Personal Finance OS (“PFOS”) is a private, single-user, non-commercial personal-finance application. It is operated solely by the natural person who registers the related Enable Banking application (the “operator”). PFOS is not a public multi-tenant service and is not offered to third parties.
This notice describes how payment-account information obtained through Enable Banking account information services (AIS) is handled when the operator authorises access to their own accounts for use inside this local PFOS instance.
Access to payment accounts is granted through the bank’s Strong Customer Authentication (SCA) and consent screens operated with Enable Banking as an authorised account information service provider under applicable PSD2 arrangements. That bank-side consent is separate from this privacy notice.
This notice describes local processing of information after it has been retrieved into PFOS. PFOS is used as a private / household tool by the operator. This notice does not claim a specific GDPR legal-basis label beyond that private, single-operator context and the operator’s own control of the local system.
PFOS does not collect bank passwords. Bank login uses the bank’s own SCA flow.
There is no advertising, no sale of data, and no sharing with unrelated third parties for marketing. PFOS uses AIS (account information) only and does not initiate payments.
After retrieval, data are stored on the operator’s local machine (local PostgreSQL database used by PFOS), except while in transit during authorised API calls.
For live (non-sandbox) bank connections, PFOS stores AIS session credentials in a local token vault using application-level encryption when the operator has configured the required local encryption key. Without that key, PFOS refuses to store or decrypt live AIS credentials. Plaintext token markers are used only for the local sandbox mock provider, not for Enable Banking live connections.
Local financial records remain until the operator deletes or otherwise manages them on the local system. Optional local database backups may be created by the operator (for example via the documented local backup command); such backups, if made, are under the operator’s control and are not uploaded by PFOS to a public cloud service.
Revoking or disconnecting bank access ends further AIS retrieval and removes locally stored AIS session credentials for that connection. It does not automatically delete transaction history or other records that were previously imported or posted in PFOS.
Bank-side consents may also be reviewed or terminated through Enable Banking’s data-sharing consents interface, which likewise does not by itself erase local PFOS history.
There is no dedicated “download all my data” or “erase all personal data” button in the PFOS user interface. The operator, as sole user of this private instance, can:
state with short TTL and one-time use for bank authorisation callbacksNo claim is made of ISO certification, penetration-test guarantees, or public-cloud hardening beyond the above.
Material changes to this notice will be reflected at this URL. Contact: darcompany.official@gmail.com.