Privacy Policy

Effective date: 11 November 2026

1. Who we are

proj.fi is a project-finance modelling platform for solar and battery storage projects. It is operated by ProjFi, Inc., a Delaware corporation, 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808 ("proj.fi", "we", "us").

This policy covers:

the proj.fi web application at www.proj.fi and its API;
the sign-in, access-request and consent pages;
the hosted proj.fi connector at https://www.proj.fi/api/mcp, which lets Claude and other AI assistants work on your projects (section 9);
support and feedback you send us.

It does not cover the local proj.fi MCP server you run on your own computer. That software computes on your machine, writes to your own disk, and contacts proj.fi only to check its API key.

2. Summary

Access is by approval. You need an account, an accepted NDA, and (if you have enrolled an authenticator app) two-step sign-in.
Your project numbers are calculated by proj.fi's deterministic engine on our servers or in your browser. No AI model computes a number in your model.
Data is stored in the United States.
We do not sell personal information and we do not use advertising or analytics trackers.
proj.fi never trains or fine-tunes AI models on customer data.
Every action in your organization is written to an append-only audit trail. The database is backed up daily, and independent security audit reports and expanded backup coverage are upcoming. Section 10 describes our security controls.

3. Information we collect

Email address, name and password, held by our authentication provider (Supabase Auth). Password-reset links are sent to your email address.
Authenticator-app (two-step) enrolment, if you set one up. We store which factors are verified; we do not see your authenticator's secret.
Your organization, role and membership history.
Session and refresh tokens, and the time you last signed in.

3.2 NDA acceptance

Before you can open proj.fi you accept a non-disclosure agreement. We record that you accepted it, when, and which version, and keep the full legal name you enter, your email address and your browser's user agent with that record.

3.3 Your content

Project models: inputs, saved versions, scenarios, curves, notes and calculated results.
Files you upload: workbooks for import, documents in a project's data room, deal-room documents.
Collaboration content: comments, questions and answers, approvals, share links and deal-room invitations.
Fi (the in-app analyst) sessions, when Fi is switched on for your organization: your messages, Fi's replies, reviews it raises and the changes you accept or decline.
Exports you create (for example an Excel workbook or a memo).

3.4 Accounts you connect to proj.fi

If you link a Microsoft 365 (OneDrive, SharePoint, Outlook) or Google (Drive, Gmail) account to a project, we store a refresh token for that connection in an encrypted vault and copy the files from the folder you link into the project's data room. If you approve an email or file for Fi to send or publish, we keep the approved draft and a receipt (a hash of what was sent, its status and the provider's message or file id). We do not read your inbox.

3.5 Assistants you connect to proj.fi

See section 9.

3.6 Access requests, support and feedback

Request access form: work email, organization (optional), your team, and an optional note about what you want to model. We also record where the request came from (the proj.fi website or the connector sign-in page).
Support email to support@proj.fi: whatever you include.
Send report (from a tab that stopped working): the error, your browser's user agent, the time, and a hash of the model's inputs. It never sends your input values.
Send feedback: a rating, an optional comment, an optional name and email, the application build, the page you were on, and your browser and window size.

3.7 Technical and security records

Audit log: actions in your organization (for example a project change, an NDA acceptance, a connected-app approval or a connector tool call), with who, when and which project.
Model change ledger: every input change, who made it and when.
Server logs: request metadata kept by our hosting provider for about 24 hours.
Rate limiting: we count requests per IP address and per signed-in person to stop abuse. The counters are held in memory on our hosting provider and, where our deployment is configured with a shared counter store (Upstash Redis), in that store as counter keys and counts; nothing else is sent to it.
Error records: technical details of errors, used to fix them.

3.8 Cookies and browser storage

proj.fi uses only what it needs to work:

a short-lived signed access cookie that shows you have signed in and accepted the NDA (renewed while you use the app);
your sign-in session, kept in your browser's local storage by our authentication library;
your preferences, such as light or dark theme, in your browser.

We use no advertising, analytics or tracking cookies. The sign-in page and the proj.fi application load fonts from Google Fonts, which receives your IP address and browser user agent when the font files are requested. The proj.fi website, this page, the terms and the connector help page serve their fonts from proj.fi.

4. How we use information

We use the information above to:

provide proj.fi: sign you in, enforce access, store and calculate your models, run imports, deal rooms and Fi, and serve connected assistants;
keep proj.fi secure: enforce access rules, detect abuse, rate-limit, investigate incidents and keep audit records;
answer support requests and access requests, and tell you when your access is ready;
fix errors and improve the product;
meet legal obligations.

We do not sell personal information. We do not use your content to advertise to you. proj.fi never trains or fine-tunes AI models on customer data.

5. AI processing

Every number in a proj.fi model is calculated by our deterministic engine. AI is used in these places only:

AI-assisted import reading. When it is switched on for your deployment and you start an import, parts of the uploaded workbook (its structure, labels and cell values) are sent through the Vercel AI Gateway to one model host from a fixed list (section 6). Every request asks for zero data retention, and a reply that says retention was not applied stops the reading. These are the gateway's and the hosts' stated policies, not a proj.fi guarantee. If the reading is off, nothing from your workbook reaches an AI service.
Fi, the in-app analyst. When Fi is switched on for your organization and a question needs a model, your request and the selected project context are sent through the same gateway, under the same host list and zero-retention request.
Direct import mapping (older import path). Sends workbook content to Anthropic only when the deployment carries a confirmed zero-retention arrangement with Anthropic. Without it, nothing is sent.

The hosted connector (section 9) makes no AI model call of its own. The assistant you connect is your AI provider, under your agreement with it.

6.1 Service providers

Provider	What it does for proj.fi	What it receives	Location
Supabase	Database, sign-in (including sign-in and password-reset emails), file storage, and the sign-in (OAuth) server for connected assistants	All stored data	AWS us-east-1 (US)
Vercel	Hosting and serverless functions	All application traffic; request logs (about 24 hours)	US East
Vercel AI Gateway	Routes AI requests for import reading and Fi (section 5)	The content of those requests	Not published by Vercel
Model hosts reached through the gateway	Run the AI model for one request	The content of that request, with zero retention requested	Not published per request
Anthropic (direct)	Older import-mapping path, only under a confirmed zero-retention arrangement	Workbook content for that import	US
Upstash	Shared rate-limit counters, where configured for the deployment (section 3.7)	Counter keys (an IP address or user id) and counts	Not published per deployment
Google Fonts	Font files for the sign-in page and the application	IP address and browser user agent	Google

Model hosts the gateway may use, as listed in our subprocessor register: Alibaba Cloud, Anthropic, Amazon Bedrock, Baseten, DeepInfra, DigitalOcean, Fireworks AI, Google Vertex AI (Claude models only), Modal, Morph, Parasail, Together AI, TypeSafe AI and Wafer. Model makers whose models may be named: Z.ai, Anthropic and TypeSafe AI.

Email you send to support@proj.fi or security@proj.fi is received in proj.fi's mailboxes and read by proj.fi staff.

Each of these providers' data processing terms forms part of its service terms with us.

Members of your organization, according to their role and NDA acceptance.
Recipients of a share link or deal-room invitation you create. Share links return a copy of the model redacted to the recipient's role.
Assistants you connect (section 9) and Microsoft or Google accounts you link (section 3.4).

6.3 Other disclosures

We disclose information when the law requires it, to protect proj.fi, our users or others from harm or fraud, or as part of a merger, acquisition or sale of assets, with notice to you.

7. Where data is stored

proj.fi stores customer data in the United States: the database, sign-in and files in Supabase on AWS us-east-1, and the application in Vercel's US East region. It runs in one region with no standby. The AI gateway and its model hosts do not publish the location of each request. Microsoft and Google connections serve from the region of your own tenant or account.

8. How long we keep information

There is no customer-configurable retention period today. Unless stated below, we keep information until you or your organization delete it, or until you ask us to erase it.

Information	How long
Projects, versions and their dependent records	Until deleted. Deleting a project removes it and its dependent database records. Files in storage are not removed by that delete today; ask us to remove them.
Uploaded import workbooks and data-room files	Until removed by us on request. No automatic expiry today.
Fi sessions (messages and replies)	90 days by default; your organization can set 1 to 365 days. Shared working cases and approved records last as long as the project.
Raw AI replies kept to diagnose imports	Kept for up to 30 days after the import and then removed, by our cleanup sweep where it is enabled or by hand. Ask us to remove them sooner.
Excel files created through the connector	Download link valid 1 hour. The file is removed after 24 hours, the next time a file is exported or uploaded for that project.
Audit log and model change ledger	Kept indefinitely as an evidence record. Ledger content can be erased on request; we keep a record that the erasure happened.
Connected-app records (section 9)	Until your account or organization is deleted. Revoking a connection ends it at once and keeps the record, marked revoked.
Account, NDA acceptance and organization membership	Until your account is removed.
Access requests and feedback	Until you ask us to delete them.
Server logs	About 24 hours, held by our hosting provider.
Backups	The database provider's daily backups, kept 7 days. A deleted record can remain in them until they age out. Uploaded files are not in them.

9. Connected apps (Claude and other assistants)

You can connect Claude, or another assistant that supports the Model Context Protocol (MCP), to proj.fi at https://www.proj.fi/api/mcp. The help article Use proj.fi from Claude describes setup, permissions and limits.

9.1 How you connect

You add proj.fi to your assistant.
Your assistant sends you to proj.fi to sign in with your own proj.fi account: password, two-step sign-in if you have it, and the NDA.
proj.fi shows you which app is asking and lets you choose what it may do: Read projects or Read and propose changes. proj.fi only connects Claude and apps on your own computer; it refuses other destinations.
You approve, and your assistant receives a sign-in token for your account.

Sign-in uses OAuth 2.1 run by our authentication provider, Supabase. The only account detail the token asks for is your email address; your assistant also receives a refresh token so it can stay connected.

9.2 What a connected assistant can do

Read the projects you can already open in proj.fi, in your own organization, under the same access rules as the app.
Calculate with proj.fi's engine: results, sensitivities, scenarios, debt sizing, memos and charts. What-if values an assistant passes for a calculation are used for that one calculation and never saved.
Create an Excel file of a project's model in that project's private storage, with a download link valid for one hour.
Calculate a new model from proj.fi's standard starting values with the values the assistant passes. Nothing is saved.
Create an inputs link, only if you chose Read and propose changes: a proj.fi inputs share link holding that model's inputs, owned by you, expiring after 30 days, and revocable under Share inputs ▸ Manage share links. Anyone with the link can load those inputs; each time it is opened we record when, whether it was served, and the reader's account if signed in. It is the same link the app's Copy share link creates.
Propose input changes, only if you chose Read and propose changes, and only where Fi is switched on for your organization. A proposal is stored as a review in your Working model. Nothing in your model changes until you open the review in proj.fi and accept it. Your Base model is never written.

The connector has no document reader. Documents you give your assistant (for example the text of a PPA) are read by the assistant itself; proj.fi receives only the values it proposes, as a proposal you review, and stores no document text.

A connected assistant cannot write to proj.fi's database tables directly (an inputs link is created through the same function the app uses, and only on a Read and propose changes connection), cannot read tables outside a fixed list needed for these tools, cannot reach files, and cannot change project sharing, members or settings.

9.3 What proj.fi records

The connection: the app's id and name, where it returns you after sign-in (for example claude.ai), the access you chose, when you approved it, whether you used two-step sign-in to approve, a fingerprint of your enrolled authenticator factors (so a change ends the connection), when it was last used (at most hourly), and when it was revoked.
Each tool call: an audit entry, written to your organization's audit log with you as the actor, the app, the tool name, the project, the outcome and how long it took. We never record the arguments, the values or the results.
Approve, deny and revoke decisions, in the same audit log.
Proposals: the review and the proposed values, stored with Fi's records for that project.
Excel files: as in section 8.

proj.fi does not see your conversation with your assistant, your assistant's memory, or anything you did not send to a proj.fi tool.

9.4 Your assistant's provider

What you send to your assistant, and the results proj.fi returns to it, are processed by your assistant's provider (for example Anthropic for Claude) under your agreement with that provider. proj.fi is not responsible for how that provider handles data. Review its privacy terms before you connect.

9.5 Ending a connection

Open Settings → Connected apps in proj.fi and choose Revoke. Access ends at once: proj.fi checks the connection on every request. Removing proj.fi inside your assistant stops the assistant from using it but does not remove the connection in proj.fi; revoke it in proj.fi too.

A connection also stops working when:

you leave or change organization;
your NDA acceptance is no longer on file;
you add or remove an authenticator factor;
your sign-in session reaches its maximum age of 7 days;
for accounts with two-step sign-in, 30 days pass since you last confirmed the connection.

9.6 Cost

proj.fi makes no AI model call to serve connector tools. Results come from the deterministic engine.

10. Security

TLS on every connection, with HSTS preloaded.
Encryption at rest by our database provider (AES-256). We do not add our own encryption layer.
Row-level security on every table in the application schema, so organizations are isolated. Reading an organization-mate's model also requires an accepted NDA.
Two-step sign-in with an authenticator app is available. proj.fi does not require it for every account.
Audit trails: an append-only audit log and model change ledger record who did what, when, and on which project.
Daily database backups, kept for seven days.
Connected assistants are limited as described in section 9.

Upcoming: independent security audit reports, and expanded backup coverage including uploaded files. Every model can also be downloaded at any time as an Excel workbook and as an inputs file you can import again.

Report a vulnerability to security@proj.fi (also published at /.well-known/security.txt).

11. Your choices and rights

You can:

read and export your models at any time from proj.fi;
delete projects you own in proj.fi;
revoke connected apps and linked Microsoft or Google accounts in Settings;
ask us to access, correct, export or delete your personal information, or to erase a project's ledger content, by emailing support@proj.fi. We answer within 30 days.

Some deletions are manual today. There is no self-service account deletion; we remove accounts on request. Where your account is part of a customer organization, we may need that organization's instruction.

12. Children

proj.fi is a professional tool and is not directed to anyone under 18. We do not knowingly collect information from children.

13. Changes to this policy

We will post changes here with a new effective date. If a change materially affects how we use personal information, we will tell account holders by email before it takes effect.

14. Contact

Privacy and account requests: support@proj.fi
Security reports: security@proj.fi
Postal address: ProjFi, Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, United States