> ## Documentation Index
> Fetch the complete documentation index at: https://recontrol.money/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AI and your data

> Exactly what leaves Recontrol when you use Chat or let it sort your bank's transactions, who processes it, and what is never sent.

*Last updated 22 October 2026.*

Two features send some of your information to a third-party model provider: [Chat](https://recontrol.money/docs/features/chat.md), and the sorting of a linked bank's new kinds of transaction into your categories. Both run only after you turn on **AI features**. This page states precisely what goes, what stays, and what happens to it, because "we use AI" is not a disclosure.

## Who processes it

The model is **Claude**, provided by **Anthropic PBC** in the **United States**. Anthropic acts as our processor for these features.

Under Anthropic's commercial terms, **Anthropic does not train its models on data sent through its API**, and prompt and response content sent to the messages endpoint is not retained by default once the response has been returned. Anthropic may retain content that its automated trust-and-safety systems flag, or where retention is required by law. See [Anthropic's privacy policy](https://www.anthropic.com/legal/privacy) and their [API data-retention documentation](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).

### You are asked first

The first time you ask Chat a question, it asks you to turn on **AI features**, in the place the answer would be. The request names Anthropic and lists what is sent. Nothing reaches Anthropic until you agree. Your choice is kept with your account, so it holds on the phone and on the web.

Turning on AI features is never a condition of subscribing, and subscribing never turns it on. You can turn it off at any time in **Settings** on the phone, or in Profile and settings on the web. Once it's off, Chat stops sending anything, and your banks' new transactions are sorted without the model.

## What Chat sends

Chat looks up what each question needs. With every question, it sends your question and a short orientation; then, as the question needs them, the results of its lookups.

| Sent | Detail |
| - | - |
| **Your question** | The text you typed or dictated |
| **Earlier turns in the same session** | Held on your device and re-sent so follow-ups make sense; capped in number and length |
| **The space** | Its name, its reporting currency and today's date |
| **Your assets and liabilities** | Their names, types, currencies and today's balances |
| **Your categories and income sources** | Their names |
| **This month's totals** | What the space holds and owes, and what came in and went out this month |
| **Caveats** | Whether some money has no category, whether an amount couldn't be converted, and which connections have stopped syncing, by institution name |
| **What your role allows** | The permissions you hold in the space, so Chat doesn't propose what you can't do |
| **Lookups, as the question needs** | Spending by category over any period; a list of matching transactions, each with its note (or its accounts), amount, date and direction; balances on a date; your budgets, goals and watchlists with their figures; and the answers to what-ifs worked out from the figures you give |
| **Opaque identifiers** | Internal record IDs for the accounts, transactions and plans above, which mean nothing outside our database |

So the names you've given your accounts, categories, sources and plans **are** sent, and so are individual transactions when a question needs them, with their notes and amounts. The space's books include what anyone sharing the space has recorded. We say so plainly rather than implying the model sees only anonymous totals.

When Chat proposes a change, the change is worked out and checked by Recontrol, and the confirm card is drawn by the app, not the model. Confirming it sends nothing to Anthropic.

## What sorting sends

When a bank you linked brings a kind of transaction your space hasn't seen before, and Recontrol can't place it from your own history or your category names, it may ask the model to choose among your space's categories. It sends:

* the names of your space's categories;
* the bank's category for the transaction, in words;
* up to three merchant names.

**It never sends an amount, a note, or anything that identifies you.** It runs only if the person who linked the bank has turned on AI features; nobody else's choice stands in for theirs. An answer that isn't one of your own categories is ignored.

## What is never sent

* **Your name, email address, or phone number**
* **Account numbers**, including the last four digits imported from a bank
* **Bank or brokerage credentials**, which we never hold in the first place
* **Individual investment holdings**: security names, quantities and prices. A connected brokerage account appears to Chat as an account with a balance
* **Anything from another space.** Chat reads only the space you're in

## What we keep

We store **the text of your Chat question** and whether the exchange succeeded, in our own database, attributed to your account.

We do **not** store the answer, and we do not store the figures that were sent with it. There is no server-side transcript. The conversation you see lives on your device only, for that session.

Your questions are deleted when you delete your account, and you may ask us to erase them at any time by emailing [support@recontrol.money](mailto:support@recontrol.money).

> [!NOTE]
>
> Question text is kept in our own database and is never sent to our analytics provider. Our analytics never include free text of any kind. See [What we store](https://recontrol.money/docs/data/storing.md).

## Voice input

If you ask by voice on the phone, the audio is transcribed by **your device's own speech recognition**: Apple's on iPhone, Google's on Android. On the web, it's your browser's speech recognition. Whether that happens on the device or on the provider's servers is decided by the platform and varies by language and device; Recontrol doesn't control it.

To help the recogniser with names it would otherwise mangle, the phone app supplies **your institution and account names** to it as vocabulary hints while the microphone is open. The microphone is active only while you're dictating, and a dictated question waits for you to send it.

Recontrol does not record, store, or transmit audio.

## Guardrails

* **The model does no arithmetic.** Every figure in an answer must come from what Recontrol computed. It's instructed to say it doesn't have a figure rather than invent one.
* **The model can't change anything by itself.** It can only propose a change, which the app shows you on a card. Nothing is saved unless you confirm it, and a confirmed change is made under your own permissions. Chat can't connect or disconnect banks, change members, roles or invitations, delete a space or your account, or touch a subscription.
* **Your data is not treated as instructions.** Text inside your books, such as an account name or a transaction's note, is passed to the model as data, explicitly delimited, with an instruction that it's never a command. A defence against prompt injection.
* **No investment advice.** Chat never evaluates, ranks or recommends a security. Recontrol does not provide investment advice, and Chat is not an adviser.
* **Your own permissions apply.** Everything Chat reads is read under your own identity, so it contains only what your [role](https://recontrol.money/docs/features/spaces.md#roles) in that space already lets you see.

## Your own AI tool

On the web, **Your AI tool** lets you connect an AI tool you use, such as Claude or ChatGPT, to your books. That connection is yours: you set it up in your tool, it reads what you can see in your spaces when you ask it to, and **the figures it reads go to your AI tool's provider**, under your agreement with them. Remove Recontrol in your tool's settings to stop it. See [Your AI tool](https://recontrol.money/docs/ai-tool.md).

## Related

* [Chat](https://recontrol.money/docs/features/chat.md): how the feature works
* [Connections](https://recontrol.money/docs/features/connections.md#where-imported-transactions-land): how imported transactions are placed
* [What we store](https://recontrol.money/docs/data/storing.md): every category of data we hold
* [Privacy Policy](https://recontrol.money/docs/legal/privacy.md#4a-ai-chat): the formal disclosure


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.