Privacy Policy

Overview

This Privacy Policy (the "Policy") describes the data protection practices of Budget Beginners LLC and its affiliates ("PlanWise," "we," "us," or "our"). The Policy applies to our websites and applications that link to this Policy, including our budgeting and financial planning application ("Product") and the PlanWise website, as well as related online and offline services thereto, and any services, transactions, or engagement you might have with us (collectively, the "Services").

We may change this Policy from time to time. We will make the revised Policy accessible through the Services, so you should review the Policy periodically. You can know if the Policy has changed since the last time you reviewed it by checking the "Last Updated" date at the top of this Policy. If we make a material change to this Policy, we will provide you with notice in accordance with legal requirements. By continuing to use the Services, you are confirming that you have read and understood the latest version of this Policy.

For users located in the European Economic Area (EEA), United Kingdom, or Switzerland, Budget Beginners LLC is the "data controller" of your personal data in connection with the PlanWise service.

If you have any questions or concerns about this Policy, please contact us at Support@PlanWise.app.

Table of Contents

Contact Information

Company: Budget Beginners LLC
Service: PlanWise
Support Email: Support@PlanWise.app

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at the email address above.

1. Collection, Use, and Disclosure of Information

Categories of Information We Collect

We collect information about you, including information that directly or indirectly identifies you, through your use of PlanWise. We do so:

• When you provide the information, by filling out forms or otherwise providing information through the Services
• When you create or add to your budgets and spending plans or we connect to your financial institutions in order to retrieve financial transaction data on your behalf or you provide other financial transaction data within the Product (collectively "Financial Data")
• Automatically (through cookies and similar tools) when you browse our websites and apps or interact with our communications
• When you correspond with us to receive customer support via email

Personal Information

When you create an account, we collect:

• Full name
• Email address
• Password (encrypted and never stored in plain text) - only if you use email/password authentication
• Account preferences and settings

Google Sign-In (OAuth Authentication)

PlanWise offers the option to sign in using your Google account through Google's OAuth 2.0 authentication service. When you choose to sign in with Google:

• You authenticate directly with Google using your Google credentials
• We receive limited information from Google: your email address, name, and profile picture (if available)
• We do NOT receive or store your Google password at any time
• We store a secure OAuth token that allows you to sign in without re-entering credentials
• You can revoke PlanWise's access to your Google account at any time through your Google Account settings

Important: When you use Google Sign-In, your use of Google's authentication service is governed by Google's Privacy Policy and Terms of Service, available at https://policies.google.com/privacy.

What We Request from Google: We only request the minimum permissions necessary:

• Email address (to identify your account)
• Basic profile information (name and profile picture)

We do NOT request access to your Google Drive, Gmail, Calendar, Contacts, or any other Google services beyond basic authentication.

Multi-Factor Authentication (MFA) Data

To protect your account and financial data, PlanWise requires all email/password users to enable Multi-Factor Authentication. When you set up MFA, we collect and store:

• MFA enrollment status and timestamp
• MFA verification attempts and success logs (for security monitoring)

Important Security Notes:

• MFA is managed through Supabase's native authentication system
• We log MFA verification attempts to detect and prevent unauthorized access
• MFA data is never shared with third parties or used for any purpose other than authentication
• You can reset your authenticator from your account settings if you switch devices
• If you lose access to your authenticator, contact support for account recovery assistance

Financial Information

To provide our budgeting and financial planning services, we collect and store:

• Account names and types (for example, "Checking," "Savings")
• Account balances and related balance information
• Transaction details, such as date, description, amount, and category
• Income, expenses, budgets, bill information, goals, and targets you set within PlanWise
• Information about assets, liabilities, and investment accounts that you choose to enter manually or connect through Plaid

Important: We do not receive or store your online banking usernames or passwords. Those are provided directly to Plaid.

Bank Account Connection via Plaid

PlanWise uses Plaid Inc. ("Plaid"), a third-party service provider, to enable you to connect your bank accounts to our service. When you use Plaid to link your bank accounts:

• You provide your bank login credentials directly to Plaid, not to us
• Plaid securely retrieves your account information and transaction data
• We receive read-only access to your account balances and transaction history
• We store Plaid access tokens to maintain the connection to your accounts
• We do not have access to your actual bank login credentials

Plaid's data collection and use practices are governed by Plaid's Privacy Policy, available at https://plaid.com/legal/. You can disconnect your bank accounts at any time through your PlanWise account settings.

Usage Information

We automatically collect certain information about how you use our service:

• Log data (IP address, browser type, operating system)
• Device information
• Usage patterns and feature interactions
• Session duration and frequency of use
• Pages viewed and features accessed

Payment Information

We use Stripe Inc. ("Stripe") to process subscription payments. When you subscribe:

• Your payment information (credit card details) is collected and processed directly by Stripe
• We do not store your full credit card numbers on our servers
• We receive limited payment information from Stripe (last 4 digits, card brand, expiration date)
• We store your Stripe customer ID to manage your subscription

Stripe's data handling practices are governed by Stripe's Privacy Policy, available at https://stripe.com/privacy.

Sources of Information

We collect most of the information referred to above from you directly. However, we may also collect information about you from the following third-party sources:

• Bank data vendors, such as open banking service providers and bank aggregation service providers (Plaid), which provide access to certain information about your financial accounts. PlanWise will obtain your consent before collecting information from these providers
• Advertising networks and partners
• Analytics providers
• Social media sites

Cookies, Online Analytics, and Advertising

We may use third-party analytics services on our Services to collect and analyze usage information through cookies and similar tools (such as the pages most read, time spent, search terms and other engagement data); engage in auditing, research, or reporting; assist with fraud prevention; and provide certain features to you.

Usage information of our Services is collected to compile statistical data in order to develop new and improved Services and marketing, identify popular features, and to provide you content that is of interest to you.

If you receive email from us, we may use certain analytics tools, such as tracking pixels, to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.

The use of cookies or other tracking technologies that may be placed on devices you use to access our Services by non-affiliated third parties is governed by those third parties' privacy policies.

We may combine the information collected through cookies with other information we collect about you.

How We Use Your Information

We use your information to:

Service Delivery

• Operate and maintain your PlanWise account and Money System, Roadmap, and Smart Planner tools
• Sync, categorize, and display your financial data so you can view budgets, cash flow, and projections
• Provide personalized insights and suggested structures based on the information you enter (for example, suggested envelope categories or transfer rhythms)
• Process your subscription payments and manage billing

Communication and Support

• Communicate with you about your account, updates to the Service, security alerts, and administrative messages
• Respond to your questions and provide customer support

Product Improvement and Analytics

• Analyze usage patterns in aggregated form to improve features, performance, and user experience
• Monitor and analyze service performance to enhance functionality

Security and Legal Compliance

• Detect, investigate, and prevent fraud, abuse, or security incidents
• Comply with legal obligations and enforce our Terms and Conditions

Important: We do not sell, rent, or trade your personal or financial information to third parties for their marketing purposes.

Legal Bases for Use of Your Information

The laws of some jurisdictions, including the European Economic Area ("EEA") and the United Kingdom ("UK"), require that companies only process your "Personal Data" (as that term is defined in the applicable law, like the EU General Data Protection Regulation) if they have a "legal basis" (or justifiable need) for processing your Personal Data. To the extent those laws apply, our legal bases for processing Personal Data are as follows:

• To perform our obligations pursuant to a contract (or pending contract) with you. For example, we will process your Personal Data to comply with the PlanWise Terms of Service as part of entering into a contract with you, and to honor our commitments in any contracts that we have with you.
• For our legitimate interests or the legitimate interests of others. For example, we will process your Personal Data to: operate our business and our Services; identify and fix any issues with our Services; provide customer service; secure the Services; learn more about how our customers use the Services; perform internal analytics; improve the Services and users' experiences; make and receive payments; comply with legal requirements and defend our legal rights; prevent fraud; engage in a business change (e.g., sale, merger); and to know the customer to whom we are providing Services.
• To comply with our legal obligations, such as our obligation to share data with tax authorities.
• With your consent. Where we rely on this basis, you may have the right to withdraw your consent at any time as described below.

Disclosure of Information

We disclose data to fulfill the purposes for which you provide it; to enforce or apply our Terms of Service, including billing. We may disclose or transfer information that we collect or you provide with:

Service Providers

These parties help us provide the Services or perform business functions on our behalf. They include:

• Hosting, technology and communication providers (Supabase)
• Security and fraud prevention consultants
• Support and customer service vendors

Analytics Partners

These parties provide analytics on web traffic or usage of the Services. They include companies that track how users found or were referred to the Services and companies that track how users interact with the Services.

Payment and Subscription Processors

We use Stripe to process and manage your payment for the Services.

Financial Data Aggregation Services

But only with your consent. By utilizing these services, you acknowledge that the terms of the respective privacy policies of these providers (Plaid, etc.) will apply to your use of their services. With respect to aggregating your banking and other financial accounts, you or we (with your consent) will transmit your account credentials to third-party financial data aggregation services, who will use them to link, gather and maintain your account balances, transactions, and holdings used to provide the Services.

Business Transfers

In the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal information held by us about users of the Services is among the assets transferred.

We may also disclose your information:

• To comply with any court order, law or legal process, including to respond to any government or regulatory request
• To enforce or apply our Terms of Service or terms of sale and other agreements, including for billing and collection purposes
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of PlanWise, our customers or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction
• To fulfill the purpose for which you provide it
• For any other purpose disclosed by us when you provide the information
• With your consent

Deidentified and Aggregated Data

We may de-identify and aggregate information collected in such a way that the information cannot reasonably be linked to you or your device. We may use such de-identified or aggregated data for any purposes (including testing our IT systems, research, data analysis, improving the Services, and developing new products and features) and may disclose it to our service providers.

We do not attempt to re-identify aggregated or de-identified data.

Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, in a way that produces legal effects or similarly significant effects concerning you, as defined under the UK GDPR and EU GDPR.

However, PlanWise may use algorithmic logic to categorize transactions, improve the legibility of payees, or generate spending insights, but these functions are designed to supplement spending management decisions and do not result in any automated decisions that affect your rights or legal status.

If this policy ever changes and we begin to use automated decision-making that has a significant effect on individuals, we will inform you and update this policy accordingly, including information about the logic involved and the consequences of such processing.

You have the right to object to certain types of automated processing and to request human intervention where applicable.

Data Storage and Security

Where We Store Your Data

Your data is stored using Supabase, a secure cloud database platform. Supabase infrastructure is hosted on Amazon Web Services (AWS) with data centers in the United States. Your data is encrypted both in transit and at rest.

Security Measures

We implement industry-standard security measures to protect your information:

• TLS/SSL encryption for all data transmitted between your device and our servers
• Encryption of sensitive data at rest in our database
• Secure password storage using industry-standard hashing algorithms
• Regular security audits and updates
• Access controls and authentication requirements
• Session timeout after periods of inactivity
• Rate limiting to prevent unauthorized access attempts
• Audit logging of authentication events

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information to the best of our ability.

Access Controls

Access to your personal and financial information is limited to authorized employees and contractors who need it to operate, maintain, or support the Service. All such personnel are required to protect your information and are bound by confidentiality obligations.

Third-Party Service Providers

We share your information with the following trusted third-party service providers who assist us in operating our service:

Supabase (Database and Authentication)

Hosts and manages our database infrastructure and user authentication system.

Google (OAuth Authentication - Optional)

If you choose to sign in with Google, Google authenticates your identity and provides us with your email address and basic profile information. Google's use of your information is governed by their own Privacy Policy.

Stripe (Payment Processing)

Processes subscription payments and manages billing information.

Plaid (Bank Account Integration)

Facilitates secure connections to your bank accounts and retrieves transaction data.

These service providers are bound by confidentiality agreements and are only permitted to use your information to perform services on our behalf. They may not use your information for their own purposes.

2. Data Retention

More specifically:

• We retain account data for up to 12 months after your subscription or trial expires, unless you delete your account as described below
• After deletion, we may retain your email address to be able to confirm deletion of associated data
• Notwithstanding the above, we may retain information as long as necessary to comply with our legal and regulatory obligations or in connection with any legal proceedings

If you request account deletion:

• Your account will be scheduled for deletion after a 30-day grace period
• During the grace period, you can cancel the deletion request and restore your account
• After the grace period, all your personal and financial data will be permanently deleted from our systems
• We may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention)

Note that you can request deletion of your information at any time by following the steps in the Your Rights and Choices section of this Policy.

Aggregated or de-identified information that cannot reasonably be used to identify you may be retained for analytical and product improvement purposes. We do not attempt to re-identify aggregated or de-identified data.

5. Your Rights and Choices

Rights Regarding Your Information

Depending on your jurisdiction, you may have the right to make certain requests regarding your "personal information" or "personal data" (as such terms are defined under applicable law, and collectively referred to herein as "personal information"). Specifically, you may have the right to ask us to:

• Inform you about the categories of personal information we collect or disclose about you; the categories of sources of such information; the business or commercial purpose for collecting your personal information; and the categories of third parties with whom we disclose personal information
• Provide you access to and/or a copy of certain personal information we hold about you
• Correct or update personal information we hold about you
• Delete certain personal information we have about you
• Provide you with information about the financial incentives that we offer to you, if any

As provided in applicable law, you also have the right to not be discriminated against for exercising your rights.

Please note that certain information may be exempt from such requests under applicable law. For example, we need to retain certain information in order to provide our services to you. We also need to take reasonable steps to verify your identity before responding to a request, which may include, at a minimum, depending on the sensitivity of the information you are requesting and the type of request you are making, verifying your name and email address.

Depending on your jurisdiction, you may be permitted to designate an authorized agent to submit certain requests on your behalf. In order for an authorized agent to be verified, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may also follow up with you to verify your identity before processing the authorized agent's request.

If you would like further information regarding your legal rights or would like to exercise any of them, please contact us at Support@PlanWise.app.

Depending on applicable law, you may have the right to appeal our decision to deny your request, if applicable. If we deny your request, we will provide you with information on how to appeal the decision, if applicable, in our communications with you.

Marketing Communications

You can unsubscribe from our marketing emails via the unsubscribe link provided in the emails. Please note that it may take us some time, consistent with our legal obligations, to process your request. Even if you opt out from receiving marketing messages from us, you will continue to receive administrative messages from us, such as order confirmations, updates to our policies and practices, or other communications regarding our relationship or transactions with you.

Mobile Devices

We may send you push notifications through our applications. You may at any time opt out from receiving these types of communications by changing the settings on your mobile device. Please note that if you disable such features, you may not be able to access or receive some or all of the services, content, and/or features made available via the Services.

Notice of Right to Opt Out of Sales of Personal Information and Processing/Sharing for Targeted Advertising

Although we do not engage in these practices with your financial or account data, certain laws categorize standard marketing and analytics activities as "selling" personal information or "sharing" or "processing" personal information for targeted advertising purposes – even though we never provide information in exchange for money.

If you would like to opt out of any such activities, please contact us at Support@PlanWise.app. Please note that if you have a legally-recognized browser-based opt-out preference signal turned on via your device browser, we recognize such preference in accordance with applicable law.

Notice of Financial Incentives

We may offer opportunities to receive certain services or benefits, including money to participate in surveys, sign up for communications, or other similar incentives, which may require the provision of personal information, such as registering for an account and answering surveys or providing additional feedback or information. Such opportunities could be considered a financial incentive under applicable law (each, an "Incentive Program"). Your participation in Incentive Programs is purely voluntary. When you participate in an Incentive Program, you agree to the terms of that Incentive Program, and may revoke your participation depending on the Incentive Program.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances. This means we can store your data but not use or process it further. You may exercise this right, for example, if:

• You contest the accuracy of your personal data and we are verifying its accuracy
• The processing is unlawful, but you do not want the data erased
• We no longer need the data for our purposes, but you require it to establish, exercise, or defend legal claims
• You have objected to processing and we are considering whether our legitimate grounds override yours

To request restriction of your personal data, please contact us at Support@PlanWise.app.

Your Right to File a Complaint

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority.

We encourage you to contact us first at Support@PlanWise.app so we can address your concerns directly. However, you have the right to go directly to the supervisory authority at any time.

Access and Portability

You have the right to access your personal information and request a copy of your data in a portable format.

Correction

You can update or correct your account information at any time through your account settings.

Deletion

You can request deletion of your account and all associated data at any time through your account settings.

Disconnect Bank Accounts

You can disconnect your linked bank accounts at any time, which will stop the syncing of new transaction data.

California Residents (CCPA Rights)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we have collected from you
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to non-discrimination for exercising your CCPA rights

Important: We do not "sell" or "share" your personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

European Residents (GDPR Rights)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise any of these rights, please contact us at Support@PlanWise.app.

6. Information for California Residents

If you are a California resident, you have the rights described in Section 5 above, and the following additional disclosures apply:

Categories of Personal Information Collected

We collect the following categories of personal information:

• Identifiers (name, email address, IP address)
• Financial information (bank account information, transaction data)
• Commercial information (subscription and payment history)
• Internet or network activity (usage patterns, device information)
• Geolocation data (general location based on IP address)

Business Purposes for Collection

We collect personal information for the following business purposes:

• Providing and maintaining the Services
• Processing payments and managing subscriptions
• Communicating with you and providing customer support
• Improving and developing our Services
• Detecting and preventing fraud and security incidents
• Complying with legal obligations

Categories of Third Parties

We share personal information with the following categories of third parties:

• Service providers (hosting, payment processing, analytics)
• Financial data aggregation services (with your consent)
• Professional advisors (lawyers, accountants)
• Government authorities (when required by law)

Important: We do not "sell" or "share" your personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

3. Third-Party Applications and Integrations

4. Children's Privacy

The Services are not intended for children under 13 years of age or 16 years of age for those who habitually reside in the European Economic Area or United Kingdom. No one under these ages may provide any personal data to the Services. We do not knowingly collect Personal Information from children under 13.

If you are under 13 or 16, do not use or provide any information on the Services or through any of its features, register for the Services, make any purchases through the Services, or provide any information about yourself to us, including your name, address, telephone number, e-mail address or any screen name or user name you may use.

If we learn we have collected or received personal data from a child under 13 or 16, we will delete that information. If you believe we might have any information from or about a child under 13 or 16, please contact us at Support@PlanWise.app.

Cookies and Tracking Technologies

We use essential cookies and similar tracking technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze usage patterns to improve our service
• Detect and prevent security threats

You can control cookies through your browser settings, but disabling cookies may affect your ability to use certain features of our service.

Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will delete such information from our systems.

If we learn that we have collected personal information from a child under 18 without verifiable parental consent, we will take steps to delete that information as soon as reasonably practicable.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law. We will provide information about the nature of the breach, the data affected, and steps you can take to protect yourself.

7. Transfers

The Services offered by PlanWise are operated from the United States. If you are located outside of the United States and choose to use the Services or provide information to us, you acknowledge and understand that your information will be transferred, processed, and stored in the United States, as it is necessary to provide the Services and perform the Terms of Service.

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data from the EEA, UK, or Switzerland to countries that do not provide an equivalent level of data protection, we rely on lawful transfer mechanisms such as Standard Contractual Clauses or other appropriate safeguards approved by applicable authorities.

By using our service, you consent to the transfer of your information to the United States and other countries where we operate.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying a prominent notice in our application

Your continued use of our service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

Legal Basis for Processing (GDPR)

If you are located in the EEA, our legal basis for collecting and using your personal information depends on the specific information and the context in which we collect it:

• Contract Performance: To create and manage your account, process your subscription, sync your financial data, and provide the PlanWise features you request.
• Consent: For optional activities such as marketing communications or connecting your bank accounts via Plaid.
• Legitimate Interests: To improve and secure the Service, prevent fraud, and understand how users interact with PlanWise in order to make it more helpful.
• Legal Obligation: To comply with tax, accounting, or regulatory requirements.

8. Contact Us

If you have any questions, comments, and requests regarding this Privacy Policy or our data practices, you can contact us by email at:

We will respond to your inquiry within a reasonable timeframe, typically within 30 days.