What happens to my banking data?

Who operates Pengevis

Pengevis is a private, non-commercial, single-user application operated by its owner and hosted on Firebase App Hosting in Google Cloud. The data-protection contact is the email address shown in the Enable Banking consent information.

Data used in the first pilot

DNB sends authorized account information through Enable Banking. The private deployment accepts the session binding, linked account details, balance evidence, and booked or pending transaction fields needed for an auditable read-only synchronization.

Purpose and storage

Data is used only for the owner's private budgeting viewer: account and Activity views, categories, approved monthly budgets, transaction treatment, and merchant rules. Complete validated bank generations and attributable owner decisions are stored in server-only Firestore. Financial values are not written to browser storage, logs, screenshots, analytics, telemetry, support records, or the source repository.

Providers and access

Enable Banking supplies the account-information connection and DNB authenticates the account owner. BankID is completed only in the bank-controlled flow. Pengevis does not collect BankID credentials. During a synchronization explicitly triggered by the signed-in owner, the browser's IP address is forwarded to Enable Banking and DNB as the bank-required online-user header. It is not retained in Pengevis financial documents or logs. No advertising, tracking, external analytics, or AI service receives the banking data.

Control and deletion

The owner chooses which accounts to link and may stop new access by revoking bank consent and removing the Enable Banking session and credentials. Disconnecting does not erase synchronized Firestore history. Settings keeps disconnect, export, and Delete financial history as separate controls. Export requires recent authentication and releases one versioned exact JSON artifact once from private temporary storage; it excludes credentials, internal paths, and operational logs. Delete financial history additionally requires a deletion-specific, short-lived, single-use authority and explicit confirmation. It removes the bank connection, stored source history, categories, budgets, decisions, merchant rules, and rebuildable indexes while preserving the Firebase user and immutable owner binding.

A best-effort Monday weekly backup is configured for the current Firestore database and retained for four weeks, but no successful backup or restore has yet been proven. For this disposable testing pilot, the owner explicitly chose not to wait for the first backup or a restore drill. Imported transactions, categories, budgets, decisions, recurring settings, and connection state may therefore be lost permanently and may not be recoverable. The backup is a convenience, not a guarantee or substitute for the bank's records. Deleted data can remain in any completed managed backup until that backup expires. Any future recovery still restores into a new database and must pass integrity and browser-denial checks before cutover.