Privacy Policy

Effective October 12, 2026

Lasa is a personal finance app operated by Enoki Labs LLC, a New Jersey limited liability company ("Enoki Labs", "we", "us"). This policy explains what information Lasa collects, how we use and share it, how we protect it, and the choices you have. It applies to the Lasa web app at app.lasa.money, the Lasa apps for iPhone and Mac, and this website.

The short version

• We use your information only to run Lasa for you. We do not sell it, rent it, or use it for advertising.
• Lasa has read-only access to the accounts you connect. It cannot move money.
• Your bank username and password go to your bank through Plaid. Lasa never sees or stores them.
• There are no ads, analytics, or tracking scripts in Lasa or on this website.
• You can download your data or delete your account at any time from Settings.

Information we collect

Information you give us

• Account information: your email address, which is how you sign in. If you turn on two-step sign-in, we store the authenticator enrollment needed to verify your codes.
• Information you enter: accounts you add by hand, transactions, categories, budgets, rules, notes, tags, scheduled transactions, loan terms, investment holdings and trades, and files you import.
• Home details: if you add a home, its address and the values you record.
• Household members: if you invite someone to share your household, the email address you invite.
• Messages: anything you send us, for example to privacy@lasa.money or security@lasa.money.

Information from accounts you connect

When you connect a bank, card, brokerage, lender or exchange, we receive information about those accounts through Plaid Inc. ("Plaid"), with your permission. Depending on the account, this includes: account names, types, the last digits of account numbers (never full account or routing numbers), balances and credit limits; transactions (date, amount, description, merchant and category); investment holdings, securities and investment transactions; and loan and card details such as interest rates, payment amounts, due dates and, for mortgages, the property address.

Information collected automatically

Our hosting and database providers record standard technical information when you use Lasa, such as IP address, browser or device type, and the time and result of requests. This is used to operate and secure the service. Lasa does not use cookies for advertising or analytics. The app stores your sign-in session and a few preferences (such as theme and page order) on your device.

How we use information

• To provide Lasa: show your balances, transactions, budgets, net worth, investments and loans, and keep them up to date.
• To sign you in, keep your account secure, and enforce two-step sign-in when you turn it on.
• To provide features you ask for, such as importing files, home value estimates, investment prices and sharing a household.
• To respond to you, and to send messages about your account or the service (for example sign-in links or important changes).
• To detect, prevent and investigate security incidents, abuse and errors, and to comply with law.

We do not sell your information, share it for cross-context behavioral advertising, or use it to build profiles for third parties. We do not use your financial data to train artificial intelligence models.

Plaid

Lasa uses Plaid to connect to your financial accounts. When you connect an account, you sign in to your financial institution through Plaid, and Plaid collects and shares your account information with us as described above. By using Plaid you acknowledge and agree that Plaid's processing of your information is governed by the Plaid End User Privacy Policy. You can disconnect an account in Lasa at any time (Settings → Connections), which revokes Lasa's access through Plaid. You can also manage the apps connected through Plaid at my.plaid.com.

How we share information

We share information only with the service providers that run Lasa on our behalf, only as needed for the purpose listed, and under their own security and confidentiality obligations:

• Supabase: database, sign-in and server functions; stores your Lasa data in the United States.
• Cloudflare: hosting and network delivery for this website and the web app.
• Plaid: connections to your financial accounts, as described above.
• Twelve Data: market prices. We send only ticker symbols (for example "VTI"), never information about you or your accounts.
• RentCast: home value estimates. When an estimate is requested, we send the home's address, and nothing else about you.

We also share information: with other members of your household, if you invite them (they see and can edit the same accounts and data); when you direct us to; if required by law, legal process or to protect the rights, safety or property of our users or others; and with a successor if Enoki Labs is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

How we protect information

Data is encrypted in transit (TLS) and at rest. Access tokens for your connections are stored encrypted in a secrets vault and are never sent to your browser or device. Each household's data is isolated in the database, and two-step sign-in is available. See our Security page for details. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach as required by law.

Retention and deletion

We keep your information while your account is open. When you disconnect an account, we stop receiving new information from it and revoke our access; information already imported stays in Lasa until you delete it. When you delete your account (Settings → Your data), we revoke all connections through Plaid and permanently delete your Lasa data. Copies may remain in encrypted backups for up to 30 days before they expire. We may keep limited records longer where the law requires it.

Your choices and rights

• Access and export: download your transactions or all of your data from Settings → Your data.
• Correction: edit your information in the app.
• Deletion: delete individual items, disconnect accounts, or delete your account in Settings.
• Questions or requests: email privacy@lasa.money. We respond within 30 days, and we will not discriminate against you for exercising your rights.

Depending on where you live (for example California or New Jersey), you may have additional rights to know, access, correct, delete or obtain a copy of your personal information, and to opt out of its sale, targeted advertising or profiling. We do not sell personal information or use it for targeted advertising or profiling. To make a request, email privacy@lasa.money; we may need to verify your identity. You may use an authorized agent where the law allows.

Children

Lasa is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

We will post any changes here and update the effective date. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect.

Contact

Enoki Labs LLC, New Jersey, United States
Privacy: privacy@lasa.money · Security: security@lasa.money