Trust center · Effective August 4, 2026
Service providers
Rubato uses a small set of providers for hosting, account connectivity, payments, optional AI, email, and public market data. A provider receives only the categories needed for its role.
Current provider list
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, edge security, server runtime, database and deployed assets | Account, application, financial and operational data |
| Plaid | Optional read-only financial account connection and synchronization | User-authorized account, balance, transaction and investment data |
| SimpleFIN | Optional read-only financial account aggregation | User-authorized account, balance and transaction data |
| PayPal | Subscription checkout, billing status and cancellation | Contact, plan, transaction and provider billing identifiers |
| OpenAI API | Optional AI-supported explanations and plan reviews | Bounded calculated metrics, category and normalized merchant summaries, and a stable one-way pseudonymous safety identifier |
| Google Analytics | Limited site and application usage measurement with advertising signals disabled | Sanitized page path without query strings or fragments, browser and device information, and approximate location; no financial values or authentication tokens |
| Resend | Transactional verification, recovery and service email | Recipient email, message content and delivery metadata |
| Zoho Mail | Human-operated support, privacy and security mailboxes | Messages and attachments a person chooses to send |
| Yahoo Finance | Public market-price history used for educational charts | Public ticker requests; no bank credentials |
Provider choice and consent
Plaid, SimpleFIN, PayPal, and AI-supported review are used only when the user chooses the corresponding connection, purchase, or review. A user can keep a manual Free workspace without connecting a bank. Disconnecting a provider stops new retrieval; account deletion covers the Rubato-side records described in the Privacy Policy.
Changes
Rubato may replace a provider when needed for security, reliability, price, or product coverage. Material changes that alter how private financial data is processed will be reflected here and in the Privacy Policy before or when the change takes effect.
OpenAI safety identifier
Alongside bounded review context, Rubato sends OpenAI a stable, one-way pseudonymous safety identifier derived from the normalized account email. OpenAI receives the identifier rather than the email address; Rubato uses it for provider abuse detection and not to personalize recommendations.