Privacy Policy

Personal information categories, sources and uses

AI processing

1. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email address)
• Financial data you enter (income, expenses, tax documents)
• Bank account data when you connect via Plaid
• Saved financial profiles, business records, credit information, investments, goals, uploaded documents, AI messages and generated outputs
• Signed-in session activity associated with your account email: page visits, entry pages, click counts and clicked element types, timestamps, session duration and idle time
• Device information, including browser user agent, screen dimensions and language
• IP address and approximate IP-based location, including city, region, country, time zone and latitude/longitude returned by ipapi.co. Your browser contacts ipapi.co, which receives your IP address. This is an IP lookup, not device GPS.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Generate educational financial and tax estimates. The AI assistant processes messages, uploaded context and saved financial records through AI service providers to answer questions and perform authorized actions.
• Understand usage and operate the service. Session digests sent to ClearPath AI include account email, session and entry-page information, page-view counts, event types and timestamps, device type, IP-derived location, and available subscription conversion/revenue information.
• Process payments and subscriptions
• Send you technical notices and support messages
• Respond to your comments and questions

3. Data Security

We use authenticated access and record-level permissions to restrict access to personal records. Authorized operators and service providers process data to operate and support WealthGuard. Plaid handles bank authentication through ClearPath AI's bank-linking service, and Stripe handles payment details. WealthGuard does not ask you to enter banking credentials or full card numbers into its financial tracking forms. Browser and API traffic uses TLS. Account records and private files are stored by the application host, which provides encryption at rest. This repository does not keep a copy of taxpayer files. The product does not ask for a full Social Security number or a full bank account number. New uploads of W-2s and tax returns go to private storage and open with a short-lived signed URL. Files already stored at a public link are not private until an operator inventory and purge. No system can guarantee absolute security.

4. Data Sharing

We do not sell your personal information. Taxpayer information is not sold and is not disclosed for another party's own use without consent, except where the law requires a disclosure. This is a voluntary limit. The product does not file tax returns. We may share data with:

• ClearPath AI, the operator, receives session digests and operates the bank-linking middleware used by WealthGuard.
• Base44 provides hosting, authentication, data storage and integrations; AI service providers process assistant inputs and saved financial context. The AI processing notice above includes the operator-supplied provider and training details when supplied.
• ipapi.co receives your IP address for the approximate-location lookup described above.
• Plaid and connected financial institutions process bank connection requests and account/transaction information when you link a bank.
• Stripe processes checkout and payments; WealthGuard stores related customer, subscription and access records. These providers also have their own privacy and retention policies.
• As required by law or legal process
• To protect our rights or the safety of users

5. Your Rights

You may access and correct your records, download a JSON copy in Settings, and request deletion. Settings' Delete my data action attempts to delete saved financial, profile and activity records immediately and revoke bank access; the result identifies failures or partial deletion. Your login remains active. Delete my account performs the same immediate attempt and requests that support remove your login within 30 days; login removal is not immediate. A failed support notification means you must use the support form to complete the request. The Delete My Data page submits a support request only and does not immediately erase records.

6. Retention and Deletion Limits

Saved records remain available while you use the service unless deleted. The app does not apply a fixed automatic expiry to all session or financial records. Billing, subscription and entitlement records are retained after a data wipe for payment administration, access management and applicable legal obligations. Deleting app data does not itself cancel a Stripe subscription or erase Stripe's records; manage billing separately. Uploaded files, AI conversations, backups, and copies already sent to ClearPath AI or other providers are not automatically erased by deleting an app record. Ask support to coordinate removal of those copies, subject to provider retention and legal requirements. If bank revocation fails, connection records are retained for follow-up and access may remain authorized. Support processes account/login removal within 30 days of a successfully submitted request and addresses unresolved deletion failures; billing records may remain where required. Financial and profile records are kept while the account is open. After a verified deletion request, personal records are removed within 30 days. The in-app delete action attempts removal immediately and reports anything it could not finish. Subscription and payment identifiers may be kept after a data wipe so charges can be reconciled. They are not used for marketing. Application security logs are kept for about 90 days, then deleted or de-identified. A signed URL for a private file expires in two minutes and is not stored on the document row. Virginia residents can request access, correction, deletion, a portable copy, and to opt out of sale, targeted advertising, and profiling in furtherance of a decision with legal or similarly significant effects (Virginia Consumer Data Protection Act). California residents can request to know, delete, and correct personal information, and to opt out of sale or sharing (California Consumer Privacy Act). Personal information is not sold or shared for cross-context behavioral advertising.

Automatic-renewal consent records are retained while subscribed and for at least three years from consent or one year after termination, whichever is longer. The app does not automatically delete these records; they are retained for billing evidence and legal obligations even after a data wipe.

7. Contact Us

If you have questions about this Privacy Policy, use support@clearpathai.solutions.