Privacy Policy

Perfi is built for people in Singapore managing their own personal finances, and this policy is written with the Singapore Personal Data Protection Act (PDPA) in mind. It explains what data we collect, why, and how you can control it.

1. What we collect

• Account details — your email address and a bcrypt-hashed password. We never store your password in plain text.
• Statement data — the contents of the bank and brokerage statement PDFs you upload: transactions, balances, account metadata (such as bank name and masked card/account numbers), and trades.

2. What happens to your uploaded files

Uploaded PDF files are used only to extract the transaction and account data described above. Once a statement import is successfully confirmed, the source PDF is deleted from our servers. If an upload is abandoned before you confirm the import, we delete the file automatically within 24 hours. What remains after that is the structured data (transactions, balances, trades) you chose to import — not the original file.

3. How your data is processed

Statement parsing is deterministic and runs entirely on our own servers, using code written per bank layout. No AI models and no third-party services ever see the contents of your statements — parsing never leaves our infrastructure.

The only outbound calls Perfi makes are:

• Market price quotes (Yahoo Finance) — used to price your investment holdings. These requests contain only public ticker symbols, never anything personal to you.
• Transactional email (Resend) — used to send account-related email such as password resets. Resend receives only your email address, not your financial data.

4. Where data is stored

Your account and financial data are stored in a PostgreSQL database that we operate and control. We do not sell or share your data with advertisers or data brokers.

5. Cookies and sessions

Perfi sets a single cookie, perfi_session, used strictly to keep you signed in. We do not use tracking, advertising, or analytics cookies.

6. Deleting your data

You can delete your account and all associated data — statements, transactions, accounts, and trades — self-serve at any time from Settings. Deletion is permanent.

7. Contact

For questions about this policy or to exercise any data protection rights under the PDPA, contact us at sulaimanbins@gmail.com.