Privacy Policy

We collect information you provide directly to us when you create an account, connect financial accounts, or use our services. This includes:

Account Information: Name, email address, and password (stored securely via Clerk authentication).

Financial Data: Bank account details, transaction history, bill information, and spending categories that you manually enter or authorize us to import through Plaid's secure bank connection service.

Usage Data: Information about how you interact with Valcentra, including pages visited, features used, and actions taken within the app.

Device Information: Browser type, operating system, IP address, and device identifiers for security and fraud prevention purposes.

We use the information we collect to:

- Provide, maintain, and improve the Valcentra platform and its features - Process transactions and send related information including confirmations and receipts - Send bill reminders, overdue alerts, and other financial notifications you have opted into - Respond to your comments, questions, and requests for customer support - Monitor and analyze usage patterns to improve user experience - Detect, investigate, and prevent fraudulent transactions and other illegal activities - Comply with legal obligations and enforce our Terms of Service

Valcentra uses Plaid Technologies, Inc. to connect your bank accounts. When you connect a financial institution through Plaid:

- You are subject to Plaid's Privacy Policy (available at plaid.com/legal/privacy-policy) - Plaid retrieves your account balances, transaction history, and account details on your behalf - We store only the data necessary to provide our budgeting and tracking features - We do not store your bank login credentials — these are handled exclusively by Plaid's encrypted systems - You may disconnect your bank accounts at any time from the Connect Bank page

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Service Providers: We work with third-party vendors (Plaid, Clerk, Resend, Stripe) who assist in operating our platform. These providers are contractually obligated to keep your information confidential and use it only to provide services to us.

Legal Requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

We take the security of your financial data seriously and implement industry-standard measures to protect it:

- All data is encrypted in transit using TLS 1.2 or higher - Database data is encrypted at rest - Authentication is handled by Clerk, which uses industry-standard security practices including multi-factor authentication support - Bank connections are secured through Plaid's bank-level encryption - We conduct regular security reviews and vulnerability assessments - Access to user data is restricted to authorized personnel on a need-to-know basis

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

- Account data is retained for the duration of your account and for 30 days after deletion to allow for account recovery - Financial transaction data is retained for up to 7 years to comply with financial record-keeping requirements - Usage logs are retained for 90 days for security and debugging purposes

You may request deletion of your account and associated data at any time by contacting us at [email protected].

Depending on your location, you may have the following rights regarding your personal information:

Access: You may request a copy of the personal information we hold about you.

Correction: You may request that we correct inaccurate or incomplete information.

Deletion: You may request that we delete your personal information, subject to certain legal exceptions.

Portability: You may request that we provide your data in a machine-readable format.

Opt-Out: You may opt out of marketing emails at any time by clicking the unsubscribe link in any email or by contacting us directly.

To exercise any of these rights, contact us at [email protected].

Valcentra uses cookies and similar tracking technologies to enhance your experience. We use:

Essential Cookies: Required for the platform to function, including authentication session cookies.

Analytics Cookies: Help us understand how users interact with our platform so we can improve it. You may opt out of analytics tracking in your browser settings.

We do not use advertising cookies or sell your browsing data to advertisers.

Valcentra is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at [email protected] and we will take steps to delete that information.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by:

- Sending an email to the address associated with your account - Displaying a prominent notice within the Valcentra app - Updating the "Last Updated" date at the top of this policy

Your continued use of Valcentra after the effective date of any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: [email protected] Website: www.valcentra.com Mailing Address: Valcentra, LLC

We will respond to all privacy-related inquiries within 30 days.