Version 1.1 · Last updated 3 August 2026
Zaisei ("Zaisei", "we", "us") is a personal net-worth application that lets you connect your bank and investment accounts, track your properties, and see your wealth in one place. This policy explains what data we handle, why, and your rights over it. It applies to the Zaisei mobile app and this website.
Data controller: NoesisBit — Borja Castellano-Extremadouro, a sole proprietor registered in Washington, USA (UBI 606240494). Registered address: 18006 28th St E, Lake Tapps, WA 98391-5707, USA. Contact: [email protected].
When you create an account we collect your email address and a password. Passwords are never stored in plain text — only a one-way hash (bcrypt) is kept.
To show your balances, transactions, investment holdings and recurring payments, you link your bank or brokerage through our aggregation partners Plaid, Tink and/or Powens. You enter your bank credentials directly into the provider's secure flow — Zaisei never sees or stores your bank username or password. We receive an access token that lets us request your data on your behalf.
Your balances, transactions, holdings and recurring payments are fetched live from the provider each time you use the app and relayed to your device. We do not keep a copy of this financial detail on our servers — only the access token needed to fetch it, and a cache on your own device (see §4).
If you add a property, we store the details you enter: address, estimated value and currency, purchase price, number of bedrooms/bathrooms, living area, and the geographic coordinates derived from the address.
If you buy a paid plan we store which plan it is, whether it is monthly or yearly, its status, when the current period ends, and the identifier the app store gives us for that subscription — enough to know what your account is entitled to and to restore your purchase on a new device. The payment itself happens entirely inside the Apple App Store or Google Play: we never receive your card number or any other payment details, and we hold no billing address or invoice of yours.
Our servers keep standard request logs (IP address, timestamp, request path, status, user agent) for security and debugging. We do not use any third-party analytics, advertising or tracking SDKs, and this website and the app set no cookies and use no cross-site trackers.
We do not sell your personal data, and we do not use it for advertising.
We use the following sub-processors and services. Only the data listed leaves our systems or your device to each one.
| Provider | Purpose | Data shared |
|---|---|---|
| Plaid | Bank/brokerage aggregation | Your bank credentials (entered into Plaid directly), access token, an internal account identifier |
| Tink (Visa) | Bank aggregation (Europe) | Bank credentials (entered into Tink directly), an internal user identifier, the consent identifier |
| Powens | Bank aggregation (EU) | Bank credentials (entered into Powens directly), connection token |
| Apple App Store, Google Play | Selling and renewing subscriptions | Handled by the store: your payment details never reach us. We receive the store's subscription identifier and its status |
| Finnhub | Market quotes & company logos | The ticker symbols in your holdings (not your identity) |
| Photon / Komoot | Address autocomplete & geocoding | The property address text you type |
| Zillow (via ZillAPI) | US property valuation | The property address (US only) |
| Frankfurter, Coinbase | Currency exchange rates | Currency codes only — no personal data |
| flagcdn.com | Currency flag images | Your device IP and the requested country code |
| Google (favicons) | Brand/institution icons | Your device IP and the queried domain name |
| CARTO / OpenStreetMap | Map tiles for the properties map | Your device IP and the map area of your properties |
Some images (flags, favicons, map tiles, institution logos) are loaded directly by the app from these hosts, so they receive your device's IP address. We may also disclose data where required by law.
We keep your data only as long as needed to provide the service. Full details — including how long each type of data lives and how it is disposed of — are in our Data Retention & Disposal Policy.
Depending on where you live (e.g. the EU/UK under GDPR, or California under CCPA/CPRA), you have rights to access, correct, export and delete your data, and to object to or restrict certain processing.
Zaisei is not directed to children and is intended for users aged 18 and over.
Our providers may process data in countries other than yours.
We may update this policy; we will revise the "Last updated" date and, for material changes, notify you in the app.
Questions or requests: [email protected].