Privacy Policy

1. Information We Collect

We collect information that you provide directly to us, as well as information collected automatically when you use our platform.

1.1 Personal Information

• Account Information: Name, email address, password, phone number
• Profile Information: Date of birth, address, employment status
• Identity Verification: Social Security Number (last 4 digits), government ID for verification purposes
• Payment Information: Credit/debit card details, billing address (processed securely by Stripe)

1.2 Financial Information

• Credit Information: Credit reports, credit scores, credit history from Experian, Equifax, and TransUnion
• Financial Accounts: Bank account information, investment accounts (when you connect via Plaid)
• Debt Information: Student loans, mortgages, credit card balances
• Income Information: Salary, employment details, income sources
• Transaction Data: Spending patterns, bill payments, transfers

1.3 Usage Data

• Device information (browser type, operating system, device ID)
• IP address and approximate location
• Pages visited, features used, and actions taken
• Time and date of visits
• Referring websites and search terms
• AI chat interactions and queries

1.4 Documents and Communications

• Uploaded documents (credit reports, ID documents, financial statements)
• Dispute letters and correspondence
• Customer support communications
• Feedback and survey responses

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing Our Services

• Create and manage your account
• Analyze your credit reports and provide insights
• Generate AI-powered dispute letters and recommendations
• Track your financial goals and progress
• Provide investment analysis and portfolio insights
• Process payments and manage subscriptions

2.2 Improving Our Platform

• Analyze usage patterns to improve features
• Train and improve our AI models (using anonymized data)
• Conduct research and development
• Fix bugs and technical issues

2.3 Communications

• Send transactional emails (account updates, receipts)
• Provide credit monitoring alerts
• Send marketing communications (with your consent)
• Respond to customer support inquiries

2.4 Security and Compliance

• Detect and prevent fraud and unauthorized access
• Comply with legal obligations
• Enforce our Terms of Service
• Protect our rights and the rights of others

3. Information Sharing and Disclosure

We may share your information in the following circumstances:

3.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform:

• Stripe: Payment processing and subscription management
• Supabase: Database hosting and authentication
• AWS: Cloud infrastructure and document storage
• AIML API: AI model access for analysis and recommendations
• Resend: Email delivery services
• Plaid: Financial account connections

3.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process or government requests
• Protect and defend our rights or property
• Prevent fraud or illegal activities
• Protect the safety of users or the public

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4. Data Security

4.1 Technical Safeguards

• Encryption: 256-bit TLS encryption for data in transit; AES-256 encryption for data at rest
• Authentication: Secure password hashing (bcrypt/argon2), multi-factor authentication (MFA)
• Access Controls: Role-based access control (RBAC), principle of least privilege
• Monitoring: Real-time threat detection, audit logging, intrusion detection systems

4.2 Organizational Measures

• Regular security audits and penetration testing
• Employee security training and background checks
• Incident response procedures
• Data minimization practices

4.3 Compliance Certifications

• SOC 2 Type II certified
• GDPR compliant
• CCPA compliant
• PCI DSS compliant (for payment processing)

5. Your Rights (GDPR & CCPA)

Depending on your location, you have specific rights regarding your personal data.

5.1 Rights Under GDPR (European Users)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

5.2 Rights Under CCPA (California Residents)

• Right to Know: Know what personal information is collected and how it is used
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell your data)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

5.3 How to Exercise Your Rights

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience.

6.1 Types of Cookies We Use

• Essential Cookies: Required for platform functionality (authentication, security)
• Performance Cookies: Help us understand how users interact with our platform
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Measure platform performance and usage patterns

6.2 Managing Cookies

You can control cookies through:

• Browser settings (disable or delete cookies)
• Our cookie consent banner (when you first visit our platform)
• Account settings (manage analytics preferences)

7. Third-Party Services

We use trusted third-party services to operate our platform. Each has their own privacy policy:

8. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

• Account Data: Retained while your account is active; deleted within 30 days of account closure
• Financial Data: Retained for 7 years for tax and regulatory compliance
• Usage Data: Retained for 2 years for analytics purposes
• Dispute Records: Retained for 7 years per FCRA requirements
• Audit Logs: Retained for 3 years for security purposes

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we use appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all third-party providers
• Ensuring recipients provide adequate protection levels

10. Children's Privacy

We do not knowingly collect personal information from children under 18. If we discover that we have collected personal information from a child under 18, we will delete it immediately.

If you believe a child has provided us with personal information, please contact us at privacy@fynvita.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date at the top of this page
• For significant changes, we will notify you via email or a prominent notice on our platform
• We encourage you to review this policy periodically for any changes

Your continued use of Fynvita after any changes indicates your acceptance of the updated policy.

12. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us: