Privacy Policy

• Account credentials — your email address and password. Passwords are hashed with bcrypt and never stored in plain text. If you sign in with Google or Apple instead, we receive your email and name from that provider and store an opaque provider-issued identifier to recognize your account on return visits — no password is created or stored in that case.
• Goals and preferences — savings goals, budget limits, notification settings, household sharing preferences, and other configurations you set within the app.
• Card credits — for credit cards with recurring credits Agence tracks, we work out which credits were used from that card's transactions, and store any credit you mark as used yourself, for the current period. We use them only to show your credits and remind you before one resets unused. Deleted with the card or your Agence account.
• Rebalance reminders — if you set a rebalance reminder on an investment account (a brokerage account you connected, or one linked through Plaid), we store the interval and the date you last rebalanced, plus a copy of that account's positions at that moment (each ticker or fund name, quantity, market value, and its share of the account). We use the copy only to show you what has changed when the reminder comes due. It is replaced each time you mark the account rebalanced, and deleted when you remove the reminder, unlink the account, or delete your Agence account.
• AI chat — if you use the AI chat, we store your messages and its replies, and any rating or feedback you give on a reply. Chat also keeps a short memory of facts from your conversations (for example a goal you mentioned) to personalize later replies. The lookups chat runs to answer you (for example reading your portfolio) are kept for 72 hours so we can show which data an answer used, then deleted.
• Automations and orders — the rules you configure for automations, the result of each automation run, the orders placed through Agence (ticker, side, quantity or amount, price, and order type), and the date you gave consent for live trading, if you did.
• Corrections and reports — transaction categories you change, merchant rules you set, and transactions you report to us as wrong.
• Households — if you create or join a household, its members' email addresses. Goals and budgets marked as shared are visible to every member, including progress and contributions. A shared budget shows the household's combined spending in its category, so it includes your transactions in that category. Anything not marked as shared stays private to you.

• Bank account data (via Plaid) — transaction history, account balances (including one saved reading per account per day, so a goal's progress can be measured from an earlier balance; deleted when you unlink the account or delete your Agence account), account metadata (institution name, account type, the account's product name such as "Platinum Card", last four digits of account number), and recurring transaction streams. Retrieved only from institutions you explicitly connect.
• Investment account data (via your connected brokerage) — portfolio positions, holdings, trade history, equity history, and cash balance, retrieved from the brokerage account you link, either through the brokerage's sign-in (OAuth) or with API keys you provide. Your brokerage is a separate, independent service from Agence. For a brokerage account an automation runs on, we keep a copy of its trade records (fills, trading fees, and position changes such as splits) to work out each automation's results and costs; deposits, withdrawals, and other cash records are not kept.
• Investment holdings (via Plaid Investments) — if you connect a brokerage through Plaid, we retrieve holdings, securities, and cost basis data.
• News and company data (via Finnhub) — news articles and company information for tickers on your watchlist and tickers you ask about. Only the ticker symbol is sent. This data is not personally identifiable. Market prices come from your brokerage provider's market data service.
• Fund and company data (via Alpha Vantage) — fund fees and size, analyst price targets and earnings estimates, dividend and split history, and institutional ownership for tickers you ask about. Only the ticker symbol is sent. This data is not personally identifiable.

• Billing information — on the web, Plus is paid through Stripe. In our iOS and Android apps, it is paid through Apple's App Store or Google Play, and RevenueCat manages those subscriptions for us. Agence never receives or stores your card number, expiry, or CVV. We keep a Stripe customer ID or your app-store subscription status, and your plan, to manage your account.

• Server logs — standard request logs (timestamp, endpoint, response code, and your account ID) retained for debugging and security monitoring. No behavioral tracking or advertising analytics.
• Security data — if you turn on two-factor authentication, its secret key (encrypted) and your backup codes (stored only as one-way hashes); and your signed-in sessions, also stored only as hashes.
• Notifications and usage — the in-app notifications we've sent you, and how many AI chat messages and insight refreshes you used each day, so your plan's limits apply.
• Service health records — when an automation, sync, or order check fails, an internal record linking the problem to the affected account, so we can fix it. Deleted with your Agence account.
• Push notification token — if you enable push notifications on our mobile app, we store a device token used to deliver notifications about events you've enabled in Settings (budget alerts, trade signals, goal completion, and similar). You can disable this at any time from Settings or your device's system settings.
• Biometric sign-in devices — if you turn on Face ID or fingerprint sign-in on our mobile app, we store a record for that phone: a random device identifier, the platform (iOS or Android), a label such as "iPhone", when it was added and last used, and a one-way hash of a sign-in key. The key itself stays in your phone's secure storage, which releases it only after your phone confirms your face or fingerprint. We never receive your face or fingerprint data, only the sign-in key once your phone has checked it. The record expires after 90 days without use, and you can remove any device at any time from Settings.

• Running AI analysis agents to generate financial insights tailored to your accounts.
• Synthesizing agent outputs via Claude (Anthropic) to produce a ranked insight feed and chat responses.
• Tracking progress toward your savings goals and budget limits.
• Executing automated paper (simulated) trades based on autopilot rules you configure, and surfacing trade signals for self-directed live trading at your discretion.
• Detecting recurring charges and upcoming subscription renewals.
• Processing subscription payments via Stripe.
• Administering accounts and providing support: Agence can see each account's email, plan, sign-up date, last sign-in and which kinds of accounts are linked, to keep the service running and answer questions.

We do not sell your data. We do not share your data with third parties for advertising or marketing purposes. Data is shared only with the service providers listed below, solely to operate the product.

We ask your permission before any of this is sent. AI analysis is off until you explicitly allow it — Agence names the data involved and identifies Anthropic as the recipient at that point, and you can withdraw permission at any time under Account → AI analysis. If you decline or later turn it off, Agence keeps working without AI: account balances, spending, budgets, goals and portfolio tracking are all unaffected, and nothing is sent to Anthropic.

What is sent, specifically: bank transactions, balances and spending categories; investment holdings, positions and portfolio values; savings goals and budgets; tickers on your watchlist and symbols you view; and the messages you send to the AI chat. Your bank and brokerage credentials are never sent — they never reach Agence in the first place (see Information We Collect, above).

Per Anthropic's usage policies, data submitted through the API is not used to train Anthropic's models. Anthropic processes this data solely to generate the requested output and does not retain it beyond what is necessary for that generation. On that basis we consider Anthropic's handling of this data to provide protection equivalent to our own commitments in this policy: it is used only to produce the output you requested, not for training, not for advertising, and not sold or shared onward. See Anthropic's Privacy Policy and Commercial Terms for the full terms.

AI-generated insights, signals, and chat responses may contain errors or omissions. They are provided for informational purposes only and do not constitute financial, investment, or legal advice. See our Terms of Service for the full disclaimer.

• Plaid — connects to your financial institutions to retrieve bank account data and investment holdings. When you link an account, you authenticate directly with your institution through Plaid's interface — Agence never sees your banking username or password. Subject to Plaid's Privacy Policy.
• Supported brokerage provider — portfolio data and trade execution via OAuth. Your connected brokerage is an independent, separate entity from Agence; please review your brokerage's privacy policy and disclosures when connecting your account.
• Finnhub — news and company information for tickers. Receives ticker symbols only, never personal or account data.
• Alpha Vantage — fund data, analyst targets and estimates, dividends, splits, and institutional ownership. Receives ticker symbols only, never personal or account data.
• Anthropic — AI insight synthesis and chat responses. Financial data is sent to Anthropic's API to generate insights. API data is not used to train Anthropic's models. Subject to Anthropic's Privacy Policy.
• Stripe — subscription billing and payment processing for Plus plans on the web. Stripe handles all payment card data directly; Agence does not store card numbers or CVV codes. Subject to Stripe's Privacy Policy.
• Apple App Store and Google Play — process Plus subscriptions bought in our iOS and Android apps, under their own privacy policies.
• RevenueCat — manages app-store subscriptions for us. It receives your Agence account ID and your subscription's purchase status from Apple or Google, never your financial data. Subject to RevenueCat's Privacy Policy.
• SendGrid and Resend — deliver our emails (password resets, security alerts and similar). They receive your email address and the message.
• Google and Apple sign-in — if you sign in with Google or Apple, we verify the sign-in with that provider.
• Public data sources — FRED (Federal Reserve economic data), SEC EDGAR filings, FINRA data and Cointelegraph news. These receive no personal or account data.
• Render — backend server hosting (API and background workers) and PostgreSQL database hosting. All data at rest is stored in Render's managed database.
• Vercel — frontend hosting and delivery.
• Firebase Cloud Messaging (Google) — if you enable push notifications on our mobile app, your device token and each notification's title, body, category, and the details needed to open it are sent to Google's Firebase Cloud Messaging service solely to deliver it. A notification can include financial details it is about, such as an unusual charge's merchant and amount. Google does not receive your account credentials or chat content through this integration. Subject to Firebase's Privacy Policy.

• All data is transmitted over HTTPS/TLS.
• Passwords are hashed with bcrypt (never stored in plain text).
• Plaid access tokens, brokerage OAuth tokens and brokerage API keys are encrypted at rest using AES-256-GCM before storage.
• JSON Web Tokens (JWT) are signed with a server-side secret and expire after a fixed interval.
• Authentication endpoints are rate-limited to prevent brute-force attacks.

No security measure is perfect. In the event of a breach affecting your personal data, we will notify affected users as required by applicable law — within 30 days under the Florida Information Protection Act (FIPA), and in the most expedient time practicable under California law and other applicable state breach notification statutes.

• Unlink a bank account — go to Settings → find the account → Unlink. Removes that account and all associated transactions from our database immediately. The corresponding Plaid item is also removed, ending data access at the source.
• Unlink a brokerage account — go to Settings → find the account → Unlink. Removes brokerage OAuth credentials and portfolio data from our database.
• Delete your Agence account — go to Settings → scroll to the bottom → Delete Account. This immediately and permanently removes all personal data from our systems, including transaction history, portfolio snapshots, goals, chat history, and linked account credentials, and cannot be undone. Note: Stripe retains billing records as required by applicable financial regulations, independent of account deletion.

Server logs and anonymized analytics may be retained for up to 90 days after the events they record.

• Right to Know — request a copy of the personal data we hold about you and information about how we collect, use, and share it.
• Right to Delete — request deletion of your personal data (subject to limited exceptions required by law or for legitimate business purposes).
• Right to Correct — request correction of inaccurate personal data we hold about you.
• Right to Opt-Out of Sale or Sharing — Agence does not sell or share your personal data for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm this at any time.
• Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights.

California residents (CCPA/CPRA): Your financial account data, transaction history, and precise portfolio information constitute "sensitive personal information" under the CPRA. We use this data only to provide the service and do not use it to infer characteristics for profiling or advertising. You may direct us to limit use of sensitive personal information to service delivery purposes by contacting us at the address below.

To exercise any of these rights, contact us at support@agence.finance. We will respond within 45 days (extendable by 45 days with notice if reasonably necessary).