Year-End Tax Planning: Streamline your tax letters →

Privacy Policy

Effective Date (New Users): September 18, 2026

Effective Date (Existing Users): October 18, 2026

1. Introduction

Fin Pods AI Inc (“Fin Pods AI”, “we”, “us”, or “our”) is committed to protecting the privacy and security of the data entrusted to us. This Privacy Policy explains how we collect, use, process, and safeguard information in connection with the Services. This Privacy Policy is designed to help our Clients and End-Clients (as both terms are defined in Section 2, and each, “you” or “your”) understand our data practices and to assist them in meeting their own compliance obligations. This Privacy Policy is incorporated by reference into, and forms part of, our Terms of Service found at https://finpodsai.com/terms_of_service/ (the “Terms”). Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms. In the event of a conflict between this Privacy Policy and the Terms with respect to the processing of Personal Information, this Privacy Policy will control.

Our Two Roles. We process information in two distinct capacities. With respect to most information that End-Clients submit through the Services, we act as a Service Provider to the Client, and the Client determines the purposes and means of the processing. With respect to a narrower set of information (including Client registration and billing information, information collected automatically through our public website, and information submitted to the Learning Services, the Shared Library, or the Template Marketplace), we determine the purposes and means of processing ourselves. Sections 15, 16, and 17 explain what this distinction means for anyone exercising privacy rights.

Effective Dates. With respect to Clients and End-Clients who first access the Services on or after the “Effective Date (New Users)” above, this Privacy Policy will apply as of such date. With respect to Clients and End-Clients who accessed the Services before that date, this Privacy Policy will replace the prior version for them, and be effective for them, as of the “Effective Date (Existing Users)” above. Section 14 further describes how we make, and notify of, changes to this Privacy Policy.

Which Sections Apply to Whom. Sections 1 through 15 and Sections 18 and 19 apply to everyone who uses the Services, including the routing rule and request procedures in Section 15. Section 16 contains additional disclosures for residents of California. Section 17 contains additional rights and disclosures for residents of other U.S. states.

2. Certain Definitions

  • “Aggregated Data” means data and information related to Clients’ or End-Clients’ use of the Services that is used by us in an aggregate and anonymized manner, including to compile statistical and performance information related to the provision and operation of the Services and for preparing reports for marketing, advertising, and similar purposes.
  • “Business” has the meaning given to it in the CCPA.
  • “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with its implementing regulations, each as amended from time to time.
  • “Client” means any advisory firm or financial professional (including any Registered Investment Adviser) who subscribes to the Services.
  • “Client Data” has the meaning given to it in the Terms.
  • “End-Client” means an individual client of a Client whose information is processed through the Services.
  • “GLBA” means the Gramm-Leach-Bliley Act and its implementing regulations, each as amended from time to time.
  • “Governmental Authority” means any federal, state, local, or foreign government or political subdivision thereof, or any agency or instrumentality of such government or political subdivision, or any self-regulated organization or other non-governmental regulatory authority or quasi-governmental authority (to the extent that the rules, regulations, or orders of such organization or authority have the force of any Law), or any arbitrator, court, or tribunal of competent jurisdiction.
  • “IRS Transcript Data” has the meaning given to it in the Terms.
  • “Law” means any statute, law, ordinance, regulation, rule, code, constitution, treaty, or common law, any order, writ, judgment, injunction, decree, stipulation, award, or determination entered by or with any Governmental Authority, or other requirement or rule of law of any Governmental Authority.
  • “Personal Information” means any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, whether that information is provided by a Client or an End-Client into or through the Services, collected by us automatically, or obtained by us from another source. Personal Information does not include Aggregated Data or other deidentified or aggregated information, publicly available information, or information excluded from the scope of applicable privacy Laws.
  • “Sensitive Personal Information” means Personal Information that is treated as “sensitive personal information” under the CCPA, including Social Security numbers, driver’s license and other government identification numbers, financial account numbers and account log-in credentials, precise geolocation, and the contents of certain communications.
  • “Service Provider” has the meaning given to it in the CCPA, and includes, where applicable, a “processor” or “data processor” as those terms are used under other applicable privacy Laws.
  • “Services” has the meaning given to it in the Terms and includes our secure file sharing, intelligent file renaming, and structured data extraction functionality, Financial Planning Builder, the Shared Library, the Template Marketplace, the Learning Services, the IRS transcript retrieval functionality, and our software, platforms, tools, and websites.
  • “UGC” has the meaning given to it in the Terms.
  • “U.S.” means the United States of America.
  • “Zero-Access Encryption” has the meaning given to it in the Terms, and refers to the optional mode under which data you upload is encrypted with a key held solely by you and is not readable by Fin Pods AI.

3. Information That We Process

With respect to information that End-Clients submit through the Services, we act as a Service Provider (and, under privacy Laws that use that terminology, as a “processor”) on behalf of our Clients, who are the Business (and, under privacy Laws that use that terminology, the “controller”). We process that information only pursuant to our written contract(s) with the applicable Client and only for the purposes specified in that contract, and we do not retain, use, or disclose such information for any other purpose or outside our direct business relationship with the Client. With respect to the information described in the first, third, fourth, and fifth bullets below, we determine the purposes and means of processing ourselves.

  • Information Provided by our Clients (e.g., Advisory Firms): We collect limited information necessary to manage our business relationship, including advisor names, email addresses, business contact information, and payment information.
  • Information Provided by End-Clients: Through a secure portal branded for the Client, End-Clients may upload documents containing sensitive Personal Information, such as names, addresses, Social Security Numbers (SSNs), account numbers, financial holdings, and income data.
  • Information Collected Automatically: When you visit our website or use the Services, we and our analytics providers automatically collect log and telemetry data, including Internet Protocol address, browser and device type, operating system, referring and exit pages, pages viewed, features used, timestamps, and approximate location inferred from Internet Protocol address. We do not collect precise geolocation. Section 12 describes the cookies and similar technologies we use.
  • Information Submitted to the Learning Services, the Shared Library, and the Template Marketplace: Users who submit UGC (including Financial Planning Builder templates and flashcards) provide account information, the content of their submissions, and, for sellers in the Template Marketplace, payout and tax information necessary for us to make payments and satisfy our information-reporting obligations. Users of the Learning Services may not be Clients or End-Clients. You should not include Personal Information of any third party in UGC.
  • Information Provided by Job Applicants: If you apply for a position with us, we collect the information contained in your application and any information you provide during the hiring process, including your name, contact information, resume, work history, and references. We use that information to evaluate your application and to comply with applicable Laws.
  • IRS Transcript Data: Where a Client uses the IRS transcript retrieval functionality, we retrieve IRS Transcript Data from the IRS at the Client’s direction and transmit it to the Client. IRS Transcript Data is “tax return” or “return” information within the meaning of Section 7216 of the Internal Revenue Code (“Section 7216”) and is subject to Section 11 of the Terms. Where we retrieve IRS Transcript Data as an IRS-authorized third party rather than under a Client’s credentials, we also collect identity-verification information from the taxpayer and retain the executed authorization and consent forms for the period the IRS and applicable Laws require. We do not use or disclose IRS Transcript Data other than as Section 7216 and the applicable consents permit.
  • Sensitive Personal Information: Documents uploaded through the Services may contain Sensitive Personal Information, including Social Security numbers, financial account numbers, and account log-in credentials. We process Sensitive Personal Information solely to perform the Services at the Client’s direction, and we do not use or disclose Sensitive Personal Information to infer characteristics about any individual.

4. How We Use Information

The information processed through our Services is used exclusively to provide, maintain, and improve the Services for our Clients as directed by them. This use includes:

  • Securely receiving and processing documents uploaded by End-Clients;
  • Performing automated tasks such as intelligent file renaming and structured data extraction;
  • Securely delivering the processed files and/or extracted data to the Client’s designated document store or making it available within the Services, per the Client’s chosen configuration;
  • Providing customer support and troubleshooting technical issues, subject to the access controls defined in Section 6;
  • Establishing, exercising, and defending legal claims, complying with our legal and regulatory obligations, and enforcing our agreements;
  • Communicating with Clients about their accounts, billing, service changes, security notices, and, for Client business contacts only, marketing communications about our own products and services, from which the recipient may unsubscribe at any time; and
  • To help us improve the Services, collecting, producing, and analyzing Aggregated Data regarding the use of our Services. Aggregated Data includes information such as feature usage, user workflow patterns, and system performance metrics. Aggregated Data does not identify, and is not reasonably capable of being associated with, any Client, End-Client, individual, household, or device, and is not Personal Information. Consistent with Section 2 of the Terms, we may make Aggregated Data publicly available and use it for research, benchmarking, industry reporting, marketing, advertising, and similar purposes. We will not include IRS Transcript Data or other tax return information in Aggregated Data except to the extent expressly permitted by Section 7216 and the regulations thereunder and, where required, pursuant to a separate written consent obtained from the applicable taxpayer. Section 16.3 describes the deidentification commitments that apply to Aggregated Data.

We have not sold and do not sell, rent, or lease Personal Information, and we have not shared and do not share Personal Information for cross-context behavioral advertising, in each case as the terms “sell” and “share” are defined in the CCPA. We will never use End-Client Personal Information for marketing or advertising purposes. For clarity, Aggregated Data is not Personal Information, and its use is governed by Section 4 above and Section 16.3 below.

5. Data Retention and Deletion

Our retention of documents and extracted data is determined by our Clients’ configuration choice:

  • Transfer & Delete (Transient Processing): When configured for this mode, our system pushes processed files to your third-party storage (e.g., OneDrive, Google Drive). You control the retention lifecycle for these transient files:
    • Immediate Deletion: Files are permanently deleted from our servers immediately after transfer.
    • Remediation Window: You may optionally configure a short retention window (e.g., up to 7 days) to allow for error checking, reprocessing, or troubleshooting. During this window, data remains encrypted. Upon expiration of this window, data is permanently deleted.
  • Zero-Access Encryption: When configured for Zero-Access Encryption, files are retained in an encrypted state on our servers. These files are encrypted with a key known only to the Client. We cannot decrypt or access this data.

Other Categories of Information. We retain the following information for the periods stated, or for such longer period as applicable Laws require: (a) Client account, registration, and billing records, for the applicable Subscription Term and 7 years thereafter; (b) log, telemetry, and security records, for 1 year; (c) support tickets and correspondence, for 5 years; (d) executed IRS authorizations, Section 7216 consents, and related records, for the period required by the IRS and applicable Laws; and (e) records that we are required to retain to comply with legal, tax, audit, or regulatory obligations, or to establish, exercise, or defend legal claims, for the period required. At our sole discretion, we may retain any of the foregoing information for longer periods pursuant to the applicable Client’s requirements communicated to us in writing. Where no period is stated, we retain Personal Information only for as long as reasonably necessary for the purpose for which it was collected.

Deletion on Termination. Consistent with Section 5.4 of the Terms, upon termination or expiration of the Terms, we will delete Client Data in accordance with the procedures described in this Section 5. This deletion obligation does not extend to: (i) UGC contributed to the Shared Library or offered through the Template Marketplace; (ii) Aggregated Data; (iii) Feedback; or (iv) records we are required to retain by Laws. We will also delete Personal Information at a Client’s direction as required of a Service Provider under the CCPA, subject to the exceptions set forth in the previous sentence.

Backups. We maintain backup copies of certain data for purposes of business continuity, disaster recovery, and protection against data-loss or security breaches or incidents, including ransomware. Such backup copies may therefore retain data that has been deleted from our active systems, and such retention will be longer than the retention of such data on our active systems. Consequently, and notwithstanding anything to the contrary in this Section 5, deleted data may, without violating this Section 5, persist in encrypted backup copies for up to 14 days before being overwritten in the ordinary course of our business and other operations.

When we delete data from our active systems in response to a valid deletion request, we take appropriate steps to ensure that the deleted data is not used or restored for ordinary business purposes. However, because certain backup copies are maintained in an immutable or otherwise protected form, we may not be able to modify such backup copies to remove particular data or a particular Client’s or End-Client’s data. Instead, all such data will remain in the backup environment until the applicable backup copy is overwritten in accordance with this “Backups” subsection of this Section 5.

6. Access to Information

Our architecture is designed to prevent Fin Pods AI personnel from accessing Personal Information.

  • All data is encrypted at rest and in transit.
  • Under Zero-Access Encryption, personnel lack the cryptographic keys to view Client data.
  • In cases where a Client authorizes technical support for a failed document parse, we may request temporary, explicit, and logged permission to access a specific document solely for the purpose of remediation. This “break-glass” procedure is an exception controlled entirely by the Client. With your permission during this process, we may create a redacted copy of the provided document, from which all Personal Information has been removed. This redacted, anonymized data may be retained solely to help us improve the accuracy and performance of the Services. Once the remediation is complete, our access to the original document is revoked.

7. Security Measures

We implement and maintain robust administrative, technical, and physical security measures to protect the confidentiality, integrity, and availability of all data processed. These measures include:

  • Bank-Grade Encryption: AES-256 encryption for data at rest and TLS 1.2+ for data in transit.
  • Cloud Security: Services are hosted on Amazon Web Services (AWS), leveraging its world-class security infrastructure.
  • Access Controls: We enforce the principle of least privilege for all personnel and systems.
  • Authentication: Client access to our platform is protected with optional Two-Factor Authentication (2FA) and Single Sign-On (SSO).
  • Security Incident Notification: Consistent with Section 7 of the Terms, we will notify the affected Client without undue delay after becoming aware of any unauthorized access to or disclosure of Client Data in our possession, and we will provide the information reasonably necessary for the Client to meet its own notification obligations. We will provide that notice no later than seventy-two (72) hours after we become aware of the incident, so that Clients subject to Regulation S-P, the FTC Safeguards Rule, or comparable requirements can meet their own deadlines. Where we are required to give notice directly to affected individuals or to a regulator, we will do so in accordance with all applicable state and federal data breach notification Laws.

No website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of Personal Information transmitted to, through, or in connection with the Services. In particular, email, text messages, and chat sent to or from the Services may not be secure, and you should consider carefully what information you send through those channels. The safety and security of your information also depends on you: you are responsible for safeguarding your credentials, for configuring the Services appropriately, and, where you use Zero-Access Encryption, for the safekeeping of your Master Key.

8. Use of Artificial Intelligence (AI) for End-Client Data

AI Features Optional. Usage of our AI features is strictly optional and is not required to access or use our Services. If you choose to opt-in, we use proprietary AI models to perform specific tasks, such as document recognition, data extraction, and file organization. End-Client data is used to process that End-Client’s own documents. Consistent with Section 7 of the Terms, we do not use, and do not permit our subprocessors to use, Client Data or UGC to train AI Tools except as you expressly authorize in writing. For clarity, the foregoing restriction does not apply to Aggregated Data. Our AI processes are subject to the same strict security and confidentiality controls as all other parts of the Services.

Automated Decision-Making. We use AI Tools to recognize, extract, organize, and summarize information. We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning any individual, including decisions about the provision or denial of financial or lending services, housing, education, employment, or healthcare. Outputs of AI Tools may be inaccurate or incomplete and must be independently reviewed by the applicable Client or End-Client before being relied upon.

9. Disclosure of Information

Permitted Disclosures. We will not disclose Personal Information to third parties except in the limited circumstances described below:

  • To Comply with Legal Obligations: We may disclose information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, subpoena, or other legal process.
  • To Enforce Our Rights and Prevent Harm: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.
  • To Service Providers and Subprocessors: We disclose information to third parties that perform services on our behalf, including cloud hosting, payment processing, analytics, customer support tooling, and third-party providers of AI Tools. We disclose information to these recipients only under written contracts that specify the limited and specified purposes of the disclosure, require the recipient to keep the information confidential, prohibit the recipient from selling or sharing the information or using it for any purpose other than performing the contract, and otherwise meet the requirements the CCPA and applicable privacy Laws impose on contracts with service providers and contractors.
  • Business Transfers: If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, information may be transferred as part of that transaction. We will require the recipient to honor this Privacy Policy with respect to the transferred information, and we will notify Clients before any transfer that would cause their information to become subject to a materially different privacy policy.
  • At the Client’s Direction: We disclose End-Client information to the Client that directs the processing and to any third party that the Client instructs us to transmit it to, including the Client’s designated document store.
  • With Your Consent: We may disclose your Personal Information for any other purpose with your consent.

Subprocessors. Section 7 of the Terms provides that a current list of our subprocessors is maintained in this Privacy Policy. Our current subprocessors are:

Cloud Infrastructure & Security

  • Amazon Web Services (AWS): Provides cloud hosting, secure data storage, and AI infrastructure to operate our core services.
  • Cloudflare: Provides web traffic management, content delivery (CDN), and security services to protect our infrastructure and users.

Identity & Authentication

  • Google: Acts as an Identity Provider (IdP) to facilitate secure user authentication (Single Sign-On).
  • Microsoft: Acts as an Identity Provider (IdP) to facilitate secure user authentication (Single Sign-On).

Financial & Business Operations

  • Stripe: Processes payments, subscriptions, and financial transactions securely.
  • PandaDoc: Facilitates document management, contract creation, and secure e-signature processing.

CRM, Marketing & Scheduling

  • HubSpot: Serves as our Customer Relationship Management (CRM) platform for marketing automation, sales, and customer communication.
  • Cal.com: Manages user scheduling, calendar integrations, and appointment bookings.
  • Luma: Manages event registration, ticketing, and attendee communication.

Communication

  • Telnyx: Provides telecommunications infrastructure for routing automated SMS and voice communications.
  • Zoom: Facilitates video conferencing, webinars, and virtual meetings with customers.
  • Slack: Internal team collaboration and communication platform (used for internal alerts and routing that may contain limited customer data).
  • Google Workspace: Internal email, account management, meetings, and document collaboration suite (used for direct communication with customers).

We will update this list before engaging a new subprocessor that will process Personal Information, and we will notify Clients of the change in accordance with Section 14.

10. Third-Party Integrations and Authorized Agents

Third-Party Integrations. Should a Client choose to integrate the Services with a third-party application, we may share information on the Client’s behalf and at its direction to enable that connection. We are not responsible for the data privacy and security practices of such third-party services, and we encourage Clients to review their privacy policies before enabling an integration.

Authorized Agents. Section 12 of the Terms permits a Client to access the Services through Authorized Agents, including browser-based artificial intelligence agents operating under the Client’s account. You should understand what this means for information: when an Authorized Agent is used, the content displayed to the Client through the Services (which may include End-Client Personal Information and Sensitive Personal Information) may be transmitted by that Authorized Agent to the Authorized Agent’s provider’s systems, including in the form of screenshots or page text. Except with respect to Authorized Agents that are owned or hosted by us (“Fin Pods AI Agents”), the Authorized Agent provider is not our subprocessor, we do not control it, and we are not responsible for its data practices. A Client that elects to use an Authorized Agent is solely responsible for: (a) selecting and diligencing the applicable Authorized Agent provider; (b) confirming that the resulting processing is consistent with the Client’s own privacy notices and obligations (including under the GLBA and the FTC Safeguards Rule); and (c) all activity conducted through the Authorized Agent, except for activity conducted through a Fin Pods AI Agents to the extent that such activity is not the result of any act or omission by you.

11. Third-Party Websites and Links

Our Services may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

12. Cookies, Analytics, and Tracking Technologies

Cookies and Analytics. We and our analytics providers use cookies, pixels, local storage, and similar technologies on our website and within the Services. We use them for the following purposes:

  • Strictly necessary purposes, such as authentication, session management, load balancing, and security, none of which can be disabled without preventing the Services from functioning;
  • Your preferences, such as remembering your settings and configuration choices; and
  • Analytics and performance, such as understanding how the Services are used so that we can improve them. Information collected for this purpose is used to produce Aggregated Data.

We do not use cookies or similar technologies for advertising, for cross-context behavioral advertising, or to build advertising profiles, and we do not permit third parties to collect Personal Information through the Services about your online activities over time and across third-party websites. You can configure your browser to refuse cookies or to alert you when cookies are being sent, although some parts of the Services may not function properly if you do. The following paragraph describes how we respond to Do Not Track and opt-out preference signals.

Do Not Track and Opt-Out Preference Signals. California law requires us to disclose how we respond to “Do Not Track” signals. Because no common industry or legal standard for recognizing or honoring Do Not Track signals has been adopted, our website does not currently respond to them. We do not sell or share Personal Information, and we do not permit third parties to collect Personal Information through the Services about your online activities over time and across third-party websites, so an opt-out preference signal such as Global Privacy Control does not currently change how we process your Personal Information. If we ever sell or share Personal Information, we will treat a Global Privacy Control signal as a valid request to opt out.

13. Children’s and Minors’ Privacy

The Services are intended for use by financial industry professionals and their clients and are not directed to children or minors. We do not knowingly permit any individual under 18 years of age to register for an account or otherwise to provide Personal Information to us directly, and we do not sell or share the Personal Information of any individual under 18 years of age. We may process information about a minor where a Client uploads a document relating to that minor (e.g., a beneficiary designation or a custodial account statement) in which case we process it solely as a Service Provider at the Client’s direction, and the Client is responsible for any required parental consent. If you believe a child has provided us Personal Information directly, please contact us at privacy@finpodsai.com and we will delete it.

14. Changes to This Privacy Policy

Privacy Policy Updates. We may update this Privacy Policy from time to time, including as our Services change and as we continue to develop our compliance program in response to legal developments. When we do so, we will update the Effective Dates at the top of this Privacy Policy and post the updated Privacy Policy at https://finpodsai.com/privacy/. We will notify Clients of any material change at least thirty (30) days before it takes effect, by email to the address associated with the Client’s account or through the Services. Your continued use of the Services after the applicable Effective Date constitutes acceptance of the updated Privacy Policy. We will not apply a material change retroactively, and where applicable Laws require your consent to a new or materially different use of Personal Information already collected, we will obtain that consent before making the change. We encourage you to review this Privacy Policy periodically.

Reviewing and Updating Your Information. Clients may review and update their account and billing information within the Services or by contacting us at privacy@finpodsai.com. End-Clients should contact their advisory firm to review, update, or correct information the firm has submitted through the Services.

15. Privacy Requests and Our Role

Fin Pods AI is a United States-based entity that primarily serves United States-based financial professionals. This Section 15 explains the capacity in which we process information, who is responsible for responding to a privacy request about it, and how to submit one. It applies to residents of every U.S. state. Section 16 contains additional disclosures for residents of California, and Section 17 contains additional rights and disclosures for residents of certain other states.

15.1. Our Role. With respect to most Personal Information that End-Clients submit through the Services, we act as a Service Provider and the Client is the Business. State privacy Laws outside of California use different vocabulary for the same division of responsibility (i.e., where the CCPA calls us a Service Provider, those Laws may call us a “processor”, and where the CCPA calls the Client a Business, those Laws may call the Client a “controller”). We process that Personal Information only pursuant to our written contract with the Client, only for the limited and specified purposes set out in that contract, and we do not retain, use, or disclose it for any other purpose, for a commercial purpose other than performing the Services, or outside our direct business relationship with the Client. We do not combine it with Personal Information received from other sources, except as the CCPA permits. With respect to Client registration and billing information, information collected automatically through our website, information submitted to the Learning Services, the Shared Library, or the Template Marketplace, and job applicant information, we act as the Business (or, under the Laws of other states, the controller).

15.2. Requests Concerning Information We Hold for a Client. Where we hold Personal Information as a Service Provider to a Client, that Client is the Business responsible for responding to your request, and we are required to act only on the Client’s instructions. If you are an End-Client, the fastest route is to contact your advisory firm directly. If you submit a request to us instead, we will, where we can identify the relevant Client, promptly inform you that we cannot act on the request in our own right and tell you to whom you should direct it where we can do so without disclosing another person’s information. We will not deny a request solely on this basis without explaining why.

15.3. How to Submit a Privacy Request. This Section 15.3 applies to residents of every U.S. state. To exercise any right available to you under Section 17 or otherwise under any applicable Laws, you may submit a verifiable request by emailing privacy@finpodsai.com with the subject line “Privacy Request”. Please describe your request in enough detail for us to understand, evaluate, and respond to it. Only you, or a person legally authorized to act on your behalf, may make a request. If you use an authorized agent, we may require the agent to provide proof of your written permission and may require you to verify your own identity with us directly and confirm that you granted permission to the agent. We may request additional information to verify your identity, and we cannot respond to your request if we cannot verify your identity or authority. We will use any information you provide in a request only to verify the request. We will confirm receipt within ten (10) business days and will substantively respond within forty-five (45) days of receipt. If we need more time, we will inform you in writing of the reason and the extension period, which will not exceed an additional forty-five (45) days. We will deliver our response to the email address from which you made the request or to your account. If we cannot comply in whole or in part, we will explain why, subject to any legal or regulatory restriction. Our disclosures will cover the twelve-month (12-month) period preceding our receipt of the request, and we will consider requests for a longer period unless doing so would be impossible or would involve disproportionate effort. For data portability requests, we will provide the information in a readily useable format that allows you to transmit it to another entity without hindrance. We do not charge a fee to process or respond to a verifiable request unless it is excessive, repetitive, or manifestly unfounded; if we determine a fee is warranted, we will tell you why and provide a cost estimate before completing the request.

16. California Privacy Rights

16.1. Application of the CCPA to Fin Pods AI. We do not currently meet the annual gross revenue threshold under California Civil Code Section 1798.140(d) and do not buy, sell, or share the personal information of 100,000 or more consumers or households, so we do not currently qualify as a “business” thereunder. We are therefore not required to provide the notices and consumer rights that the CCPA imposes on businesses. Separately, a substantial portion of the Personal Information processed through the Services is nonpublic personal information collected, processed, or disclosed pursuant to the GLBA and its implementing regulations, or the California Financial Information Privacy Act, and is exempt from the CCPA under California Civil Code Section 1798.145(e). Additionally, the CCPA does not apply to publicly available information, lawfully obtained and truthful information that is a matter of public concern, deidentified or aggregated consumer information (including Aggregated Data), or information subject to the Fair Credit Reporting Act, the Health Insurance Portability and Accountability Act, the California Confidentiality of Medical Information Act, or the Driver’s Privacy Protection Act. Nevertheless, the CCPA imposes obligations directly on service providers (including obligations concerning the terms of our contracts with Clients, assisting Clients in responding to consumer requests, deleting and correcting Personal Information at a Client’s direction, cooperating with a Client’s reasonable assessments of our processing, and implementing reasonable security procedures and practices appropriate to the nature of the Personal Information), and we comply with them. We monitor our status against the statutory thresholds and will expand this Section 16 if we meet them. Nothing in this Privacy Policy waives any right that you have under the CCPA or other applicable Laws.

16.2. No Sale or Sharing of Personal Information. We have not sold and do not sell Personal Information, and we have not shared and do not share Personal Information for cross-context behavioral advertising purposes, in each case as the terms “sell” and “share” are defined in the CCPA. We have no actual knowledge that we sell or share the Personal Information of any consumer under 16 years of age (and, as stated in Section 13, under 18 years of age). Because we do not sell or share Personal Information, we do not provide a “Do Not Sell or Share My Personal Information” link.

16.3. Deidentified and Aggregated Information. We may collect, process, and disclose Aggregated Data and other deidentified information for any purpose, without restriction, including as described in Section 4 of this Privacy Policy and Section 2 of the Terms. When we do so, we will: (a) take reasonable measures to ensure the information cannot be associated with, or reasonably linked to, any individual, household, or device; (b) maintain and use the information only in deidentified form; (c) not attempt to reidentify the information, except as reasonably necessary to determine whether our deidentification processes satisfy applicable legal requirements; and (d) contractually obligate any recipient of such information to comply with the same restrictions.

17. Other United States State Privacy Rights

General. Residents of U.S. states other than California may have comparable rights to California residents (e.g., rights to access, correct, delete, and obtain a portable copy of their personal data, to opt out of targeted advertising, sale, and certain profiling, and to appeal a denial of a request). Several of the privacy Laws of those states contain exemptions comparable to the GLBA and other exemptions described in Section 15.3. Where we act as a processor or service provider, requests should be directed to the Client, as described in Section 15.2. Otherwise, you may submit a request as described in Section 15.3, and we will honor it to the extent that applicable Laws require. If we deny your request, then you may appeal by replying to our response, and we will inform you of the outcome within the period applicable Laws require and of your right to contact your state attorney general, to the extent that applicable Laws provide for such a right.

Consumer Health Data. The Washington My Health My Data Act, Nevada Revised Statutes Chapter 603A, and comparable Laws of certain other states regulate the collection, use, and sharing of “consumer health data”, define that term broadly, and apply without regard to revenue or data volume. Documents uploaded through the Services, and IRS Transcript Data, may contain information that those Laws treat as consumer health data. Where that occurs, we process that information solely as a Service Provider at the applicable Client’s direction, do not sell it, and do not use it for advertising.

18. International Data Transfers

The Services are hosted in the United States. As stated in Section 2 of the Terms, the Services are intended for use only by financial industry professionals located within the United States, and use of the Services from outside the United States is prohibited. We do not offer the Services to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we do not intend to process Personal Information subject to the General Data Protection Regulation or any other foreign privacy Laws. If, notwithstanding the foregoing restrictions, you access the Services from another jurisdiction, then you are transferring your Personal Information to us in the United States, and by using the Services you consent to that transfer and to our use of your Personal Information in accordance with this Privacy Policy. We will take all commercially reasonably steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

19. Contact Us

If you have any questions about this Privacy Policy, wish to exercise a privacy right, or need to send a notice under the Terms, please contact us at:

ATTN: Fin Pods AI Inc
Privacy
privacy@finpodsai.com
9741 Casper Peak Ct, Las Vegas, NV, 89117

For notices under the Terms (as designated in Section 19 of the Terms):

ATTN: Matteo Hoch, Fin Pods AI Inc,
9741 Casper Peak Ct, Las Vegas, NV 89117,
with a copy by email to privacy@finpodsai.com

For privacy requests: privacy@finpodsai.com, subject line “Privacy Request” (see Section 15.3).

For End-Clients: If your information was submitted through the Services by an advisory firm, please contact that firm first. Please see Section 15.2.