the website have a provider that is the data controller in the European Economic Area (e.g. Anthropic Ireland for Claude, OpenAI Ireland for ChatGPT) or holds an active EU-US Data Privacy Framework certification (European Commission decision of 10 July 2023; list: dataprivacyframework.gov). Assistants running on your device (e.g. Claude Code) receive the data on that device, as your Fizen account does, and the software you chose passes it on. Other assistants receive only your own data, without counterparties' data, on the basis of your explicit consent (art. 49(1)(a) GDPR).
2. Your bank, which provides account data on the basis of the AIS consent.
3. The company whose account you are in: other people in the company account see your name, email address and role, and the Owner and Administrators also see your history of events (sign-ins, reads by AI assistants with their query parameters) and the AI assistants you connected, which they can disconnect.
4. Processors acting on our behalf under data processing agreements: Operator Chmury Krajowej sp. z o.o. (Google Cloud infrastructure: hosting and database in the europe-central2 region, Warsaw), Google Workspace (sending sign-in link emails), LINK Mobility Poland sp. z o.o., operator of SMSAPI (sending backup SMS codes).
5. Google and Apple as sign-in providers: when you choose to sign in with their account, they pass your account data to us, as separate controllers.
6. The National e-Invoicing System (KSeF, Ministry of Finance), when we issue an invoice to a business (with a tax number) or its correction.
7. Meest Transfer sp. z o.o. (a national payment institution, KNF register IP56/2023), when you pay for a paid plan with a transfer initiated in your Fizen account. Meest Transfer is a separate controller of the payment data it processes when initiating the transfer; its privacy policy describes how.
8. Public authorities, including the KNF and courts, where the law requires it.

10.4. How long we keep the data

1. The Fizen account, linked accounts, consents and AI assistant access: until the Fizen account is deleted.
2. Account history: it covers the history the bank made available, added to on later reads, also after a consent is renewed, and the operations from statements you add. It stays after you remove a bank until you delete it (Banks and consents: Delete history) or delete the Fizen account (§ 13(3) and (4) of the AIS Terms as of 13 December 2026). Until you accept that version we delete it at once when the bank is removed, and when it has not been refreshed for 30 days. How much history you see depends on your plan.
3. History of events: 5 years (§ 14 of the AIS Terms). AI assistant request parameters (e.g. search phrases) are deleted after 90 days. IP addresses older than 2 years are cut to the network address. After the Fizen account is deleted, the history remains without your email address.
4. Database backups: data deleted from the database may remain in them for at most 14 days, after which they are overwritten. They serve only to restore the system after a failure.
5. System logs: 30 days, unless handling an incident or the law requires longer (§ 15 of the AIS Terms).
6. SMS codes: 5 minutes. Sign-in links: 15 minutes. Phone number, passkey public keys and the authenticator app secret: until that verification method or the Fizen account is removed.
7. Account holder identification data (anti-money laundering): 5 years from the end of the year in which our relationship with you ended, also after the Fizen account is deleted (art. 49 of the Polish anti-money laundering act).
8. Identification data of the company, the person acting on its behalf and the beneficial owners (anti-money laundering): 5 years from the end of the year in which the relationship with the company ended. An invitation to a company account (email, role): until the company account is deleted.
9. Data of a person in a company account (role, accounts given): until they are removed from the company account or the company account is deleted; entries about their actions in the history of events like other history entries.
10. Paid plan payment data: 5 years from the end of the calendar year in which the tax payment deadline passed (tax law).

10.5. How we pass data to AI assistants

1. An assistant receives data only once you choose it and authorise it when you connect it (the Authorise assistant screen), and only from the accounts you choose there. You revoke the instruction by disconnecting the assistant in your Fizen account (AI apps). It takes effect at once but does not delete data the assistant has already received: you delete that with its provider, following its instructions.
2. An assistant whose provider is neither the data controller in the European Economic Area nor holds an active EU-US Data Privacy Framework certification receives only your own data: accounts, balances, amounts, dates and categories, without counterparty names, their account numbers or titles. Before you authorise it, we ask for your explicit consent to a transfer to a country without EU-level protection and describe the risks. This does not apply to assistants running on your device (e.g. Claude Code) that connect to Fizen MCP from that device: the data then reaches your device, as in your Fizen account, and the software you chose passes it on.
3. When you authorise an assistant, we recommend switching off training on your conversations at its provider; we link to those settings.
4. We do not send data to an assistant on our own. When you ask the assistant something, its provider's servers, or your device when the assistant runs on it, call a tool at mcp.fizen.com over an encrypted connection (HTTPS/TLS), with an access token issued after you authorise the assistant. The token works only for that app and only for the accounts you shared with it, is valid for 1 hour and keeps being renewed as long as the assistant uses it at least once every 30 days. We keep it only as a hash. Disconnecting the app in your Fizen account revokes it at once.
5. We answer only the call made (e.g. transactions from a chosen period) and only from the shared accounts. An assistant named on the website or running on your device receives: bank, account name, the account number masked to its last 4 digits, currency, the holder's name, the balance with the time it was fetched, and for transactions: date, amount, counterparty name, the counterparty's account number masked to its last 4 digits, title and category. Other assistants receive this scope without the counterparty name, the counterparty's account number and the title.
6. We never pass to an assistant: full account numbers, online banking logins, passwords or codes (we do not know them), our tokens, or other users' data.
7. We do not anonymise the data. We mask account numbers, but the holder's details, and for assistants named on the website or running on your device also counterparty names and transfer titles, are passed as received from the bank, because without them the assistant cannot answer questions about your finances. We remove invisible characters from titles and names and limit their length. If you do not want an assistant to see an account, do not share it with that assistant.
8. We do not see your conversation with the assistant. We see and record only the calls to Fizen MCP tools: which tool, when, through which app, with which parameters (e.g. a search phrase) and how many items we returned. Parameters are deleted after 90 days; the fact of the call stays in the history of events for 5 years. You see the last 500 calls in your Fizen account (Activity). The number of calls per day, without their content, is kept for 400 days for plan billing.
9. On the assistant's side the data becomes part of your conversation. The assistant's provider keeps it under its own terms and your settings, including any use of conversations to train models, and may process it outside the European Economic Area, in particular in the United States. We have no influence on this; check the privacy settings with your provider.

10.6. Your rights, cookies and security

1. You have the rights described in section 5. You can withdraw the AIS consent at any time in your Fizen account, in your bank or by writing to [email protected]. Withdrawal does not affect the lawfulness of earlier processing.
2. Providing data is voluntary, but without account data and the AIS consent we cannot provide the service.
3. The Fizen account (dashboard.fizen.com) uses only necessary cookies: session (up to 30 days), trusted browser (30 days, when you choose it) and language. The Fizen account uses no advertising or analytics cookies; Google Analytics runs only on the fizen.com website and only with your consent (section 3).
4. Connections are encrypted (TLS). Tokens, codes and links are stored only as hashes. We never know your online banking logins or passwords. Only authorised staff can access the data, and every access is recorded: in your Fizen account in the history of events, and access to the database in Google Cloud audit logs.