Security and privacy at Melvi

Melvi only reads

Melvi does not pay, transfer, or invest. No code in Melvi moves money. It reads the data you choose to bring in, does the math, and shows the result. An action suggested by Melvi, such as changing a goal, only takes effect after you confirm it.

Your bank password never passes through Melvi

The bank connection is made through Open Finance, the system regulated by Brazil's Central Bank (Banco Central), using Malvo, the company that connects Melvi to Open Finance. You log in on your bank's own environment, authorize read-only access to the data you choose, and can end the authorization whenever you want. Melvi does not receive or store your password.

Connecting is optional and only happens after you subscribe. Without a connection, you can upload a statement as a PDF, CSV, or OFX file, or fill it in by hand. This is how the Banco Central explains data sharing: Central Bank questions about Open Finance.

Each account is kept separate from the others

One person's data never reaches another's. The database only returns to each account the rows that belong to it. Automated tests try to read and write another account's data, and a change to the code goes ahead only if every one of those attempts is denied.

What is encrypted

• The connection between your device and Melvi is encrypted.
• The identifier of each bank connection is stored encrypted, with the keys kept outside the database. Melvi never receives your bank password.
• Backups are encrypted before they leave the server, and they are deleted within 30 days.

Who at Melvi can see your data

The people who operate Melvi have their own internal panel, protected by a password and a second code. Through it, they can open an account, with its transactions and chats, to handle a request from you, fix an error, or investigate fraud. Each access is recorded in a log that cannot be erased or changed.

Artificial intelligence receives only what it needs

The artificial intelligence model that writes Melvi's and Firvo's answers receives only what the question needs, never the whole document. Under the provider's terms, this content is not used to train its models, and Melvi does not use your data to train artificial intelligence either.

Melvi reads the text of a statement or a message as data. A hidden instruction in a file does not change what it does or who it shows the data to.

Where your data is kept

Melvi's database and servers are in Brazil. Some providers work from other countries: artificial intelligence, email delivery, payments, and website protection are in the United States, and error tracking is in Germany. The full list, with what each one receives, is in the privacy policy.

Your data is yours

No data is sold, and your financial data serves only Melvi. Under Brazil's General Data Protection Law (LGPD), you can confirm that we process your data, access it, correct it, move it to another service, request its deletion, and revoke authorizations.

• You can export and delete your data in the app, under Profile, Privacy and your data.
• When you delete your account, your data is erased within 5 business days. Only the payment records that the law requires us to keep remain.
• Uploaded statement files are deleted 7 days after the reading ends.
• Other requests about your data go to contact@meetmelvi.com.

The details are in the privacy policy and the terms of use.

How to recognize a scam

No one at Melvi asks for your password, verification code, Pix payment, or full card details, through any channel: email, message, phone, or social media. If someone asks in Melvi's name, don't reply. Report it to contact@meetmelvi.com.

If you find a security flaw

Tell us at contact@meetmelvi.com, with the steps to repeat the problem. Don't use the flaw to view, copy, change, or delete data, don't harm the service, and don't tell anyone until it is fixed. Melvi will not take legal action against anyone who reports a flaw in good faith, within these rules.

Deliberately testing Melvi's security, probing the system, and reverse engineering remain prohibited by the terms of use.