Privacy Policy

We collect the following categories of information:

• Bank and financial data from connected accounts. When you connect a financial account, a secure, read-only third-party bank-connection provider gives us, on your authorization, the institution name, account name, account type, the last four digits of the account number, balances, and transaction history (dates, amounts, and descriptions). We do not receive full account or routing numbers through a bank connection, and it cannot move money.
• Payee bank details. When you add a bank account to pay a vendor, the routing and account number you enter are sent directly to our payments bank to set up the payee. We keep only the last four digits.
• Account and profile information. Name, email address, phone number, business name, and role.
• Usage and log data. Actions taken in the platform, timestamps, and audit records used for security and compliance.

We use financial data solely to provide the services you request, specifically:

• Bank and ledger reconciliation.
• Accounts payable and accounts receivable processing.
• Cash management, balance monitoring, and financial reporting.
• Security, fraud prevention, audit logging, and legal compliance.

We do not use your financial data for advertising, and we do not sell it.

We connect to your financial institution through a secure, read-only third-party bank-connection provider. You sign in to your bank inside the provider's own window, under the provider's terms and privacy policy, which are shown to you before you connect. We never receive or store your online-banking login credentials, and we store no bank access tokens: the provider holds the connection, and we keep only its reference ids and the data listed above. You can disconnect an account at any time, which revokes our access.

• Encryption at rest. Data is stored in a managed PostgreSQL database, encrypted at rest with AES-256.
• Encryption in transit. All connections use TLS 1.2 or higher.
• No bank credentials or tokens. Bank logins stay with the bank-connection provider, and full payee account numbers go only to our payments bank. Neither is stored in our database.
• Access controls. Row Level Security enforces that each organization can access only its own data. Multi-factor authentication (MFA) protects administrative access and is required before connecting a bank account.

• Transaction data: retained for 7 years to meet IRS and tax-compliance requirements.
• Bank connections: access is revoked immediately when you disconnect an account; transactions already imported are kept as part of your reconciliation records.
• Full account data: deleted within 30 days of an account-closure or deletion request, except records we are legally required to retain (such as the 7-year transaction records).
• Backups: retained for 90 days, after which they age out.

Full details are documented in our internal Data Retention Policy. You can request deletion of your data at any time from your account settings or by contacting us (see Section 8).

We share financial data only with the service providers required to deliver the features you use: our bank-connection provider, and our payments bank when you pay vendors. We do not sell your personal information, and we do not share it with advertisers or data brokers. We may disclose information when required by law, subpoena, or valid legal process, or to protect the rights, property, or safety of our users or the public.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights:

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we have collected, subject to legal retention exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share your personal information as those terms are defined under the CCPA, so there is nothing to opt out of.
• Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, email jason@cosbyaisolutions.com. We will verify your request and respond within the timeframes required by law.

You can request deletion from Settings inside the platform, or by emailing jason@cosbyaisolutions.com. When you request deletion, we disconnect the bank accounts you connected (revoking our read access), send you a confirmation, and remove your personal data within 30 days, retaining only records we are legally required to keep.

Cosby AI Solutions LLC
Email: jason@cosbyaisolutions.com
Website: cosbyaisolutions.com

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-platform notice. The version and effective date at the top of this page indicate the current version.