1. Who we are and what this covers
FamilyOffice.bot, operated by LanPro LLC-FZ, Dubai, United Arab Emirates ("we", "our", or "the Service"), provides family office software for managing financial accounts, entities, documents, and reporting. This policy explains what personal and financial information we hold, how it is processed, who else can see it, and how long it is kept.
It applies to this website, to the software itself, and to the infrastructure we operate on your behalf. Where you connect a third party — such as your bank, through Plaid — that provider's own privacy policy governs what it does with your information, and we link to it below.
2. How the Service is built
This matters for privacy, so we state it plainly: each family runs on its own dedicated infrastructure. Your family's data is not stored in a shared multi-tenant database alongside other customers. A family instance consists of two servers on a private network reserved for that family — one running the application and database, one running the AI model — and no other customer's data is present on either.
The practical effect is that a fault or compromise affecting one family does not expose another family's information, because the data was never co-located.
3. Information we collect
Account information. Your name, email address, and a password stored only as a salted hash. We never store your password in a recoverable form.
Financial information. Whatever you enter or import: account balances, transactions, investment holdings, valuations, entities and ownership structures, insurance policies, property details, liabilities, and related notes.
Documents. Files you upload to the Document Vault, together with text extracted from them so they can be searched.
Connection credentials. Where you link an external provider, the access token that provider issues to us. These are encrypted before storage (see section 7).
Technical information. Server logs recording IP address, browser user agent, timestamps, and requested pages, kept for security and troubleshooting.
We do not operate advertising or analytics trackers, and we do not build profiles of you for marketing.
4. Connecting bank accounts through Plaid
If you choose to link a financial institution, we use Plaid Inc. ("Plaid") to establish and maintain that connection. Linking is always optional; the Service is fully usable without it.
We never see or store your banking credentials. When you link an account, you enter your institution's username and password directly into Plaid Link, which is operated by Plaid. Those credentials are transmitted to Plaid and are never sent to, processed by, or stored on our servers.
What Plaid returns to us. After you authorise a connection, Plaid provides us with an access token plus the account data you consented to share. Depending on the account type, that may include:
- Account identifiers, names, types, subtypes, and account mask (typically the last four digits)
- Current and available balances, and the account's currency
- Transaction history — date, amount, description, merchant, category, and pending status — for up to 730 days
- Investment holdings and investment transactions, where you link an investment account
- Liability details such as balances, rates, and due dates, where you link a credit card or loan
- Information about the financial institution itself
We request the Plaid products transactions, investments, and liabilities, matched to the type of account you are linking.
Where that data goes. Plaid delivers it to your family's own instance, where it is stored on your dedicated server. The access token and the raw provider payloads are encrypted at the field level. Plaid data is not pooled across families, and is not shared with any other customer, advertiser, or data broker.
Plaid's own handling of your information is governed by Plaid's privacy policy, which we encourage you to read: plaid.com/legal. Plaid may retain and process information in accordance with that policy and its agreements with your financial institution.
Disconnecting. You can unlink an institution at any time from within the Service. When you do, we instruct Plaid to remove the item, which revokes the access token and ends further data retrieval, and we delete the stored token. Data already retrieved and stored in your instance remains until you delete it or delete your account (see section 9).
5. AI features (MIDAS)
MIDAS, the assistant built into the Service, runs on a language model hosted on your family's own AI server, on the private network described in section 2. In this default configuration your financial data, documents, and questions are processed inside your own instance and are not transmitted to any third-party AI provider.
Your data is never used to train models — neither ours nor anyone else's.
A family administrator may optionally choose to use an external AI provider instead. Because that sends the relevant content outside your instance to that provider, it requires explicit, recorded consent by an administrator before it takes effect, and it can be reversed at any time. We record who gave that consent and when.
6. How we use your information
- To provide the Service: dashboards, reporting, document search, and assistant responses
- To authenticate you and protect your account
- To retrieve and refresh data from providers you have connected
- To operate, back up, monitor, and troubleshoot your instance
- To communicate with you about the Service, including security notices
- To meet legal and regulatory obligations
We do not sell, rent, or licence your personal or financial data, and we do not disclose it to advertisers.
7. Security
In transit. All connections to the Service use TLS. Traffic between your application server and its AI server stays on a private network that is not reachable from the public internet.
At rest. Sensitive fields — provider access tokens, API credentials, and raw provider payloads including Plaid's — are encrypted at the application layer before being written to the database, using per-instance keys. Note that the underlying server disk is not separately encrypted; protection of stored data rests on field-level encryption, access control, and the isolation described in section 2.
Backups. Backups are encrypted on your server before they are uploaded, so the storage provider holds only ciphertext and never a key. They are written to versioned object storage in the same region as your instance. The credential held by your server can write backups and remove current copies, but cannot delete stored versions — so an attacker who compromises your instance can hide your backups without destroying them, and we can restore from the retained versions.
Every instance's backups additionally carry a 30-day immutability lock on every backup file, which no one — including us — can lift before it expires, and a second encrypted copy replicated into a separate cloud account, which is itself locked in the same way.
Access control. Administrative access to servers is by SSH key only; password authentication is disabled. Access within the application is role-based, and an administrator controls who in your family can see what.
What we can do. We operate the servers, so our team can access an instance to keep it running, restore it, and apply updates. That is true of every hosted service; most simply do not say so.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal information we will notify you promptly and describe what happened and what we are doing about it.
8. Who else processes your information
We keep the list of third parties deliberately short. As of the date above, they are:
| Provider | Purpose | What it can access |
|---|---|---|
| Hetzner | Hosting of your dedicated servers | Operates the infrastructure; does not access application data in the ordinary course |
| Amazon Web Services | Off-site backup storage | Encrypted backup files only; holds no decryption key |
| Plaid | Bank account connections, if you use them | Your institution credentials and the account data described in section 4 |
| Stripe | Subscription payments | Billing contact and payment details; no access to your financial records in the Service |
| Our mail host | Sending service and security email | Your email address and the contents of those messages; sent over an encrypted connection |
We may also disclose information where required by law, regulation, or valid legal process, or where necessary to protect the rights or safety of a person. If we are legally permitted to tell you about such a request, we will.
9. How long we keep information, and deletion
Your information is kept for as long as your family's instance is active. You may delete individual records, documents, and connections at any time.
When you delete your account, the live data on your instance is removed. Please note that encrypted backup copies persist for a period after deletion, because backups exist precisely so that a deletion — accidental or malicious — can be undone. Backups follow a rolling schedule of daily, weekly, and monthly snapshots, so a copy of deleted information may remain in encrypted form for up to six months. Superseded versions in object storage are retained for a further limited period, which falls within that same six-month bound. In US East, an individual backup file also cannot be deleted by anyone, ourselves included, for 30 days after it is written. Those copies are not accessible through the Service and are expired automatically on that schedule.
We may retain a minimal record of the account's existence, such as billing history, where required for legal, tax, or accounting purposes.
10. Your rights
- Access and portability — export your data at any time from within the Service
- Correction — edit your profile and any financial record you have entered
- Deletion — delete individual records, or your entire account, subject to section 9
- Withdraw consent — disconnect a linked institution, or revert an external AI provider choice, at any time
- Objection and restriction — where applicable law provides these rights, contact us and we will honour them
Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA. We apply the protections in this policy to all customers regardless of location.
12. Where your information is held
Your instance is provisioned in a region chosen when your family is set up, and your data resides there. Backups are stored in cloud object storage in that same region. Each region also replicates an encrypted copy to one paired region, in a separate cloud account: US East to US West, US West to US East, Europe (Frankfurt) to Europe (Ireland), and Asia (Singapore) to Australia (Sydney). A European instance's backups therefore stay in Europe; an Asian instance's second copy is held in Australia. Providers you connect, such as Plaid, may process information in the countries described in their own policies.
13. Children
The Service is intended for adults. We do not knowingly collect information directly from anyone under 18. A family may of course record information about minor family members as part of its own records; that information is treated the same as any other family data.
14. Changes to this policy
We may update this policy as the Service evolves. The date at the top reflects the most recent change, and we will tell you about material changes by email or in-app notice before they take effect.
15. Contact
For any privacy question, or to exercise any right described above, contact privacy@familyoffice.bot.
LanPro LLC-FZ · Dubai, United Arab Emirates · FamilyOffice.bot