Privacy Policy

Information we collect

• Identity & account data: your name and email address, and authentication data used to secure your account.
• Financial account data (via Plaid): when you connect a financial institution, we receive account balances, transactions, investment holdings, and account/institution names. We use Plaid Inc. to securely connect to your financial institutions; we do not receive or store your bank login credentials.
• Usage & device data: basic technical data (e.g. logs) needed to operate and secure the Service.

The Service is read-only with respect to your financial accounts: it can view data to power your dashboards, but it cannot move money or change your bank account details.

How we use your information

• To provide the Service: aggregate your accounts, track spending and budgets, and show investment and net-worth insights.
• Automated categorization & insights (AI): to categorize transactions and generate insights, we send limited transaction details (such as merchant name and amount — not your account credentials) to our AI provider, Anthropic (Claude). This data is processed to return a category or insight and is not used to train third-party models.
• To communicate with you (e.g. transactional email).
• For billing, where applicable (processed by Stripe).
• For security, fraud prevention, and to comply with legal obligations.

How we share information

We do notsell your personal information. We share it only with service providers (“subprocessors”) who process it on our behalf, under contract, to operate the Service:

We may also disclose information if required by law or to protect rights, safety, and the integrity of the Service.

Plaid

We use Plaid to connect your accounts. By using the Service to link an account, you also agree to Plaid’s End User Privacy Policy, available at plaid.com/legal.

Data security

We protect your data with encryption in transit (TLS 1.2+) and at rest, and we additionally encrypt third-party access tokens at the application level. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.

Data retention & deletion

We keep personal and financial data only as long as needed to provide the Service and meet legal obligations. You can disconnect any linked institution at any time from within the Service, which revokes the connection and deletes the associated access tokens.

Deletion is self-serve and immediate. From Settings you can permanently erase all of your household’s financial data while keeping your login, or delete your entire account — every household member, every record. Both take effect as soon as you confirm; there is no grace period and nothing is kept for recovery. If you would rather not do this yourself, you may request deletion by contacting team@hisharvest.ai; we will process verified requests within 60 days.

Either way, a small amount of information survives deletion where the law requires it: billing records we must retain for accounting, and an anonymised activity log entry noting that a deletion occurred.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of your personal information, and to withdraw consent. To exercise these rights, contact team@hisharvest.ai.

Children's privacy

The Service is not directed to individuals under 18, and we do not knowingly collect their information.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date and, where appropriate, by notifying you.

Contact

Questions or requests: team@hisharvest.ai. This policy is governed by the laws of Georgia, United States.