Your Privacy Matters

The table below describes the categories of personal information we collect, why we collect it, and how long we retain it.

• Provide and operate the FinancialHealth.io platform and all its features
• Calculate financial metrics (NOI, equity, cap rate, net worth, cash flow)
• Sync bank and investment account data at your direction via Plaid
• Process rent payments through Stripe Connect (we are not a payment processor and never hold funds)
• Send notifications about lease expirations, payment due dates, and alerts you configure
• Generate reports, tax summaries, and Schedule E data you request
• Improve platform features and fix bugs using anonymized, aggregated analytics
• Comply with applicable laws and respond to lawful legal requests
• Detect and prevent fraud, abuse, and security threats

We do not sell, rent, or trade your personal or financial data to any third party, ever.

We do not use your financial data for advertising, profiling, or to train AI/ML models belonging to third parties.

We share data with the following service providers under contractual data protection agreements. Each provider governs its own data practices under its privacy policy:

We do not use data brokers, ad networks, or data enrichment services.

Several features — including the AI Assistant, AI Insights, the Monthly Review, automatic transaction categorization, periodic financial briefings, and the optional AI import of PDF or photo bank statements — are powered by a trusted third-party large language model provider. Depending on the feature, our servers transmit the data described below to that provider's API to produce a response. We may change AI providers over time to use whatever best serves you; any provider is bound by equivalent contractual data-protection terms.

AI Assistant, Insights, and briefings — an anonymized, aggregated snapshot:

• Aggregated dollar totals (net worth, income, expenses, account balances by category)
• Derived ratios and percentages (savings rate, FI progress, passive coverage)
• Property metrics: type (e.g. "Single-Family"), value, equity, occupancy rate, and rent roll — no addresses
• Expense category buckets (e.g. "FOOD: $800/mo")
• Lease count and expiry proximity — no tenant names

Automatic transaction categorization:

To classify your transactions, individual transaction descriptions and merchant names are transmitted to our AI provider. This runs automatically — including a nightly background process — for transactions we cannot categorize by rules alone, and only after you have enabled AI features.

Optional statement import:

If you import a PDF or photo bank or credit-card statement, the document you upload is transmitted to our AI provider so the model can extract its transactions. Because the statement is sent as-is, it may include details printed on it such as your name, account number, or financial institution. It is used only to extract your transactions.

What is never sent to our AI provider, in any feature:

• Financial-institution login credentials or bank passwords (these never reach our servers)
• OAuth tokens or API keys
• Social Security Numbers, tax IDs, or government identifiers

Our AI provider's API terms of service prohibit using API inputs and outputs to train models. API data is retained only briefly (typically up to 30 days) for trust and safety review purposes, after which it is deleted. FinancialHealth.io does not control the provider's internal retention practices beyond these contractual terms. Data is only ever transmitted after you have explicitly enabled AI features; you can withdraw that consent at any time in Settings, which stops all further transmission.

All AI features are optional and off until you enable them. Once enabled, automatic transaction categorization and periodic briefings run in the background; if you prefer that your transaction descriptions not be processed by our AI provider, disable AI features in Settings or contact us at [email protected].

We implement defense-in-depth security. The following table describes the specific controls applied to each data category:

No security system is perfect. If you discover a vulnerability, please report it responsibly to [email protected]. We commit to acknowledging reports within 48 hours.

FinancialHealth.io does not perform tenant background checks or credit checks, does not collect Social Security Numbers, and is not a consumer reporting agency (CRA) under the Fair Credit Reporting Act (FCRA, 15 U.S.C. § 1681 et seq.). We do not obtain, generate, transmit, or sell consumer reports.

• The optional tenant "screening" fields in the app (such as an Approved / Pending / Denied status, credit score, or income) are notes you enter from your own records. We do not verify them or run any check.
• If you screen applicants using a separate third-party service, you — as the landlord or property manager — are the "user" of those consumer reports under the FCRA and are solely responsible for FCRA compliance, including obtaining written authorization from applicants and providing adverse-action notices.

We do not collect, store, process, or transmit raw payment card data. All cardholder data (card numbers, CVVs, expiration dates) is handled exclusively by Stripe, Inc., a PCI-DSS Level 1 certified service provider. Our integration uses Stripe Elements, meaning card data flows directly from your browser to Stripe and never passes through our servers. We qualify as a SAQ A merchant — the lowest-risk PCI category.

ACH bank account details for rent payments are similarly held by Stripe Connect, not by us.

Depending on your location, you may have the following rights over your personal information:

To exercise any right, email [email protected]. We will respond within 30 days (or 45 days for complex GDPR requests with notice of extension).

In the event of a security incident involving unauthorized access to your unencrypted personal data, we will:

• Notify affected users by email within 72 hours of discovery (consistent with GDPR Article 33 and U.S. state breach notification laws)
• Notify applicable state attorneys general as required by the breach notification law of your state of residence
• Describe the nature of the breach, the data categories involved, steps we've taken to contain it, and protective actions you can take

Because bank access tokens, API tokens, and OAuth tokens are encrypted with AES-256-GCM, a database breach alone does not expose plaintext values of those fields. State breach notification laws vary on whether encrypted data triggers notification obligations.

We use only functional cookies necessary to operate the platform — no advertising, behavioral tracking, or third-party analytics cookies. Specifically:

• accessToken — httpOnly, Secure, SameSite=Lax; contains your JWT access token (2-hour expiry)
• refreshToken — httpOnly, Secure, SameSite=Lax; used to obtain new access tokens (7-day expiry)

No third-party cookies, no cross-site tracking, no advertising pixels. See our Cookie Policy for full details.

FinancialHealth.io is designed for adults (18+) managing financial assets. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it promptly.

We may update this policy as our product evolves. When we make material changes, we will notify you by email and display a notice in the platform at least 30 days before the changes take effect. Continued use after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, GLBA inquiries, or to report security concerns: