Privacy & Terms of Use

4. Information Sharing

4.1 We may share information with:

• Service providers (hosting, analytics, payment processing, bank connectivity)

  Professional advisors (legal, accounting, insurance)

• Business partners (with your consent)

• Law enforcement (when legally required)

• Successors (in case of merger or acquisition)

4.2. Artificial Intelligence

We may use AI tools to assist in survey generation, analysis, and reporting. We do not use client or participant data to train AI or machine learning models. Any AI processing is performed in accordance with our data minimization and purpose limitation principles.

4.3 We never:

• Sell your personal information

• Share data for unrelated marketing

• Transfer data without appropriate safeguards

4.4. Payment Processing (Stripe)

We use Stripe, Inc. ("Stripe") to process all payments. When you submit payment through our billing portal or invoices:

What Stripe Collects Directly:

• Card number, expiration date, and security code (CVV)

• Billing name and address

• Email address for receipts

• IP address and device fingerprint for fraud prevention

What We Receive from Stripe:

• Last 4 digits of your card (for receipt reference)

• Card brand (Visa, Mastercard, etc.)

• Payment status (success/failure)

• Transaction ID for record-keeping

Stripe's Compliance:

Stripe is certified as a PCI DSS Level 1 Service Provider — the highest level of certification in the payments industry. All card data is encrypted using 256-bit TLS and stored in Stripe's secure, PCI-compliant infrastructure. Your card information never touches our servers.

For information about how Stripe handles your data, see Stripe's Privacy Policy at stripe.com/privacy. To exercise data rights related to payment information, you may contact us or Stripe directly.

Payment Record Retention:

Transaction records are retained for 7 years in compliance with US tax and accounting requirements.

4.5 Financial Data Services (Plaid)

For users of our financial management tools (Warren), we use Plaid, Inc.

to securely connect bank accounts for balance visibility and transaction

import. When you link a bank account:

What Plaid Collects Directly:

• Account credentials (during secure OAuth flow only)

• Account and routing numbers (for verification)

What We Receive from Plaid:

• Account identifiers and institution name

• Account type (checking, savings, etc.)

• Account balances (refreshed periodically)

• Transaction history (up to 24 months)

Important:

• Bank access is READ-ONLY — we cannot move money, initiate payments,

or make transfers

• Plaid access tokens are encrypted at rest and never exposed to your browser

• You can disconnect your bank account at any time from your settings

• Transaction data is retained for 24 months on a rolling basis

Plaid's Compliance:

Plaid is SOC 2 Type II and ISO 27001 certified. For information about

how Plaid handles your data, see Plaid's Privacy Policy at plaid.com/legal.