Last updated: August 16, 2026
Buffx AI Ltd. ("Buffx", "we", "us" or "our"), as data controller, presents this privacy policy, as may be amended from time to time (the "Privacy Policy"), in order to provide you with information about our privacy practices relating to Personal Data (as defined below) in connection with our website available at https://buffx.ai or any other address as may be updated from time to time (the "Website"), including when registering to receive early access to our platform (the "Platform").
This Privacy Policy applies only to Personal Data collected through the Website. The processing of Personal Data in connection with use of the Platform will be subject to the Platform's privacy policy, as published through the Platform from time to time.
For the purposes of this Privacy Policy, "Personal Data" means any information that we receive from you or that we collect about you, which relates to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly.
This Privacy Policy supplements our Terms of Use.
The division of this Privacy Policy into sections and headings is for convenience only and shall not affect its interpretation.
We hereby inform you, and you hereby acknowledge, that you have no legal obligation to provide us with any Personal Data when you use the Website, and the provision of it is solely based on your free will. However, without receipt of Personal Data it may not be possible to use the Website or for us to fulfill specific purposes. For example, without providing certain details marked as mandatory fields in forms on the Website, we may not be able to process your inquiry or contact you.
If you provide us with Personal Data relating to third parties, including a former spouse or minors in your custody, you represent that you have obtained their consent to provide us with their Personal Data for the purposes set out in this Privacy Policy, and that you have brought the provisions of this statement to their attention.
Personal Data that you provide us with. During your use of the Website, we may collect and process one or more of the categories of Personal Data listed below:
Personal Data Collected Through Technological Tools. In addition to the above, we collect data through cookies and various analytical tools regarding your browsing habits, such as IP address or Device ID, the duration of visit to the Website, and the like. For more information about these tools, including options for disabling certain Cookies, please see our Cookie Policy.
We process the Personal Data described above for the following purposes:
| Purposes | Example of Use of Personal Data | Legal Basis (for EEA Visitors only) |
|---|---|---|
| Managing and administering early access registration | To process your request and reserve a spot for early access; to maintain and manage our early access list and/or waiting list; to contact you in connection with your early access request and answer your inquiries; to send you operational updates or schedule a call. | Your consent. |
| Developing the Platform or our business activities | To collect feedback, including through satisfaction surveys; to analyze feedback and survey results. | Our legitimate interest in developing and improving the Platform. Where required by applicable law, we will rely on your consent. |
| Marketing and promotional purposes | To send marketing communications and promotional materials; to provide you with updates about products or offers. | Your consent. You may withdraw your consent at any time by contacting us or as stated in the advertising message. |
| Improving the Website | To monitor and analyze the Website usage and performance; to improve the functionality, content, and usability of our Website; to measure the effectiveness of our Website; to create aggregated statistical data. | Where required by applicable law, we collect such data and analytics through cookies and similar technologies only with your consent. For more information about our use of cookies and similar technologies, please refer to our Cookie Policy. |
| Supporting and enhancing our data security measures | To monitor, investigate bugs, and improve our Website; to prevent and mitigate the risks of fraud, error or any illegal, criminal or prohibited activity. | Legitimate interest in securing our Website. |
| Defending rights | To take action against any identified security breach, manage any dispute or litigation; to seek advice from lawyers, auditors, and other professional advisers. | Legitimate interest in defending our rights and interests. |
| Complying with legal and regulatory obligations | To perform any reporting and notification obligations we may be subject to, to competent governmental agencies and authorities; to process your requests to exercise your rights; to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to rights. | Legal obligations to which Buffx is subject. |
We may share your Personal Data with third parties as detailed below:
We may host, store, process, maintain or transfer the Personal Data to various sites worldwide, outside your jurisdiction. Where specific laws or regulations relating to Personal Data transfer apply to us, we will implement our best effort to ensure that the Personal Data is protected and transferred in a manner consistent with legal requirements.
By using our Website, you acknowledge that your Personal Data may be transferred to countries where data protection standards differ from those in your jurisdiction, including in countries that provide a lower level of privacy protection than that applicable in your jurisdiction.
We implement customary and appropriate technical and organizational security measures with respect to the Personal Data in our possession, in accordance with the legal requirements applicable to us. Nevertheless, the transmission of Personal Data over the Internet and its storage on cloud-based hosting servers cannot provide absolute protection. Accordingly, we cannot guarantee absolute protection of Personal Data or ensure that unauthorized access, transfer, alteration or loss of Personal Data will not occur.
Data Retention. We will retain Personal Data for the period required to fulfill the purposes set out in this Privacy Policy, or for a longer period where permitted or required by law, such as: (i) where we are required to do so in accordance with legal and regulatory requirements, including tax or accounting requirements, or (ii) for us to have an accurate record of your interaction with us in the event of any inquiries or contact requests, or (iii) if we reasonably believe there is a prospect of litigation. Anonymized data may be retained indefinitely, to the extent not prohibited by law.
General Provisions. Please note that under certain circumstances and depending on your jurisdiction, you are entitled to specific rights regarding your Personal Data (subject to some exceptions). Applicable privacy and data protection laws in your jurisdiction may provide you with different or additional rights related to the Personal Data we collect from you, which may also apply. In most cases, you can exercise such rights free of charge.
When you ask us to exercise any of your rights under this Privacy Policy and the applicable privacy and data protection laws, we may need to ask you to provide us with certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of Personal Data which is related to others that you are not authorized to receive, and to ask you questions to better understand the nature and scope of Personal Data that you request to access.
Please note that you can deliver your request by contacting us using the contact details set out in Section 11 below.
EEA Visitors. If you are based in the EEA and subject to the GDPR, you have the following rights:
Data Rights for Israeli Individuals. If you are based in Israel, you are entitled to request us to review and access your Personal Data that we process, and to update, amend, and delete Personal Data which is incomplete, incorrect, outdated or unclear.
This section describes how the Buffx application accesses, uses, stores and shares data from your Google Account. It applies only if you choose to connect your Gmail mailbox to Buffx. Connecting Gmail is entirely optional: Buffx can be used in full without it, and you may instead forward individual invoices to a dedicated Buffx address.
What we access. If you connect your mailbox, you grant Buffx the https://www.googleapis.com/auth/gmail.readonly scope through Google's own consent screen. This is a read-only permission. Buffx cannot send, delete, modify, or label anything in your mailbox. We also receive your email address (openid, email) solely to display which mailbox is connected.
What we use it for. Buffx uses this access for one purpose only: to locate invoices and receipts relating to your children's expenses, so that they can be documented in your case file. We search your mailbox for messages carrying invoice-like attachments within the time window you select, and we read the attachments themselves in order to extract the vendor, amount, date and reference number. Every item found is placed in a review queue and is added to your case only after you personally approve it. Nothing found in your mailbox is used for any other feature.
What we store. We store the attachments you approve, because those documents become the evidentiary record of your case, which is the service you are asking us to provide. For items you have not approved we retain the file and its message metadata (sender, subject, date, message identifier) so that the review queue can show you where each item came from. We do not store the body or the text of your emails. Your Google access and refresh tokens are encrypted at rest using AES-256-GCM with a key held outside the database.
What we share. Attachments are transmitted to Google Cloud Document AI, operating as our processor under contract, for the sole purpose of extracting the figures described above. No Google user data is shared with any other third party, other than where Section 4 above requires disclosure to authorities or in legal proceedings. We do not sell Google user data, we do not transfer it to data brokers, advertisers, or information resellers, and we do not use it for advertising of any kind.
Humans and machine learning. Google user data is not read by Buffx personnel, except where you specifically ask us to for support purposes, where it is necessary for security purposes such as investigating abuse, or where we are required to do so by law. We do not use Google user data to develop, train, or improve generalized artificial intelligence or machine learning models.
Limited Use. Buffx's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How to disconnect and delete. You can disconnect your mailbox at any time from the mail connection screen inside Buffx. Disconnecting revokes the token with Google immediately, so Buffx loses all access to your mailbox at that moment, and deletes the stored credential. You may also revoke access directly at myaccount.google.com/permissions. Documents you already approved into your case are not deleted by disconnecting, because they form part of the record of your case; to request their deletion, contact us using the details in Section 11 below. Items still waiting in the review queue are deleted on request, and rejected items are excluded from your case.
During your use of the Website you may access links to other websites or services operated by third parties. Please note that this Privacy Policy only applies to Personal Data that we (or third parties on our behalf) collect from or about you through the Website, and we are not responsible for Personal Data collected and stored by third parties. Third party websites and services have their own terms and conditions and privacy policies, and you should read these carefully before you submit any Personal Data through these websites.
We reserve the right to update or amend this Privacy Policy from time to time, as needed and at our sole discretion, without any obligation to provide prior or subsequent notice. The new or updated privacy policy will be effective from the date mentioned at the top of the new privacy policy. We recommend that you review this Policy from time to time; your continued use of the Website following any update to the Policy constitutes your acceptance of its updated terms.
If you have any questions about this Privacy Policy, please contact us by email at: info@buffx.ai.
Data Controller Details: Buffx AI Ltd.