Privacy Policy

Proa is operated by Rafael Cabrera, a natural person in Spain, under the public product name Proa. Privacy questions can be sent to privacy@getproa.app.

A professional postal address and any tax registration details are under legal review. Proa does not publish a residential address.

We process account profile data such as email, name, locale, authentication identifiers, and subscription state.

We process personal finance data you add to the app, including budget accounts, categories, transactions, notes, wallets, assets, allocations, regimes, and portfolio history.

For AI reports, Proa uses portfolio holdings, allocations, and market context. Proa does not need your name, email, password, or login details in report prompts.

If you enable Proa AI, Proa may process Assistant chat messages, assistant responses, selected data-source permissions, chat history settings, context sources, proposals, feedback, usage, and operational telemetry.

For Spain eligibility, Proa stores a minimal age band, jurisdiction, policy versions and acceptance times, eligibility and assurance status, revocation version, and—only for age 13—the status, purposes, timestamps and audit record of guardian authorization. Proa does not require a full date of birth, identity document, biometric or third-party age-verification provider for this launch model.

We use data to provide the app, secure your account, operate billing, generate reports, answer Assistant chats, prepare reviewable proposals, deliver transactional emails, handle support, prevent abuse, and comply with legal obligations.

We do not use Google Analytics, Google Tag Manager, advertising pixels, or advertising cookies at launch.

Proa AI is optional. In Settings, you can turn it on or off, choose whether it may read Budget, Investments, and Reports data, and decide whether recent chat history may be used for follow-up questions.

When Proa AI is enabled, Proa sends Assistant messages and relevant allowed financial context to OpenAI to generate responses or prepare proposals. API requests are sent with storage disabled where supported by OpenAI. This does not mean the data never leaves Proa.

AI Assistant messages and AI Reports are separate product features. Assistant messages support chat answers and reviewable proposals. AI Reports use a separate report-generation pipeline and quota.

The Proa MCP plugin is an optional connection to an eligible Proa account. The OpenAI host may request authorized workspace names and links, Budget accounts, categories, transactions and explicitly requested notes, recorded investment holdings and valuation provenance, retained Reports and schedules, and allowlisted stored Assistant artifacts. Tool results are personal financial records. Record references, versions, pagination cursors and as-of times support selection, consistency and provenance; authentication secrets and internal diagnostic payloads are not returned as financial context.

Auth0 and AWS Cognito support the connection's OAuth authentication. Proa stores authentication subject/client bindings, connection consent and revocation status, scope, connection and last-use times, operational rate counters, and minimal write audit/idempotency records. Each request rechecks eligibility, permissions, capability and workspace ownership. The single proa.user_access connection scope does not bypass those checks.

OpenAI receives selected tool results and the conversation in its host under its applicable terms and controls. Proa receives explicit tool arguments, not your entire host chat history. This differs from Proa's optional in-app Assistant and its separate data-source permissions. Connecting the plugin does not enable that Assistant. Auth0 operates the configured EU authentication tenant; this does not mean all data stays within Proa or the EU.

Adult record changes require a five-minute preview and separate first-party confirmation before an identical apply request. Creating transactions records lasting account financial history: account currency cannot change afterward, even if those transactions are deleted. Cancelling a preview does not change financial records. All calls still update operational access/rate controls.

Do not place passwords, one-time codes, card numbers, government identifiers, bank credentials, health information, API secrets, seed phrases or private keys in Proa fields or tool inputs. Proa checks some explicit restricted-data markers and rejects unsafe write previews; these limited checks cannot detect every sensitive value. Some read results redact detected text; retained Reports that fail safety checks are withheld.

Disconnect in Settings → Connected apps to block new tool access and revoke the connection. Disconnecting does not delete Proa records or copies already shared with the host. Use the host's own data controls for those copies, and Proa's authenticated privacy process for Proa exports or deletion.

Proa uses AWS for hosting, storage, Cognito authentication, databases, and logs; Auth0 for MCP OAuth authentication; Stripe for payments and billing; OpenAI for AI report generation, optional AI Assistant responses and selected MCP tool results requested by its host; Tavily for market research used in reports; Resend or AWS SES for transactional email; and Cloudflare for DNS, security, and email routing. The plugin does not execute public price or FX research for investment valuation.

Google Gemini may be used later only if OCR features launch. MailerLite and Anthropic/Claude are not active processors for the MVP.

MCP write previews and confirmation grants expire after five minutes. Minimal write-audit and idempotency records use a 180-day retention period. Operational plugin logs omit raw tool payloads and credentials and follow configured retention, currently 30 days in production and seven days in development. Short-lived rate counters expire within two days. Revoked connection barriers remain for 30 days to prevent stale-token reuse. Logical expiry blocks access before storage TTL deletion or controlled backup expiry completes.

Reports are kept for 90 days unless you delete them earlier. Assistant chat messages and runs are kept for the conversation retention period configured by Proa, currently 90 days by default, unless you delete the chat earlier.

Some related records, such as preferences, usage, feedback, security logs, billing metadata, backups, fraud prevention, tax, dispute, suppression, and legal records, may be retained when legally or operationally required.

You can download account profile data in Settings. Profile export includes Assistant records such as conversations, messages, preferences, runs, proposals, usage, and feedback. Full product exports for Budget, Investments, Reports, and billing records may still require a manual privacy request while Proa continues automating cross-module exports.

Deleting a chat removes that Assistant chat and related Assistant records from the active Assistant store. Account deletion is processed through an authenticated deletion request and may retain limited records where required.

Eligibility preflight and abuse-control records expire on short operational schedules. Guardian and eligibility grants expire or become inaccessible when revoked. Minimal revocation and audit records may be retained for the documented security and rights-handling periods so stale authorization cannot silently reactivate access.

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of personal data.

To make a request, email privacy@getproa.app from the email associated with your Proa account.

A guardian requesting access, export or deletion for an age-13 account must complete a purpose-bound representation check. Guardian status alone does not grant workspace access or automatic disclosure. Proa will minimize evidence and will not request identity documents by ordinary email.