Privacy Policy

1.Introduction and scope

Plata is a financial workspace built and operated by Buena Agency, Inc., a company incorporated in the United States, for its own books and for the people who help keep them. It connects to bank and card accounts, records and categorizes transactions, tracks cash flow and profit and loss for personal, business, and nonprofit workspaces, and issues invoices to clients. It is not a public service: users sign in by invitation to one workspace, and clients reach their own invoices through a private link.

This policy applies to information processed through the application at plata.buena.org, the client portal it serves, and the emails it sends. It covers three groups of people:

• Users: the people invited to sign in to Plata and work in a workspace.
• Clients: the businesses and individuals Buena invoices, and the people at those clients who receive invoices or open the client portal.
• Counterparties: merchants, vendors, payees, and team members whose names appear in transaction records that Plata imports from financial institutions.

Plaid, Ramp, Stripe, and the other providers named in this policy each publish their own privacy notice covering the part of the process they perform. Where this policy links to one of those notices, that notice governs the provider’s handling of your information.

2.Definitions

The following terms have the meanings given here wherever they appear in this policy.

Personal information

Any information that identifies, relates to, or could reasonably be linked with a particular person or household, such as a name, an email address, or a transaction record that names a person.

Financial account data

Information obtained from a financial institution about an account and its activity: account names and types, the last four digits of account numbers, balances, and transactions.

Workspace

A set of books within Plata (personal, business, or nonprofit) with its own accounts, transactions, clients, and members. Every record in Plata belongs to exactly one workspace.

Operator

Buena Agency, Inc., which owns every workspace, decides what information Plata processes and why, and is the controller of that information.

Service provider

A company that processes information on Buena’s behalf and under its instructions to provide part of the service, such as hosting, payment processing, or email delivery.

Client portal

The private page, reached by a unique link, where a client views and pays the invoices Buena has sent them.

3.Information we collect

Plata collects only the information needed to keep accurate books and to invoice clients. This section lists each category, where it comes from, and what it contains.

3.1Financial account data, through Plaid

When a user connects a bank or card account, Plaid provides the account’s name and type, the last four digits of its number, its balances, and its transactions (date, merchant, description, amount, and Plaid’s own category). Plata never sees or stores online-banking credentials: the user enters them in Plaid’s own flow, and Plaid returns an access token that Plata stores encrypted so it can refresh transactions. Plata does not request full account numbers, routing numbers, or identity documents. Plaid’s handling of your data is governed by the Plaid End User Privacy Policy.

3.2Card and bill data, through Ramp

With a Ramp API connection, Plata reads the business’s cards (name, last four digits, cardholder, spending limit), card transactions, and, when the additional scope has been granted, bills paid through Ramp Bill Pay (vendor, amount, date, invoice number). Ramp API credentials are stored encrypted and are readable only by the server.

3.3Statement imports and receipts

Users may import bank or card statements as CSV files. Each row becomes a transaction record like any other. Receipt images a user attaches to a transaction are stored in a private storage bucket that only members of that workspace can read.

3.4Information about users

A user’s email address, display name, and a password hash, held by Supabase Auth; the workspace they belong to and their role in it; the invitation that admitted them and when it was accepted; and an audit trail of significant actions (connecting or disconnecting an account, moving records between workspaces, inviting or removing members, and changes to billing) recorded with the acting user and a timestamp. Team members may also be recorded with a photograph and pay details so that payroll transactions can be attributed to them.

3.5Information about clients

For invoicing, Plata stores a client’s company or personal name, billing address, billing and contact email addresses, phone number, the invoices issued and their line items, the payments received, reminder emails sent, and when an invoice was opened in the client portal.

3.6Payment information, through Stripe

When a client pays an invoice by bank transfer, Stripe collects and holds the bank account details. Plata receives only the payment’s status, its amount, and a Stripe customer reference. It never receives or stores the client’s account or routing number. Stripe’s privacy policy applies to that step. Clients who pay by other means are matched to their invoice by the invoice number they place in the payment memo.

3.7Technical information

Like any web application, Plata’s servers receive the network address, browser type, and requested page for each request. The application uses the network address only to limit the rate of requests to the sign-in, portal, and API routes, holding it in memory for the duration of that window. Server logs record events with a short message and never contain request bodies, credentials, or financial data. Vercel and Supabase keep their own infrastructure logs under their own retention schedules.

3.8What Plata does not collect

Plata has no analytics or advertising trackers, no third-party cookies, no pixels, no session recording, and no fingerprinting. It does not collect location, contacts, calendar, or device identifiers. It does not collect Social Security numbers, tax identification numbers, government identity documents, or credit scores. It sets only the cookies described in section 8.

4.How we use information

We use the information described above for the following purposes and no others:

• Bookkeeping. To show balances, transactions, spending, cash flow, net worth, and profit and loss for each workspace, and to keep an accurate financial history.
• Categorization and reconciliation. To categorize transactions, match transfers and card payments, detect recurring charges, attribute pay to team members, and flag items for review.
• Invoicing and collections. To create, send, and collect invoices, including billable expenses, late fees, and reminders, and to match incoming payments to open invoices.
• Forecasting. To build plans and projections from the workspace’s own history.
• Access and accountability. To authenticate users, enforce workspace membership and roles, and keep the audit trail that lets the operator see who changed what.
• Security and integrity. To detect and prevent abuse, enforce rate limits, verify webhooks from providers, and investigate incidents.
• Legal compliance. To keep the financial records the law requires and to respond to lawful requests.

We do not sell personal information, share it with advertisers or data brokers, use it for behavioral advertising, or use it to build profiles of anyone. We do not make automated decisions about people that have legal or similarly significant effects.

5.Legal bases for processing

Where data protection law requires a legal basis for processing, including for people in the European Economic Area, the United Kingdom, and Switzerland, Buena relies on the following:

• Performance of a contract. Processing a client’s billing details to issue and collect an invoice, and a user’s account details to provide them access to their workspace.
• Legitimate interests. Keeping accurate books, securing the application, keeping an audit trail, and detecting fraud or abuse. These interests are balanced against the rights of the people concerned; the data involved is limited to what those purposes need.
• Legal obligation. Retaining financial and tax records for the periods the law requires, and responding to lawful requests from authorities.
• Consent. Connecting a financial account through Plaid or Ramp, which a user initiates and can withdraw at any time by disconnecting the account. The optional AI categorization pass runs only when a user chooses to run it.

6.Service providers and disclosures

Buena engages the following service providers to operate Plata. Each processes information only as needed to perform its service, under a written agreement with Buena, and is not permitted to use it for its own purposes.

Supabase

Database, authentication, and file storage, hosted in the AWS us-west-2 region (Oregon, United States). Holds every record Plata stores.

Vercel

Hosts the application and runs its server functions and scheduled jobs. Processes every request to plata.buena.org.

Plaid

Connects bank and card accounts and supplies financial account data. Receives the credentials you enter in its own flow; Plata does not.

Ramp

Supplies card, transaction, and bill-payment data for the business workspace through its API.

Stripe

Processes client bank-transfer payments. Holds the client’s bank details; Plata receives the payment status only.

Resend

Delivers invoice, reminder, and account emails. An email carries the recipient’s address, the invoice lines, and the amounts due. It never carries bank account or routing numbers, which appear only on the client’s private invoice page.

Anthropic

Provides the optional AI categorization described in section 7. Receives a minimal set of transaction fields, only when a user runs the pass.

Fontshare and Fuego

Serve the typeface and the design system stylesheet the application is drawn with. A request for those files carries the same technical information as any web request and nothing else.

Beyond these providers, Buena discloses personal information only in the following circumstances:

• Legal requirements. Where required by law, regulation, legal process, or a governmental request, or where disclosure is necessary to protect the rights, property, or safety of Buena, its clients, or others.
• Professional advisers. To Buena’s accountants, auditors, and legal counsel, who are bound by professional duties of confidentiality, to the extent needed for their work.
• Business changes. If Buena is involved in a merger, acquisition, or sale of assets, the information may be transferred as part of that transaction, subject to this policy.
• With your direction. Where you ask us to share information with a third party, such as your own accountant.

7.AI-assisted categorization

Plata offers an optional categorization pass that asks a language model, provided by Anthropic, to suggest a category for transactions a user selects. The pass runs only when a user starts it; nothing is sent automatically.

• What is sent: for each selected transaction, the merchant name, the bank’s description, the amount, the date, and the current category.
• What is never sent: account numbers, balances, the names of people, client details, receipts, or anything from another workspace.
• What comes back: a suggested category per transaction, which the user reviews and can accept or discard. No suggestion is applied without that review.
• Training: Anthropic’s commercial API terms provide that data submitted through the API is not used to train its models.

The same limits apply to the forecast assistant, which receives aggregate figures (clients, team, recurring costs, and monthly totals) and returns a proposed plan for the user to review before anything is saved.

8.Cookies and local storage

Plata uses a small number of strictly necessary cookies and no others. None is used for tracking, advertising, or analytics, and none is shared with a third party.

Session cookies

Set by Supabase Auth when a user signs in, so that subsequent requests are recognised as theirs. Marked Secure and SameSite=Lax. Cleared on sign-out.

plata-workspace

Remembers which workspace a user last opened. HttpOnly, Secure, SameSite=Lax.

plata-theme

Remembers whether the user chose the light or dark appearance.

The application also registers a service worker in supporting browsers so that it opens quickly and shows an offline page when there is no connection. The service worker caches the application’s static files and the pages you have viewed on your own device; that cache is cleared when the sign-in page loads and can be cleared at any time from your browser’s settings. Because Plata does not track, browser signals such as Do Not Track and Global Privacy Control have nothing to change, and the application behaves the same whether or not they are set.

9.How we protect information

Buena maintains technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, and loss. They are described in detail, control by control, in Plata’s security documentation and summarised here.

• Transport. Every connection uses HTTPS with HTTP Strict Transport Security. The application sets a Content Security Policy with a per-request nonce and refuses to be embedded in other sites.
• Encryption. Plaid access tokens and Ramp API credentials are encrypted at the application layer with AES-256-GCM under a key held only in the server environment, then stored in tables no browser session can read. Encryption keys are versioned so that they can be rotated. Supabase also encrypts every disk at rest.
• Isolation. Every table is protected by row-level security. A signed-in user reads only the workspaces they belong to; only finance roles can change financial records; the client portal is served by a scoped server-side client that shows one client their own invoices only.
• Access. Sign-in is by invitation only. An invited person sees the one workspace they were invited to and nothing else, and every other address is refused even with a valid password. Invitations expire after fourteen days. Passwords are at least twelve characters and are stored only as hashes.
• Portal links. Client portal links are long random tokens, stored in a column that browser sessions cannot read, which the operator can retire and reissue at any time.
• Provider integrity. Webhooks from Plaid and Stripe are verified by signature before anything is processed, and a replayed webhook is refused. Scheduled jobs require a secret only the scheduler holds.
• Least exposure. Secrets never appear in the browser bundle or in logs. Error messages shown to users are fixed sentences that never echo provider or database output. Exported spreadsheets are neutralised against formula injection.
• Review. The application and its database are audited against these controls, and dependencies are checked for known vulnerabilities as part of every release.

No system is perfectly secure. If you believe your account or a portal link has been compromised, write to hola@buena.org immediately and we will retire the affected credentials.

10.Data retention

We keep personal information for as long as it is needed for the purposes described in this policy, and then delete it. Books need history, so financial records are kept longer than operational ones.

Transactions and balances

Kept for as long as the workspace exists. Disconnecting an account stops new data and revokes Plata’s access at the institution; the history already imported stays in the books until a user deletes it.

Invoices and payments

Kept for as long as Buena must retain financial and tax records under applicable law, which is generally seven years from the end of the tax year concerned.

Client contact details

Kept while the client relationship is active and for as long as the invoices that name them are retained.

Receipts

Kept with the transaction they are attached to, and deleted with it.

User accounts

Kept while the person is a member of a workspace. When a member is removed, their sign-in is disabled; their name remains on audit entries recording actions they took.

Audit trail

Entries recording a person’s action are kept with the workspace. Entries generated by automated syncs are deleted after 400 days.

Connection logs

Records of a Plaid Link session are deleted seven days after it finishes; connection event logs are deleted after 400 days.

Provider credentials

Deleted at the provider and in Plata the moment an account is disconnected.

A daily retention job enforces the shorter periods automatically. Backups kept by Supabase age out under its own schedule.

11.International transfers

Buena is based in the United States, and Plata’s data is stored and processed there. If you are a client or user outside the United States, your information is transferred to and processed in the United States, where data protection laws may differ from those in your country. Where the law of your country requires a lawful transfer mechanism, Buena relies on the standard contractual clauses approved by the relevant authority, as incorporated in its agreements with its service providers, or on your consent where you have connected an account or requested a service that necessarily involves the transfer.

12.Your rights and choices

Whether you are a user, a client, or a counterparty named in a record, you may ask Buena to:

• Access the personal information we hold about you and receive a copy of it in a portable, machine-readable format.
• Correct information that is inaccurate or incomplete.
• Delete your information, except where the law requires us to keep it or where it is needed to complete a transaction you requested.
• Restrict or object to processing based on legitimate interests, where your situation gives you grounds to do so.
• Withdraw consent where processing is based on consent, without affecting processing that took place before withdrawal.
• Retire a portal link so that an invoice page can no longer be opened by anyone who holds the old link.

12.1How to exercise these rights

Write to hola@buena.org with the subject line “Privacy request” and tell us what you would like us to do. We will confirm receipt, may ask you to verify your identity in a way proportionate to the request (for example, by replying from the email address we hold for you), and will respond within thirty days. Where the law allows a longer period for a complex request, we will tell you why and when to expect an answer. You may authorise someone to make a request on your behalf, in which case we will ask for proof of that authority. We will not treat you differently for exercising any of these rights.

12.2Residents of the European Economic Area, the United Kingdom, and Switzerland

You have the rights listed above under the General Data Protection Regulation and its UK and Swiss equivalents, and the right to lodge a complaint with your national supervisory authority. Buena, as controller, will cooperate with any such inquiry.

12.3Residents of California and other U.S. states

Buena does not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and has not done so in the preceding twelve months. The categories of personal information collected, the sources, the purposes, and the recipients are set out in sections 3, 4, and 6. You may request access to, deletion of, or correction of your information, and may not be discriminated against for doing so. Financial account data obtained through Plaid is provided under the Gramm-Leach-Bliley Act and is handled in accordance with it.

13.Connections you control

Some of the most important controls are in your own hands and take effect immediately, without a request to us.

• Disconnecting an account. A user can disconnect any bank or card account from the Accounts page. Plata revokes its access token at Plaid or Ramp and deletes the credential; no further data is read from that account.
• Plaid Portal. Plaid offers its own portal at my.plaid.com, where you can see every application connected to your accounts through Plaid, including Plata, and revoke access there.
• Deleting records. Users with a finance role can delete imported transactions, receipts, and client records from within the application, subject to the retention obligations in section 10.
• Email. Plata sends transactional email only (invoices, reminders, account messages). There is no marketing list to unsubscribe from. A client who no longer wishes to receive invoice reminders by email can ask their contact at Buena to switch reminders off for their account.

14.Children

Plata is a business tool intended for adults. It is not directed to children, and Buena does not knowingly collect personal information from anyone under the age of eighteen. If you believe a child has been given access to Plata or that we hold a child’s information, write to hola@buena.org and we will remove it.

15.Third-party sites and services

Plata links to the websites and services of Plaid, Stripe, and the financial institutions you connect. Those sites are operated independently, have their own privacy policies, and are not covered by this one. A link from Plata is not an endorsement, and Buena is not responsible for the practices of sites it does not operate. We encourage you to read the privacy notice of any site that asks for your information.

16.Security incidents

If Buena becomes aware of a security incident that has resulted in unauthorized access to personal information it holds, it will investigate promptly, contain the incident, and notify the people affected and any authority that must be told, within the time the applicable law requires and in any case without undue delay. The notification will describe what happened, what information was involved, what has been done about it, and what the affected people can do to protect themselves.

17.Changes to this policy

We may update this policy to reflect changes in Plata, in the providers it uses, or in the law. When we do, the version number and the “last updated” date at the top of this page change. If a change materially affects how personal information is handled, users are told at sign-in and clients are told in the next invoice email before the change takes effect. Earlier versions are available on request.

Version 1.1 · September 12, 2026

Expanded with definitions, legal bases, cookies, retention periods, international transfers, regional rights, incident notification, and the controls users hold themselves.

Version 1.0 · September 7, 2026

First published.

18.How to contact us

Buena Agency, Inc. is the controller of the personal information described in this policy. Questions, requests, and complaints about this policy or about how your information is handled should be addressed to:

We will acknowledge every message and aim to resolve any concern directly. If you are not satisfied with our response, you may have the right to complain to a data protection authority in your country of residence.