Privacy notice

G.R.A.V.I.S. · Last updated 24 October 2026

Who operates G.R.A.V.I.S.

G.R.A.V.I.S. Personal Finance is a private application operated by Gaëtan Oosterlinck, a private individual, for personal use. It does not provide services to anyone else.

Contact for any question about this notice or the data described here: gaetan@weargrevon.com. This address is on the GREVON company domain. Using it as a contact does not mean that GREVON operates the application, and it does not authorize any access to business bank accounts.

What the application covers

G.R.A.V.I.S. helps its owner keep track of personal finances and, separately, of GREVON business figures that the owner imports from bank statement files. The connection to the bank through Enable Banking is used only for the owner's own eligible personal accounts. GREVON business accounts are never connected through Enable Banking; business information enters the application only through statement files the owner imports.

Whose data this concerns

The application has a single user: its owner. It mainly processes the owner's own financial data. Bank transactions can also contain information about other people, such as the name of a payer or payee and the text of a payment reference.

What data is processed

• Sign-in data: the owner's email address and the information needed to keep the owner signed in, handled by Supabase.
• Bank account information, only after the owner authorizes access at the owner's bank through Enable Banking: for personal current and savings accounts in euro at KBC, CBC or KBC Brussels, the account name, the last four digits of the account number, provider account identifiers, balances with their type and date, and up to 90 days of transaction history (dates, amount, currency, description, counterparty name, payment reference and booking status). The full account number is not kept by the bank connection; it is converted into a one-way fingerprint used to recognise the account.
• Business accounts, accounts in other currencies and accounts that the bank does not identify as personal are excluded automatically from the bank connection.
• Bank statement files (CSV), personal or GREVON business, that the owner opens in the application. These are read inside the browser. Only rows the owner reviews and confirms are sent for saving, together with the statement's account name and account number; the database keeps a one-way fingerprint of the account number rather than the number itself.
• Information the owner enters, such as accounts, budgets and goals.
• Cookies: the cookies Supabase needs to keep the owner signed in, and a cookie that ties a bank authorization to the browser that started it. That second cookie cannot be read by scripts, is sent only to the bank-return address and expires after ten minutes.

What the application does not do

• It cannot initiate payments or move money. Access to the bank is limited to reading account information.
• It never asks for or stores bank passwords. The owner authenticates directly on the bank's own pages.
• It contains no advertising, analytics or tracking, and it does not sell or share data for marketing.
• Bank data is not sent to an artificial-intelligence service and is not used for automated decisions.
• It does not write bank authorization codes to its logs.

Where data is stored and how it is protected

• The application runs on the owner's own computer and is not publicly available.
• Bank connection data (the reference to the bank session, the list of authorized accounts, retrieved balances and transactions, and review choices) is stored on that computer in a file encrypted with AES-256-GCM. The encryption keys are kept in the application's server configuration, separate from the application code.
• Sign-in data and the finance records the owner chooses to save (accounts, budgets, goals and confirmed transactions) are stored in a Supabase database hosted in the EU (Ireland). Bank transactions are written there only after the owner separately enables saving and reviews them.
• Connections to Enable Banking and Supabase use encrypted HTTPS.
• When the bank sends the owner's browser back after authorization, the return passes through a public HTTPS address provided by ngrok. A small relay on the owner's computer accepts only that bank return, does not record it, and forwards the browser to the application on the same computer. The application accepts a bank return only once, only within ten minutes, and only in the browser and signed-in session that started it.
• These measures reduce risk but cannot make any system completely secure.

Service providers

The following services process data as part of the application. Each handles data under its own terms and privacy notice:

• Enable Banking: connects to the bank and passes account information to the application after the owner's authorization.
• KBC (including CBC and KBC Brussels): the owner's bank, which authenticates the owner and provides the account information.
• Supabase: sign-in and the saved finance database, hosted in the EU (Ireland).
• ngrok: provides the public HTTPS address for the bank return. It can see the return address, which contains a one-time authorization code, together with the visitor's IP address and connection details, and it may set its own cookie when it shows a warning page.
• Cloudflare (Cloudflare Pages): hosts these legal pages and can see the IP address and browser details of anyone who visits them.

How long data is kept

• Bank access lasts until the expiry date set when the owner authorizes it (at most 180 days, or less if the bank sets a shorter limit), or until the owner disconnects, whichever comes first.
• Disconnecting immediately deletes the account list, balances, transactions and review choices held in the encrypted file on the owner's computer. Only the reference needed to end the bank session is kept, and only until Enable Banking confirms that the session has ended; the application retries until it does.
• Records the owner has saved in the Supabase database stay there until the owner deletes them. Disconnecting does not delete them.
• Deleting a record removes it from the active database. Supabase may keep copies in backups that it manages, under its own practices and the project's plan; the application does not use those copies and does not control how long Supabase keeps them. Likewise, if the owner backs up the computer, earlier copies of the encrypted file may remain in those backups.
• Values used to secure a bank authorization expire after ten minutes and can be used only once.
• Enable Banking, KBC, Supabase, ngrok and Cloudflare keep data according to their own terms.

Your choices and rights

The owner can withdraw bank access at any time by disconnecting in the application, or through Enable Banking or the bank.

Anyone whose information appears in this application, for example as the payer or payee of a transaction, can contact gaetan@weargrevon.com with questions or requests. Where data protection law such as the EU General Data Protection Regulation applies, you can ask for access to, correction or deletion of your personal data, ask for its processing to be restricted, object to it, and request a copy. You can also complain to your data protection authority; in Belgium this is the Belgian Data Protection Authority (GBA/APD).

Changes to this notice

This notice will be updated if the application changes how it handles data. The date at the top shows the latest version.