Privacy, in plain English.

Who this policy covers

Ultrafinance is operated by Joe Hoyle. This policy covers the website and hosted API at ultrafinance.app. If you run the open-source code yourself, you control that installation and its data practices.

What we receive

When you submit a lookup, we receive the transaction description and any optional information you include, such as amount, currency, date, country, location, or extra context. The demo sends the fields you fill in when you press the lookup button.

We save the full lookup input, the merchant candidates considered, the matching method, any AI answer, and the final result or error, along with timestamps. The hosted API has no accounts and no public endpoint for browsing this lookup history.

Our hosting providers also handle connection information, such as your IP address and browser details, to deliver requests. Operational logs can include errors and technical information. If you email us, we receive your email address and whatever you choose to share.

Why we use it

We use lookup information to identify merchants and transaction locations, investigate errors, and check how matching works. We use technical information to operate and protect the service, and contact information to answer your requests.

We do not sell your personal information, use it for advertising, or publish your submitted transactions in the merchant catalog.

Who helps process a lookup

Amazon Web Services hosts the service and its database. When a lookup needs AI evaluation, we send the transaction fields you supplied, including extra context, and relevant merchant candidates to TypeSafe AI’s Jev service. When Jev is configured, transaction kind is classified for every valid lookup, including verified exact merchant matches and lookups with no merchant candidates. Local enrichment without Jev leaves transaction kind unknown.

If a business-discovery service is configured, unresolved lookups can send their description, country, supplied location and possible name interpretations to that service. This discovery request excludes amount, currency, date and extra context. Supported resolutions may be saved privately with their transaction context and business evidence to assist later lookups; a model result alone does not become a verified mapping.

TypeSafe’s privacy policy says it does not train or fine-tune models on submitted inputs. Its policy also explains its use of service providers and its handling of data. We do not promise that a provider immediately deletes a lookup after answering it.

Providers may process information outside your country, including in the United States, where privacy laws may differ. We may also disclose information when required by law or when necessary to investigate abuse or protect the service and people using it.

How long information stays

Saved lookup history currently has no automatic expiry. Unless a record is deleted, the full input and result remain in our database. This applies to demo lookups too.

Our application’s operational logs are configured to expire after 14 days. Database backups and provider records have separate retention rules; deleting a live record does not necessarily erase every backup or provider copy immediately.

We use HTTPS for the hosted website and API and restrict database access through hosting permissions. No online service can guarantee absolute security, so please send only the context needed for a lookup.

Your choices and requests

You can browse the site and merchant catalog without submitting a transaction. For lookups, use sample data or remove personal details first. Please do not send account or card numbers, passwords, full bank statements, or sensitive information about yourself or someone else.

Email contact@ultrafinance.app to ask about your information, request a copy or correction, request deletion, or raise a privacy concern. Include an approximate submission time and enough non-sensitive context to help us find the record. Please do not resend a full transaction or bank statement.

Because there are no accounts, we may need to confirm a record belongs to you before sharing or changing it. We will explain if we cannot identify it, or if a legal requirement prevents deletion. Your local law may give you additional rights, including the right to complain to a privacy regulator.

Cookies and other websites

The main website does not set cookies or use advertising trackers. We run Umami analytics on our own AWS infrastructure to count page views and understand referrers, approximate location, and browser and device types. The tracker excludes URL query strings and fragments and respects the browser’s Do Not Track signal when enabled. We do not send lookup form contents to Umami, and session recording is disabled. Analytics data is stored separately from merchant and lookup data. Merchant logos, when available, load directly from their image hosts, which may receive your IP address and browser details. Logo requests do not include the page URL as a referrer. The API documentation loads its interface from jsDelivr, which receives connection information when your browser downloads it. Links to GitHub, merchant websites, and other services take you to sites with their own privacy practices.

API usage metrics

We also record API endpoint names, response codes, request duration, generated request identifiers, and aggregate enrichment outcomes, such as matched or unresolved counts and batch sizes. AWS CloudWatch stores operational metrics, and our self-hosted Umami service receives aggregate enrichment events through an AWS queue. These analytics records do not include transaction descriptions, amounts, lookup bodies, merchant identities, URL query strings, or client IP addresses. This is separate from the saved lookup history described above.

If this policy changes

We will update this page and its date when our practices change. For a significant change, we will also put a notice on the website before it takes effect. If a new use of personal information requires your consent, we will ask for it.

Questions are welcome at contact@ultrafinance.app. You can also read our terms of use.