Last updated: 24 July 2026 · Data controller: Pixby Media AB (org.nr 556825-4469), Stockholm, Sweden · hello@pixby.se
The hosted Saldo service stores your bank data encrypted with a key that belongs to you alone, used solely to answer your own questions — and never sold, shared, or used to train models. One exception, and we'd rather name it than bury it: to sort your spending into categories, the merchant text on a transaction — nothing else — goes to Anthropic, for your transactions alone. Deleting your data destroys that key first, so even backups become permanently unreadable. If you'd rather no server were involved at all, self-hosting keeps everything on your own machine and we process nothing about you.
Hosted service. When you link a bank, our service fetches your account names, balances, and transactions from the open-banking provider (Enable Banking) under your BankID consent, and stores them encrypted at rest — each user's data under their own encryption key — so your AI assistant gets answers without waiting on your bank. We also store the email you sign in with, your subscription status, the consent and connection records for the banks you link, and the tokens that let your chosen assistants query your data (stored only as hashes). A security log records events — sign-ins, syncs, tool calls by name — never amounts, merchants, account names, or what you ask your assistant.
Your conversations are not ours. What you and your assistant discuss stays between you and your assistant provider. Saldo sees only which read-only tool was called, and answers it.
Payments. Subscriptions are sold by Polar as merchant of record: your name, email, and payment details are processed by Polar under their privacy policy. We never see your card details.
Categorizing your spending. So your transactions arrive already sorted into groceries, transport and so on, the hosted service sends the merchant text of transactions it can't already place — the shop name a bank prints on a statement line — to Anthropic to work out what each one is. Nothing else goes with it: no amounts, no dates, no balances, no account details, and nothing identifying you. It happens only for your own transactions, never pooled with anyone else's, and the resulting rules are yours to see, edit or delete in the app. This is part of the hosted service and can't be turned off individually — if you'd rather no third party saw your merchants at all, self-hosting runs the same software with no server of ours involved.
Beta signups. If you request beta access, we store your email and use it only to invite you. Deleted on request.
This website sets no tracking cookies and runs no analytics. Self-hosters use no service of ours, and we process no data about them at all.
Hosted-service and payment data: performance of our contract with you (Art. 6(1)(b)). Beta emails: your consent (Art. 6(1)(a)), withdrawable at any time. The security log: our legitimate interest in keeping the service safe (Art. 6(1)(f)). Bank access itself is granted by your explicit consent at your bank, read-only — account-information consents only, never payment initiation.
Enable Banking (Helsinki, Finland) — the licensed open-banking provider that serves your bank data under your consent. Your bank — the source, under your BankID authorization. Railway — hosts the service and its database in the EU. Polar — merchant of record for subscriptions. Resend — delivers sign-in codes and invites (email addresses only, never financial data). Anthropic — categorizes transaction merchant text, as described above. We do not sell or share personal data, and we use no advertising or tracking.
Your financial data stays until you remove it: unlink a bank, reset your data, or erase your account — all self-service in the app, never blocked by subscription status. Deletion destroys your personal encryption key first, which makes your data unreadable everywhere at once, including in backups. Bank consents expire on your bank's schedule (typically ~180 days) and renew only with your authorization; you can also revoke at your bank directly. The security log is kept for 12 months, then purged.
Under the GDPR you can access, rectify, erase, restrict, and port the personal data we hold, and complain to a supervisory authority (in Sweden: IMY). Erasure is built into the app; for a copy of your data, email us and we'll provide an export.
Data-protection questions and requests: hello@pixby.se.