Privacy Policy

Custolio ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Custolio website, applications, and services (collectively, the "Service"). Please read this policy carefully. By accessing or using the Service, you agree to the terms of this Privacy Policy.

1. Information We Collect

a. Information You Provide

• Account information: Name, email address, and password when you create an account (authentication is handled securely through Clerk).
• Support communications: Any information you include when contacting us for help.

b. Financial Data from Linked Accounts

When you connect a financial institution through our third-party provider, Plaid Inc. ("Plaid"), we receive read-only access to certain data, including:

• Account names, types, and balances
• Transaction history (descriptions, amounts, dates, categories)
• Investment holdings and securities information
• Institution names and identifiers

We collect this financial data only to operate the Service you request, including showing linked accounts and balances, calculating net worth and cash flow, categorizing spending, identifying recurring bills or subscriptions, and displaying investment holdings and portfolio allocation.

We request read-only access through Plaid. We do not receive or store your banking login credentials. Your credentials are handled directly by Plaid. Plaid's use of your data is governed by the Plaid End User Privacy Policy.

c. Automatically Collected Information

• Device & browser data: IP address, browser type, operating system, and device identifiers.
• Usage data: Pages visited, features used, time spent on pages, links clicked, and other interactions within the Service.
• Cookies & similar technologies: We use cookies and similar technologies to support essential Service functions such as authentication and session management. Cookies are small data files stored on your device that help us maintain your session and improve the Service. We do not use third-party advertising or tracking cookies. You can manage or disable cookies through your browser settings, though doing so may affect your ability to use certain features of the Service.

d. Information from Other Sources

When you create or log into your Custolio account through a third-party authentication provider (Clerk), we may receive information associated with your account on that platform, such as your name, email address, and profile picture, in accordance with the authorization procedures determined by that provider.

e. Information We Derive

We may derive information or draw inferences based on the data we collect. For example, we calculate your net worth from linked account balances, generate spending breakdowns from your transaction history, and compute portfolio allocation percentages from your investment holdings. These derived insights are used solely to power the features of the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Display your aggregated financial data, including balances, transactions, net worth, and portfolio allocations.
• Authenticate your identity and secure your account.
• Send you technical notices, security alerts, and support messages.
• Respond to your support requests and communicate service-related updates.
• Communicate with you about product updates, new features, and other news about the Service (you can opt out at any time; see Your Rights & Choices below).
• Monitor and analyze trends, usage, and activities to improve the Service.
• Detect, investigate, and prevent fraud, unauthorized access, or other illegal activity, and help protect the rights and property of Custolio and our users.
• Create de-identified or aggregated information that can no longer reasonably be used to identify you.
• Comply with legal and financial obligations.

3. How We Share Your Information

We do not sell, rent, or trade your personal or financial information. We may share information only in the following limited circumstances:

• Service providers: We share data with trusted third-party vendors who help us operate the Service (e.g., Plaid for account linking and read-only financial data retrieval, Clerk for authentication, our hosting and database providers for secure storage and processing, and email or support providers when we send service communications). These providers are contractually required to protect your data and use it only for the services they provide to us.
• Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or lawful requests by public authorities, including to meet national security or law enforcement requirements.
• Safety & rights protection: We may share personal information if we believe it is necessary to protect the rights, property, or safety of Custolio, our users, or the public, or to detect, investigate, or prevent fraud or other illegal activity.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With your consent: We may share information for other purposes if you provide explicit consent.

In particular, when you connect an account, Plaid processes the information needed to authenticate and maintain that connection and to deliver read-only financial data to Custolio. We do not authorize third parties to sell your personal or financial data or use it for their own advertising.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

4. Data Storage & Security

Custolio stores account records, subscription status, preferences, and linked-account metadata in hosted application infrastructure. To maintain Plaid connections, we store server-side records such as Plaid item IDs, institution names and identifiers, sync cursors, connection status information, and Plaid access tokens. We do not store your bank username or password.

Sensitive connection data is stored server-side and protected with encryption, authentication safeguards, and access controls. Financial account data shown in the app may also be cached temporarily in server memory and in your browser's session storage to improve performance during an active session.

We use industry-standard security measures including TLS for data in transit, least-privilege access restrictions, and regular security reviews. While we take reasonable precautions, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your personal and financial data for as long as your account is active or as needed to provide the Service. If you unlink a financial institution, we stop future collection from that institution and remove the stored Plaid connection record associated with that link. If you delete your account or submit a verified deletion request, we will delete or anonymize your data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements).

6. Your Rights & Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data and account.
• Port your data in a structured, machine-readable format.
• Withdraw consent where processing is based on consent.
• Unlink a financial institution at any time, which revokes our access to future data from that institution.

To exercise any of these rights, contact us at privacy@custolio.com. If we receive a request from an authorized agent, we may require evidence that you have provided that agent with valid written authority to submit requests on your behalf.

How to Request Deletion

You may request deletion of your account and associated personal data by using the Delete account control in your account settings or by emailing privacy@custolio.com from the email address associated with your account. If you only want us to stop collecting new data from a linked institution, you can unlink that institution at any time. We may ask you to verify your identity before completing a deletion request.

Communication Preferences

You may opt out of promotional emails at any time by following the unsubscribe link in those messages or by updating your notification preferences in your account settings. Even if you opt out of promotional communications, we may still send you transactional or service-related messages (such as security alerts or account notifications).

Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals to the websites you visit. Because there is no universally accepted standard for how to respond to DNT signals, we currently do not alter our data collection practices when we detect such signals. If we adopt a DNT standard in the future, we will update this section accordingly.

7. State Privacy Rights

Residents of certain U.S. states—including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and others with comprehensive privacy laws—may have additional rights regarding their personal information.

Categories of Information

In the preceding 12 months, we may have collected the following categories of personal information:

• Identifiers: Name, email address, IP address, and unique device identifiers.
• Financial information: Bank account names and types, account balances, transaction history, and investment holdings (received via Plaid in read-only mode).
• Internet or network activity: Browsing history within the Service, pages viewed, features used, and interactions.
• Inferences: Net worth calculations, spending patterns, and portfolio allocations derived from the data above.

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) grants you the right to: (1) know what personal information we collect, use, and disclose; (2) request deletion of your personal information; (3) request correction of inaccurate personal information; (4) opt out of the sale or sharing of personal information; and (5) not be discriminated against for exercising these rights.

We do not sell or share your personal information as defined under the CCPA/CPRA. We do not use your information for cross-context behavioral advertising.

Non-Discrimination

We will not discriminate against you or retaliate in any way for exercising your privacy rights under any applicable state privacy law. You will not receive a different level of service or pricing for making a privacy request.

To submit a privacy request under any state law, email privacy@custolio.com. You may be asked to verify your identity before we process your request.

8. Children's Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

9. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

10. International Users

If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of information to the U.S. and other countries that may have different data protection laws than your country of residence.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" at the top of this page and notify you via email or through a prominent notice in the Service. We encourage you to review this policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• Email: privacy@custolio.com
• Web: Terms of Service