Who we are
Quantumize AI built NBU. Here's who to contact about privacy.
Quantumize AI Inc. is a software company incorporated in the Province of Québec, Canada, with offices in Montréal. NBU (getnbu.com) is a product of Quantumize AI Inc.
We are responsible for the personal information we collect and hold. Our designated Privacy Officer handles all data-related requests and inquiries.
What we collect
We collect your email, the statements you upload, and basic usage data. We never collect your bank login.
We collect the following personal information:
- —Email address — required for account creation and authentication.
- —Transaction data — the CSV files you upload and their parsed contents (merchant names, amounts, dates, categories).
- —Usage data — page visits and feature interactions, collected to understand how NBU is used and improve the service.
- —Product events — first-party records of key actions in your account: signing up (and the link you arrived from), your first import, completing a monthly review, viewing an upgrade prompt, and starting or pausing a card pursuit. They live only on our servers, are never shared or sold, never reach Google Analytics, and are deleted with your account.
- —Community-learning contributions — only if you turn on community learning (Settings → Data): the merchant-category corrections you make are counted toward a shared suggestion pool, in scrambled form. See “Community learning” below.
- —IP address — retained for security monitoring and fraud prevention.
- —Session and preference data — stored as cookies; see our Cookie Policy.
We do not collect your bank login credentials, banking passwords, or any financial account access tokens — ever.
Why we collect it
We collect data to run the service. That's it.
We use your personal information to:
- —Create and authenticate your NBU account.
- —Provide the NBU service — categorizing your transactions and running the Valerie assistant.
- —Improve our automatic categorization accuracy over time.
- —Measure how NBU is used through our own first-party product events, so we can improve the service without relying on third-party trackers.
- —Respond to your support requests.
- —Comply with applicable Québec and Canadian law.
We do not use your data for advertising, behavioural profiling for third-party purposes, or any use not described in this policy.
How AI processes your data
Before Valerie sees your transactions, anything that could identify you personally gets removed first.
NBU uses Google Gemini — an AI model provided by Google LLC — to power the Valerie assistant and automatic categorization features.
Before your transaction data is processed by the AI model, we automatically remove personal identifiers, including full names, account numbers, card numbers, and similar information. The AI model receives transaction descriptions, amounts, and dates only.
We do not use your personal financial data to train AI models.
Who we share it with
We use a small number of third-party services to run NBU. Here's each one, and why.
- —Supabase — database hosting and authentication. Data is encrypted in transit and at rest.
- —Google LLC — Gemini AI processing, and Google Analytics (only after you accept analytics cookies). Transaction data, with personal identifiers removed, is processed via Google's Gemini API.
- —Stripe, Inc. — payment processing for Plus and Household subscriptions. Stripe handles your card details directly; we never see or store your full card number.
- —Vercel Inc. — hosting and deployment. Usage data may pass through Vercel's servers.
We do not share your data with any other third parties. We do not sell your data.
Because these providers operate their infrastructure primarily in the United States, your personal information is hosted and processed outside Québec and Canada. When your data is communicated outside Québec, we rely on contractual protections requiring these providers to safeguard your information to a standard comparable to what applies here.
How long we keep it
We keep your data as long as your account is active. After you delete your account, it's gone within 30 days.
- —Active accounts — we retain your transaction data and account information for as long as your account is active.
- —Deleted accounts — when you delete your account, your personal data is permanently removed from our production systems. Residual copies in encrypted backups are removed within 30 days.
You can delete your account at any time from Account Settings.
Your rights
You have real rights over your data. Here's what they are and how to exercise them.
Under Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and regardless of where you reside, you have the following rights:
- —Right of access — request a copy of the personal data we hold about you.
- —Right of correction — request that we correct inaccurate or incomplete data.
- —Right to deletion — request that we delete your personal data.
- —Right to data portability — request your data in a structured, machine-readable format (CSV).
- —Right to withdraw consent — withdraw consent for any data processing based on consent.
To exercise any of these rights, contact our Privacy Officer at privacy@quantumize.ai. We will respond within 30 days.
Filing a complaint
If you think we've mishandled your data, you can report it — first to us, then to the CAI if needed.
If you believe we have processed your personal information in violation of applicable privacy legislation, please contact our Privacy Officer at privacy@quantumize.ai first. Most issues can be resolved quickly.
If you are unsatisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.
Cookies
We use essential cookies, plus Google Analytics — but only if you accept it.
We use essential cookies to keep you logged in and remember your preferences. With your consent, we also use Google Analytics (GA4) to understand how the site is used. You can accept or decline analytics in our consent banner and withdraw consent at any time; declining sets no analytics cookies and clears any existing ones. See our Cookie Policy for the full list.
See our Cookie Policy for the full list of cookies and how to manage them.
Community learning (optional)
Off by default. Turn it on and NBU learns from patterns, never from anything traceable back to you.
Your own transaction history and category labels stay in your private, isolated account. Community learning changes nothing about that.
If you turn on community learning (Settings → Data), the merchant-category corrections you make are counted toward a shared suggestion pool. A suggestion joins the pool only after at least five different consenting people have independently taught NBU the same thing — and what is stored is a one-way code created with a secret key on our server, never a readable merchant name. The pool holds no names, amounts, personal notes, or e-transfer details, and keeps no record of who contributed.
You can turn it off at any time in Settings → Data. Your pending contributions — the ones not yet promoted to the pool — are removed immediately, and the Sparks you earned for them are reversed; we show you the exact number before you confirm. Deleting your account also removes your pending contributions.
Community learning governs contribution only. With it off, you still receive community suggestions; you just do not add to the pool or earn contribution Sparks.
Changes to this policy
If we make significant changes, we'll email you at least 14 days before they take effect.
We may update this Privacy Policy from time to time. If we make material changes — changes that affect your rights or how we handle your data — we will notify you by email at least 14 days before the changes take effect.
The current version of this policy is always available at getnbu.com/legal/privacy. The "Last updated" date at the top of this page reflects the most recent revision.