Privacy Policy — Rebus
Last updated: 12 October 2026
Controller: Deus Labs (“we”, “us”)
Contact: privacy@deuslabs.com
This Privacy Policy explains how Rebus (the web app and the mobile app, together the “Service”) processes personal data when you create an account and use personal-finance features. It is written for users in the European Economic Area and Sweden and is intended to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act.
This document is an engineering draft for product transparency, pending counsel review. It does not replace independent legal advice. If anything here conflicts with a later signed version we publish, the signed version prevails.
1. Who is responsible
Deus Labs is the data controller for personal data processed in Rebus when you use our hosted Service. You can contact us at privacy@deuslabs.com for privacy requests.
If you self-host Rebus on infrastructure you alone control, you are typically the controller for that deployment; this policy describes the product’s default hosted design.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Identity & account | Name, email address, profile image (if provided), email verification status | You; Google/Apple if you use social login |
| Authentication | Password hash (email/password), OAuth tokens/ids, session tokens | You / identity providers |
| Session metadata | IP address, user-agent, session expiry | Your device / our auth stack |
| Financial content | Accounts, balances, transactions (incl. descriptions/merchants/notes), budgets, categories, recurring rules, holdings, goals, net-worth snapshots | You; optionally your bank via Enable Banking |
| Bank connection metadata | Enable Banking session id, consent validity, institution labels | Enable Banking / your bank after you connect |
| AI assistant context | Chat prompts and tool results (e.g. spend aggregates, merchants) when Ask is enabled | You / derived from your data |
| Agent suggestions | Pending budget/categorization proposals stored until you accept or reject | Generated when Ask tools run, or by AI auto-categorization if you turn it on |
| Merchant category memory | Learned merchant→category mappings from your confirmed categorizations, and the pairs you turned down | Derived from your actions |
| AI preferences | Whether Ask and AI auto-categorization are on, and when you turned each on | You |
| AI usage log | One row per Ask question or AI auto-categorization run: the kind and the time, plus a one-way key used so a retried message isn't counted twice. Never the text of your question | Generated when you use Ask / AI features |
| Subscription (Rebus Plus) | Plan, status (trial, active, grace period, cancelled, expired), where it was bought (App Store, Google Play, web, or a manual/promotional grant), store product id, current period end, and when we last received an update | RevenueCat (from Apple / the store, or from our web checkout); us, for manual grants |
| Setup answers | What you said brings you to Rebus (used to order your Overview), and when you finished or skipped first-run setup | You |
| Push notifications | Device push token, notification preferences | Your device when you opt in |
| Support correspondence | Messages you send to privacy@deuslabs.com | You |
We do not receive or store your card or other payment details; App Store purchases are paid to Apple, and web purchases are paid through Stripe (see §5).
We do not sell personal data. We do not use advertising or cross-app tracking SDKs in the Service as shipped.
3. Purposes and lawful bases
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Create and secure your account; provide core budgeting, transactions, goals, and related features | Contract (Art. 6(1)(b)) — performance of the Service you request |
| Store session metadata (IP / user-agent) for security and abuse prevention | Legitimate interests (Art. 6(1)(f)) — securing the Service; you may object |
| Connect a bank via Enable Banking (AIS, read-only) and sync account/transaction data | Consent (Art. 6(1)(a)); AIS consent is also governed by PSD2 / bank SCA |
| Process financial context through the Ask assistant (Anthropic's Claude — directly, or via OpenRouter / the Vercel AI Gateway) | Consent (Art. 6(1)(a)) — off until you turn on Ask (Rebus asks first and explains what Ask can see); you can turn it off at any time in Settings |
| Suggest categories for uncategorized transactions with AI (merchant name, typical amount and your category names sent to the model provider) | Consent (Art. 6(1)(a)) — off until you turn it on in Settings; you can turn it off at any time |
| Sell and provide Rebus Plus: show plans, process your purchase status via RevenueCat, restore purchases, and unlock Plus features for your account | Contract (Art. 6(1)(b)) |
| Count Ask questions and AI runs to apply Plus / free usage limits | Contract (Art. 6(1)(b)) |
| Track our AI costs from the same usage counts, including while limits aren't enforced | Legitimate interests (Art. 6(1)(f)) — running the Service sustainably; you may object |
| Keep bookkeeping records of our subscription revenue (Swedish Bookkeeping Act, bokföringslagen) | Legal obligation (Art. 6(1)(c)), where the records contain personal data. For App Store purchases Apple is the seller to you; we receive the proceeds and Apple's sales reports, not your payment details |
| Send push nudges (e.g. budget pace) | Consent (Art. 6(1)(a)) via device permission / in-app registration |
| Comply with legal obligations and respond to valid authority requests | Legal obligation (Art. 6(1)(c)) where applicable |
| Defend legal claims / security investigations | Legitimate interests (Art. 6(1)(f)) |
You may withdraw consent for bank sync, Ask, AI auto-categorization, or push at any time (see §8) without affecting the lawfulness of processing before withdrawal. Core account features remain available if you withdraw optional consents.
4. How bank and AI features work
Enable Banking (optional). When you connect a bank, you authenticate at your bank (SCA). Rebus never receives your bank login credentials. We store a session identifier and import account and booked transaction data into your Rebus account. Access is read-only.
Ask / eve (optional, consent-based). Ask is off until you turn it on: the first time you use it, Rebus explains what Ask can see and who processes it, and asks you to turn it on. You can turn it off at any time under Settings → Ask (web and mobile); while it is off, Rebus refuses Ask messages from your account. When Ask is on, your questions and the minimum tool context needed to answer (which may include merchants, amounts, and categories) are sent to the model provider (Anthropic's Claude — directly, or via OpenRouter or the Vercel AI Gateway, whichever we configure). Agent proposals are stored as pending suggestions and are not applied until you approve them.
AI auto-categorization (optional, off by default). If you turn on Suggest categories with AI in Settings, then after a bank sync or CSV import Rebus sends the model provider the names of merchants you haven't categorized yet, a typical amount for each, and the names of your categories, and asks which category fits. It is never sent your name, account details, dates or notes, and Swish payments and bank text with no identifiable merchant are filtered out before anything is sent. The answers are stored as pending suggestions you approve or reject; approving teaches Rebus that merchant, and rejecting stops it from proposing that category for that merchant again.
Your data is not used to train AI models. We don't train models on your data, and we only use AI providers whose terms for this kind of business use exclude training on what we send: Anthropic does not train on API inputs and outputs by default, OpenRouter requests are sent with data collection disabled, and through the Vercel AI Gateway requests are restricted to Anthropic and to providers that don't train on prompts.
5. Subscriptions and payments (Rebus Plus)
Rebus is free to use. Rebus Plus is an optional paid subscription that adds Ask, AI proposals and automatic bank refresh. In Sweden it costs 99 kr per month or 599 kr per year (VAT included; other App Store countries are charged a local price shown before you buy). The yearly plan may start with a free trial if you are eligible; the app and the web checkout show the trial length and the date it ends before you confirm.
Who processes your payment. On iPhone you buy Rebus Plus through Apple In-App Purchase. Apple is the seller to you and handles payment, billing, taxes, renewals and refunds under its own terms and privacy policy, as an independent controller for that processing. Rebus never receives your card details or Apple ID credentials. We receive the proceeds and Apple's sales reports.
On the web (the Rebus Plus page in the web app) we sell Rebus Plus ourselves: Deus Labs is the seller, RevenueCat runs the checkout (RevenueCat Web Billing) and Stripe processes the payment. You enter your card (or Apple Pay / Google Pay) details in Stripe's secure payment form inside the checkout; they go straight to Stripe, and Rebus never receives or stores them. The checkout also asks for your email address (for receipts and subscription emails, which RevenueCat sends on our behalf) and, where needed to charge the right VAT, your billing country and postcode. That information goes from the checkout to RevenueCat and Stripe; Rebus does not store it. If we later offer Plus through Google Play, we will update this policy before that launches.
RevenueCat (subscription management). We use RevenueCat, Inc. (USA) as our processor to keep track of subscriptions across stores and to run the web checkout:
- Only when you open Rebus Plus (in the mobile app: the plans screen, Restore purchases, or Manage subscription; on the web: the Rebus Plus page, or Manage subscription if you bought Plus on the web) does Rebus identify you to RevenueCat, using your Rebus account id, a random identifier. If you never open Rebus Plus, nothing about you is sent to RevenueCat. Rebus never sends it your name, email or financial content; the only email RevenueCat gets is the one you type into the web checkout yourself.
- RevenueCat receives the purchase information the store provides: the product, price and currency, storefront country, purchase, renewal and expiry dates, trial status, cancellations, billing problems, refunds, and store transaction ids (from the App Store receipt). Its SDK also collects technical device data such as device type, operating system, app version, and when you last opened the app. For a web purchase it receives what you enter in the checkout (described above), the payment status from Stripe, and technical data from your browser such as IP address and browser type.
- RevenueCat tells our server when your subscription changes (a webhook), and our server may also read your current subscription status from RevenueCat's API to keep it accurate (for example right after you buy on the web).
- From all of this, Rebus stores only the subscription fields listed in §2 (status, source, product id, period end, and timestamps). We do not store prices, receipts or store transaction ids.
Usage limits. Each Ask question (and each AI auto-categorization run) adds one entry to a usage log: the kind of use and the time, never the text. We use it to apply Plus and free limits and to track AI costs.
Manual grants. We may grant Plus to an account without a purchase (for example a promotion or a support goodwill gesture); that is recorded with the source "manual" or "promo".
Cancelling. Cancel at any time in iPhone Settings → [your name] → Subscriptions, or from Manage subscription in the Rebus app. If you bought Plus on the web, cancel (or change your card, or get receipts) from Settings → Rebus Plus → Manage subscription in the web app, which opens RevenueCat's customer portal; every receipt email links there too. Plus stays active until the end of the period you have paid for. Refunds for App Store purchases are handled by Apple (reportaproblem.apple.com); for web purchases, email us. Deleting your Rebus account does not cancel a Rebus Plus subscription, whether you bought it in the App Store or on the web; the app reminds you of this before you delete, but you must cancel it (with Apple, or under Manage subscription on the web) or it keeps renewing.
6. Recipients and processors
We use service providers (“processors”) to host and operate the Service. Depending on which optional features you use, these may include:
| Processor | Role | Location note |
|---|---|---|
| Railway | Application hosting and Postgres database | Primary production database and app are hosted in the EEA / EU (Railway EU region for the Rebus project). Account and financial content at rest are stored there. |
| Enable Banking | Account Information Service (bank connect / sync) | EU AIS provider; used only if you connect a bank |
| Anthropic — directly, or via OpenRouter or the Vercel AI Gateway (whichever one we configure) | Ask assistant and AI auto-categorization inference | May involve processing outside the EEA; used only if Ask is enabled or you turn on auto-categorization. Through OpenRouter, requests are routed only to Anthropic itself, with data collection disabled |
| RevenueCat, Inc. | Subscription management for Rebus Plus (purchase status, webhooks, restore) and the web checkout (RevenueCat Web Billing, receipts and subscription emails) | United States (RevenueCat stores customer data in AWS data centres in the US); used only once you open Rebus Plus in the mobile app or on the web (or buy it) |
| Stripe Payments Europe, Ltd. | Payment processing for Rebus Plus bought on the web (card and wallet payments, VAT calculation, fraud prevention) | Ireland (EU); Stripe may transfer data to Stripe, Inc. in the United States under the Standard Contractual Clauses and the EU–US Data Privacy Framework. Used only if you buy Plus on the web |
| Expo (exp.host) | Push notification delivery | May involve processing outside the EEA; used only if you register for push |
| Google / Apple | Identity provider if you choose social login | May involve processing outside the EEA; dormant until enabled |
Processors may only process data on our instructions and for the purposes above.
Independent controllers. Apple (App Store payments) and, if you use them, Google or Apple sign-in process your data under their own privacy policies; we receive only what is described in this policy. For some processing Stripe must do on its own account, such as fraud prevention and meeting financial regulations, Stripe is an independent controller under its own privacy policy.
Hosting. Core account and financial data are stored on our EU-hosted Postgres instance. That reduces cross-border transfer risk for the primary database compared with a US-only host.
Optional features and transfers. Enable Banking, Ask/AI, Expo Push, Rebus Plus (RevenueCat, and Stripe for web purchases) and social login are opt-in (or dormant until configured). Where those providers process data outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and/or an adequacy decision (including the EU–US Data Privacy Framework for certified US recipients), as applicable. For RevenueCat, its data processing addendum includes the Standard Contractual Clauses (controller-to-processor and processor-to-processor modules). Ask us at privacy@deuslabs.com for the current transfer mechanism for a named processor.
7. Retention
| Data | Retention |
|---|---|
| Account and financial content | Kept while your account is active |
| Account after you request deletion | Soft-deleted immediately for normal use; hard-deleted after 30 days (grace period). You may cancel deletion during the grace period |
| Auth sessions | Until expiry or logout; expired sessions are purged by scheduled jobs |
| Email verification tokens | Until used or expired; stale tokens purged (target: within 7 days after expiry) |
| Push tokens | Until you unregister, disable notifications, or your account is purged |
| Pending agent suggestions | Until you accept/reject them, or your account is purged |
| Subscription record and AI usage log | While your account is active; deleted when your account is purged |
| Data held by RevenueCat | For as long as we use RevenueCat, then returned or deleted under its data processing addendum (subject to its backup and archival practices). RevenueCat's own policy describes keeping some records for up to six years after an account ends to resolve legal issues. You can ask us to have your RevenueCat record deleted |
| Data held by Stripe (web purchases) | Under Stripe's own retention schedule; payment records are kept for as long as financial and anti-money-laundering rules require |
| Bookkeeping records of subscription revenue | 7 years from the end of the financial year, as required by the Swedish Bookkeeping Act (Apple's aggregated sales reports and, for web purchases, the payment and invoice records in Stripe and RevenueCat) |
| Support emails | As long as needed to handle your request and for applicable legal retention |
After hard deletion, residual backups may persist for a limited operational window before rotating out, and are not used for production serving.
8. Your rights
Subject to GDPR conditions and exceptions, you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Data portability (machine-readable copy of data you provided / that we process by automated means for contract/consent)
- Object to processing based on legitimate interests
- Withdraw consent where processing is consent-based
- Lodge a complaint with a supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY), imy.se
How to exercise rights in the product
- Export (portability): Settings → Access & data → Export (JSON bundle and CSV of transactions). The bundle includes your AI preferences, subscription record and AI usage log (kind and time of each entry).
- Erase: Settings → Access & data → Delete account. This starts a 30-day soft-delete. During that period you can cancel. After 30 days the account and associated data are permanently deleted (including cascading database rows). We also attempt to revoke Enable Banking sessions and unregister push tokens when deletion is requested. Deleting your account does not cancel a Rebus Plus subscription. Cancel it first (iPhone Settings → [your name] → Subscriptions for the App Store; Settings → Rebus Plus → Manage subscription for a web purchase), or it keeps renewing.
- Subscription: Cancel or change plan in iPhone Settings → [your name] → Subscriptions, or from Manage subscription in the app; for a web purchase, from Settings → Rebus Plus → Manage subscription in the web app. Ask Apple for App Store refunds, and us for web refunds. Email us to have your RevenueCat record deleted or to get a copy of it.
- Bank disconnect: Settings → Connections → Disconnect (also revocable via Enable Banking’s data-sharing consents page).
- Push: Disable in mobile notification settings / unregister the device token.
- Ask / AI: Ask is off until you turn it on (Rebus asks first, and explains what Ask can see); turn Ask off in Settings (web or mobile) to withdraw that consent; turn off Suggest categories with AI in Settings to stop background categorization; disable the features on the server (no AI key) to prevent further model processing.
You may also email privacy@deuslabs.com. We aim to respond within one month.
9. Children
Rebus is not directed at children under 16. We do not knowingly create accounts for children. If you believe a child has provided data, contact us and we will delete the account.
10. Security
We apply technical and organisational measures appropriate to the risk, including transport encryption (HTTPS), authentication (Better Auth sessions; optional HTTP Basic Auth outer gate on some deployments), authorisation scoped per user, and Postgres row-level security as defence-in-depth. No method of transmission or storage is perfectly secure; please use a strong unique password and protect your devices (e.g. mobile biometric app lock).
11. Cookies and similar technologies
The web app uses necessary cookies/storage for authentication (session), short-lived OAuth state for bank connect, and a theme preference. We do not use advertising cookies or analytics trackers in the shipped product. A consent banner for non-essential cookies is not required while only necessary cookies are used; if that changes, we will update this policy and the product.
12. Changes
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change. Material changes will be highlighted in the Service or by email where appropriate. Continued use after the effective date constitutes acknowledgment of the updated policy where permitted by law.
13. Contact
Deus Labs
Email: privacy@deuslabs.com
For supervisory authority complaints in Sweden: Integritetsskyddsmyndigheten (IMY) — https://www.imy.se