Mambo Privacy Policy

Version 1.1 · Effective October 16, 2026 · Last updated October 16, 2026

1. Overview

Mambo is the financial intelligence system built around your household. It brings your accounts, your income and your plans into one picture, and tells you plainly what is changing and where you are heading. Mambo is in an invite-only early-access beta.

This policy rests on one promise about your data:

Your data is yours. Nobody sees it but you and Mambo. Nobody at Mambo opens it without your permission. We never sell it. We never use it for research.

In this promise, "Mambo" includes the processors that handle household data for us under contract, and Section 9 names each of them. Nobody at Mambo, not even our founder, can log in to your bank or move your money. Section 7.2 states the only two circumstances in which household data may be opened, and Section 7.4 explains how each occasion is logged.

2. Scope and definitions

2.1 Scope

This policy explains how Mambo Money, Inc., a Delaware corporation registered to do business in New York, collects, uses, shares, protects, keeps and deletes information when you use Mambo. It applies to everyone who uses Mambo during the early-access beta. We will revise it when Mambo opens more widely.

2.2 Definitions

In this policy:

• "Mambo", "we", "us" and "our" mean Mambo Money, Inc.. Where this policy describes what Mambo shows, says or does within the Service, "Mambo" means the Service.
• "The Service" means Mambo as provided through mambo.financial and, once it is offered, through WhatsApp.
• "You" means the person using the Service.
• "Your household" means the household account in the Service that you use, and the people in it.
• "Household data" means all information the Service holds about you and your household: the information you give us, the information we receive from your financial institutions through Plaid, and the information the Service derives from both.
• "Processor" means a company that handles household data for us, under contract, and uses it only to do that work for us.
• To "open" household data means for a person at Mambo to view a household's financial or personal content (Section 7.2).

2.3 The Terms

The Mambo Early Access Terms, at mambo.financial/terms, govern your use of the Service. This policy explains how we handle household data within it.

3. Information we collect

3.1 Account information

When you create an account, you give us your name, your email address and a password. We store your password only as a one-way hash. When you sign in, we email you one-time sign-in codes. When you enter a code, we place a random token in that browser so that a code is not requested there again for 30 days. We store only a one-way hash of that token, with the dates on which it was created and expires, and nothing about which browser, device or operating system it is. We use account information to sign you in, to communicate with you and to keep your account secure.

3.2 Financial account information from Plaid

If you connect a bank or investment account, Plaid Inc. ("Plaid") sends us its balances, transactions and investment holdings, its account identifiers, and details about the financial institution. You enter your bank login in Plaid's own window, and we never see it. Plaid's own use of the connection is governed by Plaid's End User Privacy Policy, which you accept in that window and which is available at https://plaid.com/legal/#end-user-privacy-policy. We use this information to provide the Service.

3.3 Information you provide

You may add household members, goals and income details, and answer the questions the Service asks. You may upload documents, such as pay stubs and tax returns. The Service keeps the details you review and save from a document, not the document itself (Section 5.2). The Service also keeps your conversation with Mambo (Section 5.3). We use this information to provide the Service.

3.4 Information the Service derives

From the information described in Sections 3.1 to 3.3, the Service builds a picture of your household: how you earn, where you stand, how cash moves and where you are heading. It recognizes patterns in transaction descriptions, such as your employer, your lenders and your insurers, and it measures how complete your data is. Much of this picture appears on the Service's pages, and you can correct your own details in Settings. To receive everything the Service has derived about your household, write to us (Section 10). Derived information is household data, and it is deleted with the rest of your household data (Section 8).

3.5 Usage information, error reports and cookies

We record which pages of the Service you open and when, and how many questions you ask in the conversation. When something in the Service breaks, an error report is sent to our error-monitoring processor (Section 9). We use this information to find and fix problems and to keep the Service secure.

The Service sets only the cookies it needs to sign you in and to remember your browser. It sets no advertising or analytics cookies. Because nothing in the Service tracks you across other websites, a browser's "Do Not Track" signal changes nothing here.

3.6 Information from WhatsApp

If you link a phone number once Mambo on WhatsApp is offered, we receive your number and the messages you exchange with Mambo there, and we keep a record of your consent. Section 6 explains how this information is handled.

4. How we use information

4.1 Purposes

We use household data only for the following purposes:

• to provide the Service you asked for, including the analysis, categories, summaries and projections that make up your household's picture;
• to answer your questions in the conversation and to write the summaries on the Service's pages (Section 5);
• to send you sign-in codes, password-reset links, invitations and notices about this policy and the Terms;
• to find and fix problems, using error reports and counts of which parts of the Service are used;
• to keep the Service and your account secure; and
• to comply with the law (Section 7.2).

4.2 Why we use it

We use household data for these purposes because you have asked us to provide the Service to you, because protecting your account requires it, or because the law requires it. We do not use household data for any purpose this policy does not describe.

4.3 What we never do

We never:

• sell household data, or rent it to anyone;
• share it for advertising;
• use it for research;
• offer loans, underwriting or credit decisions; or
• move, hold or transfer money. The Service only reads your accounts.

4.4 Research

"Research" means studying, analyzing or sharing a household's data for any purpose beyond running that household's own Service. Counting how the Service is used, such as how often a page is opened, is part of running it and is not research.

5. How the AI works with your data

5.1 The four tasks

The Service uses an AI model provided by Anthropic, PBC ("Anthropic") for four tasks: writing the plain-language summaries and explanations on the Service's pages; answering your questions in the conversation; reading a document you upload; and suggesting a category for a transaction.

5.2 What Anthropic receives

For each task, Anthropic receives the following:

• Summaries and explanations: a briefing Mambo assembles for that answer, with names, account numbers and other identifiers removed. It may include your city and state.
• The conversation: what you type, as you typed it, and the figures Mambo looks up to answer. Account and ID numbers are removed from those figures; the names of people in your household are not yet.
• A document you upload: the whole document, or the photo of it, with every name and number on it, so it can be read. Mambo keeps the details you review and save, not the file.
• A transaction to categorize: the merchant's name as it appears on your statement, the amount and the date.

5.3 Your conversation

The Service keeps one conversation for each household, encrypted under its own encryption key. Each time you ask a question, the earlier messages are sent again so that the answer takes them into account. Do not enter passwords, codes, or account, card, Social Security or ID numbers in the conversation.

5.4 What the AI cannot do

The AI never reads the Service's database directly, and it is never given your bank login. It cannot move money or act at your bank. In the conversation, it can look up information and open pages in the Service, but it does not change anything for you. Mambo is an AI system, not a person.

5.5 Anthropic's commitments

Anthropic works for us under its commercial terms and does not train its models on your data. It keeps what it receives for up to 30 days and then deletes it, except that content its safety systems flag may be kept for up to 2 years. Anthropic's privacy policy is available at https://www.anthropic.com/legal/privacy.

6. Mambo on WhatsApp — offered after launch, by invitation

6.1 Availability

After launch, we will offer Mambo on WhatsApp to people we invite. Nothing in this Section 6 applies to you unless you link a phone number.

6.2 Meta's role

WhatsApp is operated by Meta Platforms, Inc. ("Meta"), which handles your messages with Mambo for us under Meta's business terms. Meta's servers can read these messages in order to deliver them. These chats are not end-to-end encrypted. Meta keeps message content for up to 30 days in order to deliver it, and then deletes it. Meta also knows that you message Mambo, and it handles that fact under WhatsApp's own privacy policy, available at https://www.whatsapp.com/legal/privacy-policy.

6.3 Linking your number

You link a number on the Service's website: you send a code from WhatsApp, and then confirm the link on the website. We store your number encrypted. If your WhatsApp account is set up again on another phone, Mambo pauses the chat until you confirm on the website that it is you.

6.4 Consent, and how to stop

Mambo messages you only after you have linked your number and agreed to receive messages. Mambo writes first only a few times a week, in addition to the reminders and alerts you ask for. You may stop at any time by replying STOP or by unlinking your number in Settings, and your account on the website keeps working. To prove consent, we keep a record of when you agreed and when you stopped for 4 years, with no name and no financial data in it.

6.5 What a message may carry

Never send passwords, codes, or account, card, Social Security or ID numbers. If you do, Mambo does not keep them and tells you where they belong. Upload financial documents, such as pay stubs, tax returns and statements, on the website rather than sending them by message. You may send photos of receipts or listings, and screenshots; like an upload, they go to Anthropic whole. Mambo's first message states that Mambo is an AI system, not a person. To reach a person at Mambo, write to security@mambo.financial.

6.6 What deleting your household does not reach

Deleting your household (Section 8) does not delete the chat on your phone or in your phone's backup, which is yours to delete. Meta's copy is deleted within 30 days.

7. Security, and when household data may be opened

7.1 How we protect household data

We protect household data with technical and organizational safeguards designed for its sensitivity. They include the following:

• Household data travels encrypted, using TLS 1.2 or higher, between your browser and the Service, and between the Service and our processors.
• The Service runs on Amazon Web Services in the United States, and its database is encrypted at rest.
• The most sensitive fields carry a second layer of encryption, under keys of their own held in a managed key service. Those fields are bank connection tokens, identity numbers, insurance policy numbers and your conversation.
• On every table that holds household data, a database rule ensures that one household's account can never read another's.
• Your password is required every time you sign in. A one-time code is emailed to you when you sign in on a new device or browser, which is then remembered for 30 days. Changing or resetting your password means that every browser needs a new code.

No safeguard is perfect, and we do not claim that household data can never be accessed without authorization. If a security incident affects your household data, we will notify you as the law requires.

7.2 When household data may be opened

To open household data means for a person at Mambo to view a household's financial or personal content. Mambo opens household data in two circumstances only:

• The law requires it. We open only what the law compels, and we tell you unless the law forbids it.
• A security threat to your household requires it. We open only what protects you, and we tell you at once unless the law forbids it.

We do not open household data in any other circumstance, including at your request.

7.3 Running and repairing the Service

Running the Service is not opening household data: keeping the systems running and reading record numbers, counts and error codes does not involve viewing a household's content. Problems are fixed at the level of the system. If a problem cannot be fixed that way, we do not open the household's content; we ask the household to repeat the step that failed. When you write to us for help, we answer from what you tell us. Nobody at Mambo signs in to your Mambo account as you.

7.4 The log

Each time household data is opened, we log when it happened, which of the two circumstances in Section 7.2 required it, and what was opened, and we keep each entry for 2 years. Once a month, we check every administrative access shown in our systems' activity logs against the log. Your household's entries in the log are yours to see: ask, and we will send them to you. No one outside Mambo reviews the log yet.

7.5 When these practices begin

The log and the monthly check described in Section 7.4, the 2-year activity log, and the deletion after a restore described in Section 8.3 will be in place before the first invited household joins Mambo.

8. Keeping and deleting household data

8.1 How long we keep it

We keep household data only for as long as we need it to provide the Service to you, or for as long as the law requires. Within that rule, the following periods apply:

• a remembered browser expires after 30 days (Section 3.1);
• each entry in the log of occasions on which household data was opened is kept for 2 years (Section 7.4);
• the record of your WhatsApp consent is kept for 4 years (Section 6.4);
• disaster-recovery backups are overwritten within 7 days (Section 8.3);
• Anthropic keeps what it receives for up to 30 days, or up to 2 years if its safety systems flag it (Section 5.5), and Meta keeps message content for up to 30 days (Section 6.2); and
• system logs keep internal record numbers, and in a few cases an account's name, until they expire.

8.2 Deleting your household

You can delete your entire household yourself at any time, in Settings › Security › Delete your household, by typing DELETE to confirm. You can also ask us to do it for you by writing to security@mambo.financial.

Deleting your household:

• asks Plaid to end the Service's access to your bank connections;
• destroys the encryption keys for your sensitive fields, so that their contents cannot be read again; and
• removes every record belonging to your household from the Service's database.

Deletion takes effect immediately and is permanent. The Service offers no way to undo it, and we never restore a deleted household (Section 8.3). What remains is a note that an account existed and was deleted, with no personal or financial data in it.

8.3 What deletion does not reach at once

Deletion does not immediately reach the following:

• Backups. Disaster-recovery backups of the database are overwritten within 7 days, and we never use one to restore a deleted household: if we restore a backup to recover the Service, we delete every such household again before the Service reopens.
• Anthropic's copy, which is deleted within 30 days, or kept for up to 2 years if Anthropic's safety systems flagged it (Section 5.5).
• System logs, which keep internal record numbers, and in a few cases an account's name, until they expire.
• WhatsApp, where the chat on your phone remains yours to delete and Meta's copy is deleted within 30 days (Section 6.6).

We review these practices periodically, and we update them as the Service changes.

9. Processors

We share household data only with the processors listed below. Each works for us under contract and uses household data only to do that work for us. We do not share household data with anyone else, except where the law requires it (Section 7.2). We chose these processors for their security and compliance practices.

To run the Service:

• Plaid Inc. connects your financial institutions and delivers balances, transactions and holdings. Plaid's own use of the connection is governed by its End User Privacy Policy (Section 3.2).
• Anthropic, PBC provides the AI model (Section 5).
• Amazon Web Services, Inc. provides hosting, the database and its backups, and the encryption keys.
• Amazon Simple Email Service, part of Amazon Web Services, sends your sign-in codes, password-reset links and invitations.

To support it:

• Functional Software, Inc. (Sentry) receives error reports. Error reports carry no passwords, codes, tokens, cookies, form contents, or account or Social Security numbers, and we do not attach your name or email address to them.
• Google LLC (Google Workspace) provides our email, for the messages you send us.
• Meta Platforms, Inc. will carry WhatsApp messages once Mambo on WhatsApp is offered (Section 6).

Market prices come from Financial Modeling Prep, which receives only the ticker symbols we ask about and never anything about you.

10. Your rights

Depending on where you live, you may have the right to see the personal information we hold about you, to correct it, to delete it, and to withdraw your consent. You can exercise these rights as follows:

• To see your data, including everything the Service has derived about your household, write to us and we will send you a copy. The copy is produced by the Service and delivered to you without anyone at Mambo viewing its contents.
• To correct your data, change your details in Settings, or write to us.
• To delete your data, delete your household (Section 8.2), or ask us to do it for you.
• To stop the Service reading a bank, disconnect it in Settings › Accounts, or delete your household.
• To stop WhatsApp messages, once Mambo on WhatsApp is offered, reply STOP or unlink your number in Settings.

For these requests and any other, write to security@mambo.financial. We reply within 30 days. We may ask you to send your request from the email address on your account, so that we can confirm it comes from you.

11. Children

The Service is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18. Information about a child that an adult adds to the Service, such as a child's name among the household members, is household data, and this policy applies to it in full.

12. Changes to this policy

When we change this policy, we update the "Last updated" date at the top. During the beta, we will email you before any change to how household data is used takes effect.

13. Contact

Mambo Money, Inc.
Email: security@mambo.financial