Privacy Policy

SpendVisible LLC ("SpendVisible," "we," "our," or "us") provides a personal financial analytics service that aggregates your bank transactions and email receipts so you can see your spending at a line-item level. This Privacy Policy explains what we collect, how we use it, who we share it with, and how we protect it. If you disagree with its terms, please discontinue use of the Service.

1. Information We Collect

1.1 Information You Provide

• Account information (name, email address) provided at signup
• Billing and payment information (processed via Stripe; we do not store card numbers)
• Support communications and feedback you send us
• Corrections you make to automatic categorization or merchant data

1.2 Financial Account Data via Plaid

To pull your bank and credit card transactions, we use Plaid Inc. ("Plaid"). When you link an account, we receive:

• Transaction history (merchant name, amount, date, Plaid's category)
• Account metadata (institution name, account type, account mask)
• Account balances (current and available)

We never see or store your banking credentials — Plaid handles authentication directly with your financial institution. Your use of Plaid is also subject to Plaid's End User Privacy Policy. We use the data Plaid returns only to power the analytics, dashboards, categorization, and merchant insights you see in SpendVisible. We do not use this data for advertising, do not share it with marketers, and do not use it to train machine learning models.

1.3 Email Receipt Data via Gmail

If you connect your Gmail account, we use Google's Gmail API under the read-only gmail.readonly scope to find and parse receipt emails from merchants you have transacted with. Specifically:

• We search for receipt-shaped messages (order confirmations, shipping notifications, restaurant receipts).
• For each matched email we extract the merchant, date, total, and line items.
• We store the extracted structured data plus an internal reference to the Gmail message ID so we do not re-import the same receipt.
• We do not store the full email body, your contacts, or any other Gmail data beyond what is needed to parse the receipt.
• We never send, modify, label, or delete messages in your Gmail.

You can disconnect Gmail at any time from the Service or by revoking access at myaccount.google.com/permissions. SpendVisible's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1.4 Uploaded Receipt Images

If you upload a receipt image (JPG or PNG, up to 10MB), we store the image and process it to extract the merchant, date, total, and line items. Uploaded images are visible only to you, are tied to your account, and are deleted when you delete the receipt or your account.

1.5 Automatically Collected Information

• Log data (IP address, browser type, pages visited, timestamps)
• Device information (operating system, screen resolution)
• Usage data (features used, session duration, errors)
• Cookies and similar technologies (see Section 6)

2. How We Use Your Information

We use the information we collect to:

• Operate and improve the Service
• Connect your financial accounts and display transaction analytics
• Parse receipt emails and uploaded receipt images into structured line items
• Automatically categorize transactions and line items using an AI service (see Section 3.4)
• Enrich merchant data so you can see who you are paying
• Process subscription payments and manage your account
• Send transactional emails (sign-in links, billing receipts, important service notices)
• Respond to support inquiries
• Detect and prevent fraud or abuse
• Comply with applicable laws and regulations

We do not sell your personal information or financial data. We do not use your data for advertising or marketing. We do not use your data to train or improve general-purpose machine learning models.

3. How We Share Your Information

3.1 Service Providers (Subprocessors)

We share data with the following third-party service providers only to operate the Service:

• Plaid Inc. — bank account connectivity and transaction sync
• Google LLC (Gmail API) — read-only access to your email to find receipts (you authorize this directly via OAuth)
• Anthropic, PBC — AI categorization, receipt parsing, and merchant enrichment (see Section 3.4)
• Render Services, Inc. — application hosting
• Neon Inc. — managed PostgreSQL database
• Resend, Inc. — transactional email delivery (sign-in links)
• Stripe, Inc. — payment processing for paid plans (when applicable)

Each provider is contractually obligated to use your data only to perform services on our behalf and consistent with this Privacy Policy.

3.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights or prevent harm.

3.3 Business Transfers

If SpendVisible is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

3.4 AI Processing of Your Data

We use Anthropic's Claude API to automatically categorize line items, parse receipt content, and enrich merchant information. To do this, we send transaction descriptions, receipt text, and uploaded receipt images to Anthropic. Under Anthropic's commercial API terms, Anthropic does not train its models on customer API inputs or outputs, and retains the data only for the duration needed to process the request and meet legal and abuse-monitoring requirements. We do not send Anthropic your name, email, bank credentials, account numbers, or balance information.

4. Data Retention and Deletion

We retain your personal and financial data for as long as your account is active or as needed to operate the Service.

If you disconnect a Plaid-linked bank account: we revoke the Plaid access token and stop pulling new transactions. Historical transactions already imported remain in your account so your dashboards continue to work; you can delete them individually or remove your entire account.

If you disconnect Gmail: we revoke the refresh token and stop pulling new receipts. Receipts already parsed remain in your account; you can soft-delete individual receipts or remove your entire account.

If you delete your account: we delete your personal data, transactions, receipts, uploaded images, categorizations, and merchant data within 30 days of a verified request, except where retention is required by law. Contact privacy@spendvisible.com to request deletion.

5. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (TLS 1.2+) for all connections between you, our servers, and our subprocessors
• Encryption of data at rest in our managed PostgreSQL database (AES-256)
• Secrets and API keys stored in encrypted environment variables, never in source code
• Access controls limiting administrative access to authorized personnel with a business need
• Multi-factor authentication on our hosting provider, source control, and database provider
• Routine review of dependencies for security vulnerabilities and timely patching

No method of transmission over the Internet is 100% secure. In the event of a data breach affecting your information, we will notify you and applicable regulators consistent with our obligations under federal and state law.

6. Cookies and Tracking

We use cookies and similar technologies to maintain your session, remember preferences, and analyze usage. You may disable cookies in your browser settings, but some features may not function correctly. We do not use third-party advertising cookies.

7. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, contact us at privacy@spendvisible.com. We will respond within 30 days.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal information, please contact us immediately.

9. Aggregated and De-identified Data

We may create aggregated or de-identified data that cannot reasonably be used to identify you (for example, totals across all users in a spending category). We may use this data to improve the Service, evaluate model accuracy, or share with partners. Aggregated and de-identified data is not subject to this Privacy Policy and is not "personal information" once it can no longer reasonably be linked to you.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the Last Updated date above, and where appropriate, sending an email notification. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

SpendVisible LLC
Privacy: privacy@spendvisible.com
Security: security@spendvisible.com
Website: https://spendvisible.com