Privacy policy
Last updated 23 October 2026. This policy matches the code in the repository; every statement below can be checked there.
BankJar compares Spanish bank offers. It has no accounts, no sign-in and no database of its users. This page says what the site, the JSON API and the MCP server at https://bankjar.fabriquefutur.com/mcp handle when you use them, who receives it, how long it stays and what you can control. The operator is Ivan Zaitsev (Fabrique Futur).
Data we handle, and why
| Data | Why | Where it goes | How long |
|---|---|---|---|
| Your question, and the filters you or your AI assistant send: monthly income, balance, residency, longest commitment, banks where you already are a customer, gift preference | To rank the offers you asked about. | The server reads them from the request (the URL on the website and the REST API, the request body on MCP) and answers. They are not written to a database or a log file. | Not kept. They live in server memory while the answer is built. |
| The text of a question, only when the rule parser cannot place it | To read the filters out of your sentence with AI (see below). | The accounts hub, then Anthropic. Only the question text, cut to 500 characters. Filters sent as separate fields are not sent. | See “Providers that receive data”. |
| Your IP address, on a search that reaches the AI step | To limit AI calls to 20 per address per hour, and to give the hub a daily pseudonym for its budget. | Held in server memory for the limiter. The hub gets a pseudonym, never the address: the first 16 characters of a SHA-256 hash of address, a secret salt and the UTC date. | The counter lasts one hour and is lost on a restart. The pseudonym changes every day, so it cannot follow you from one day to the next. |
| AI filters, cached | To avoid asking the AI the same question twice. | Server memory only, filed under the lower-cased question. At most 500 entries. | 24 hours, or until a restart. |
One cookie, bj_v | To remember which of two page layouts you picked. | Your browser. It holds the letter a or b and is sent back to BankJar with each request. | One year, or until you clear it. It is set only when you use the Layout switch in the footer or open a link with ?v=. |
| Connection data (IP address, time, requested URL) held by the host | The server and the network it sits on need it to deliver pages. | The hosting provider, DigitalOcean. BankJar’s own web server writes no access log and the shared proxy in front of it has none configured. | As the provider keeps it; BankJar does not read or export it. |
| Error lines | To see when the AI step falls back to rules. | The container’s standard output: one line such as fallback to rules: timeout. It never contains your question or filters. | Three rotating files of 10 MB, then overwritten. |
BankJar never asks for your name, e-mail address, bank account or card number, passport or tax number, or a password, and you should not type them into a question. It does not collect health data or any other special category of data. Residency status (resident, NIE/TIE holder, non-resident) is used only as a filter, because some offers are closed to some groups.
What we do not do
- No analytics, advertising, tracking pixels, fingerprinting or session replay, on the site or in the API.
- No third-party scripts, and no request to another site when a page loads. The fonts are served by BankJar itself.
- No accounts and no profile of you. Two searches from the same person are not linked.
- No sale or rental of data, and no data broker. No bank pays to be ranked higher, and no bank receives your search.
- No tracking parameter is added to a link to a bank’s page. If you follow it, the bank sees that the visit came from this site (the browser sends the site’s address, not your search), as with any link.
Providers that receive data
| Recipient | What it receives | Role |
|---|---|---|
| Anthropic PBC (Claude Haiku) | The question text (up to 500 characters) and the daily pseudonym, only on an AI-assisted search. | AI processor. It turns the sentence into search filters and returns them. It handles the text under Anthropic’s commercial terms and may keep inputs and outputs for a limited time under them; see Anthropic’s privacy policy. |
| Fabrique accounts hub (run by the operator, hosted on Supabase in the EU) | The same question text and pseudonym, and a usage record per call: product name, model, token counts, cost, time. | Passes the call to Anthropic and keeps the monthly spend within a budget. The usage record does not contain the question text. It is kept as a billing record and is not linked to a named person. |
| DigitalOcean, LLC | All traffic to the server, as any host sees it. | Hosting provider. |
| Your AI assistant (for example Claude, ChatGPT or Codex) | It sends BankJar the arguments of a tool call. BankJar sees nothing else of your conversation or account. | Your own choice of service. What it does with your conversation is covered by its provider’s privacy policy, not this one. |
| GitHub, Inc. | Only what you post if you open an issue (public), and the source code that lives there. | Code host and issue tracker. |
The AI step is a fallback: the rule parser runs first on the server, and the AI is asked only when the rules cannot place the goal. If the AI is unavailable, over its limit or slow (4 seconds), the rule parser answers. When the AI is over our limit or unavailable, nothing is sent. When it is slow, the question has already been sent, and the provider handles it as the table above describes. The AI never writes a number you see; every euro figure comes from the dated data files in the repository.
Why we may use this data
For people in the EU or UK, the basis is our legitimate interest (GDPR Art. 6(1)(f)) in answering your request, keeping the free service within its budget and protecting it from abuse. We keep only what these purposes need.
Your choices
- Skip the AI. Send filters instead of a sentence: on the REST API use the parameters
goal,income,balanceand the others listed in /openapi.json; in an MCP tool call leavequeryempty. Nothing then goes to the hub or to Anthropic. - Leave personal details out of a question. BankJar does not need them.
- Delete the
bj_vcookie in your browser settings at any time. - Because there is no account and no stored profile, there is usually nothing of yours to look up or delete. You still have the rights the GDPR gives you (access, correction, deletion, objection, restriction, portability) and the right to complain to your data protection authority. Write to the contact below and we answer within one month.
Security
The site is served over HTTPS with HSTS. The salt that hashes your address is a secret kept on the server. The AI service token is kept on the server and never reaches a browser. To report a vulnerability, use GitHub’s private advisory form.
Children
BankJar is for adults who compare bank products. It is not directed at children, and it collects nothing that identifies anyone.
Changes
This page is a file in the repository, so every change is public and dated in its history. If a change widens what is collected, the date above changes and the change is described in the commit.
Contact
Ivan Zaitsev (Fabrique Futur) is the operator and the data controller for the data described here.
E-mail: dev@fafutur.com. Public questions and bug reports: GitHub issues.