Privacy Policy

The data controller for your personal information is Aduki Ventures S.A.S., RUT 220950830019, registered at Lazarillo de Tormes 31751/004, Punta Ballena, Maldonado, Uruguay ('Daiku', 'we', 'our', or 'us'). This Privacy Policy explains how we collect, use, and safeguard data when you use the Daiku personal finance platform available at daiku.app.

By using Daiku, you agree to the collection and use of information in accordance with this policy.

Account information. When you register, we collect your email address, name, and a hashed password. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.

Financial data. Daiku stores the financial records you enter: expenses, income, recurring transactions, portfolio holdings, and category budgets.

Usage data. We may collect anonymised information about how you interact with the application to improve the product. We do not sell this data.

Technical data. Standard server logs may include your IP address and browser type, used for security monitoring and failure diagnosis.

We use your information to: provide, operate, and improve the Daiku service; authenticate your identity; send transactional emails; generate your financial summaries and reports; and respond to support requests.

We do not use your financial data for advertising, profiling, or sale to third parties.

Your data is stored in a secured database with strict access controls. Access tokens are short-lived (60 minutes) and refresh tokens expire after 7 days.

All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text.

We use: Railway (backend hosting), Cloudflare (frontend hosting and CDN), Google OAuth (optional sign-in), and Resend (transactional email). Each provider operates under their own privacy policy.

If you connect Daiku to ChatGPT, we share information returned by the integration’s tools and financial dashboard with OpenAI for use in ChatGPT. Section 12 explains the information shared, permissions and your controls.

We retain your data while your account is active. If you delete your account, your data is permanently removed within 30 days, except where retention is required by law.

You have the right to: access your data; request correction of inaccurate data; request account deletion; and export your data in a portable format.

These rights are exercised under Uruguay's Personal Data Protection Act No. 18.331. If you believe your request was not properly handled, you may file a complaint with Uruguay's data protection authority (URCDP).

Daiku does not use tracking or advertising cookies. In the web application, the access token is kept in memory and the session is renewed using an HttpOnly cookie. We use localStorage to save browser preferences.

Daiku is not directed at children under 16. If you believe a minor has provided us with personal data, please contact us and we'll delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice.

Aduki Ventures S.A.S. — RUT 220950830019
Lazarillo de Tormes 31751/004, Punta Ballena, Maldonado, Uruguay

If you have questions about this Privacy Policy: hello@daiku.app.

Connection and authorization. The integration is optional: you connect your own account through OAuth, sign in on Daiku and review the requested permissions before authorizing. Do not give your Daiku password to ChatGPT. OAuth uses access and refresh credentials to act on your behalf. Financial permissions are finance:read (read data) and finance:write (make supported changes, including deleting records). If openid, email or profile are requested and authorized, your user identifier, email and verification status, name, profile picture and language may also be shared, depending on the permission.

Information we receive. Daiku receives tool calls and their arguments: household, account, portfolio or record identifiers; searches, dates, filters and currency; and values or descriptions needed for requested changes. It also receives the OAuth credentials used to validate the connection. Dashboard filters and a selected transaction can provide context to ChatGPT.

Information we return. Depending on the request and your permissions, tools may return household identifiers, names, roles and settings; accounts, including account numbers and holder names where recorded, institutions, currencies and balances; transactions, income, expenses, transfers, installments and recurring entries, including amounts, dates, categories, tags and descriptions; budgets; portfolios, assets, holdings, cash flows and value history, including notes and descriptions; projection scenarios, rules and results, and net worth and currency exposure reports. Responses may include owner or author identifiers, timestamps and action results or errors. The financial dashboard inside ChatGPT displays household, account, transaction, budget, portfolio and net worth information, as well as filters and language. Descriptions and notes you have entered in your records may contain personal information.

Purpose and limits. We use this exchange to answer your requests, display your financial information and carry out authorized actions. Access depends on OAuth permissions and your permissions in each household or portfolio, including shared ones. Selecting a default household does not limit authorization to that household. The integration can create, modify, archive or delete records through supported operations. Financial write operations require a confirmation indication in the tool call; certain operations, such as deletions, balance adjustments and bulk changes, also require a valid preview. These controls do not guarantee that ChatGPT will show a separate confirmation before every change. Saving or clearing the default household is a preference change and does not require financial write permission.

OpenAI and your data. Information returned through tools and the dashboard is shared with OpenAI for use in ChatGPT. Retention and possible use to improve or train models depend on your product, account type and settings. See OpenAI’s privacy policy and its information about connected apps and data controls in ChatGPT.

Disconnection and revocation. To stop future access through a connection, open ChatGPT settings, find Daiku among your connected apps or plugins and select Disconnect for the relevant account. See OpenAI’s connection management instructions. Daiku supports credential revocation through its OAuth service and checks credential validity on each operation. Disconnecting or revoking access does not delete your financial records in Daiku, undo completed changes or delete information already present in ChatGPT conversations. Manage that information separately through ChatGPT controls; for requests about your Daiku data, use the contact in this policy.

Integration storage and logs. Daiku stores OAuth authorization records and access and refresh credentials associated with the user, application, permissions and validity or revocation status. Credential expiry or revocation does not mean all connection records are deleted. If you choose a default household, we store it in your account; you can ask the integration to forget it without deleting financial data. Disconnecting does not automatically clear that preference. Financial changes are saved as Daiku records. The integration code logs failures with the operation name to diagnose problems, without including arguments or financial results in those messages. This does not describe all infrastructure logs or set a retention period for them. The session lifetimes in section 4 do not describe this integration’s OAuth credentials, and the commitment in section 6 does not set retention periods for information held by OpenAI.

Users on Daiku’s free plan can currently use this integration. This availability is not a promise about future pricing or terms.