Privacy — MBC AI connections
Updated 10 November 2026. Cenulinq (KvK 42186920) is the MBC controller. Contact support@cenulinq.com. The ordinary MBC privacy notice applies alongside this notice. This connection is separate from the MBC AI app-help feature.
Only your own confirmed MBC account, age 18+, can be linked. No account is linked automatically. MBC shows the return hostname and assistant before you allow or deny the requested scopes. ChatGPT connections send results to OpenAI; Claude connections send results to Anthropic; Cursor connections send results to Anysphere and may use its selected model providers. A local connection sends results to the local AI application you initiated; MBC cannot verify that application or its onward provider. Review that application's provider, selected models and privacy settings before allowing access. Denying a connection does not prevent normal MBC use.
Month, currency, closed-month status, planned/recorded income and expense totals and record count. To prepare an expense: month, date, amount, currency, description, category, paid/planned choice, random proposal identifier, MBC review link and approval status. Tool responses do not include a full transaction list, account name, email, bank account number, password, MBC sign-in token or billing history. Use neutral expense descriptions without sensitive information or information about other people.
The recipient processes results as part of your conversation, under its own account settings and terms. Read the OpenAI privacy policy, Anthropic privacy policy or Cursor privacy policy, as applicable, and the selected downstream model provider's notice. MBC's app-help API retention/training statements do not describe these separate conversations. Data may be processed outside your country. Revoking MBC access stops new requests; it does not erase data already received by the assistant. Manage or delete those conversations with that provider.
The existing Netlify endpoint and Supabase database retain protected account/session/client links, scopes, token hashes, expiry/revocation, request state and expense proposals. The MBC sign-in credential stays with MBC. The assistant gets a separate scoped random token; MBC stores its hash. There is no shared administrative credential, marketing analytics on the consent page or budget content in marketing documents.
Authorization requests expire after five minutes, connections after 15 minutes without refresh tokens, and expense proposals after 10 minutes. Existing daily cleanup removes expired artifacts after more than one day, normally approximately 24–48 hours after expiry. Private account/day usage counters are retained for today and the seven preceding UTC dates. Stable public client identifiers and registered callbacks are non-secret configuration retained while the service operates, with bounded registration capacity. Necessary security and abuse-prevention processing uses our legitimate interest in protecting the service. Ordinary logs and backups follow the main privacy notice; faults may delay cleanup.
A minimal booking marker (random identifiers, a hash of the exact proposal and its resulting record identifier, without its amount or description) remains while the account exists to prevent duplicate recording after delayed retries. Account deletion removes the marker. After separate approval, a recorded entry follows ordinary budget retention. Signing out of the original MBC session, revocation, expiry or account deletion stops future access. For access, deletion or privacy requests contact support; see the ordinary notice for your rights and complaint routes.