Privacy Policy

When you register and use PatraX, we collect:

• Name and email address
• Phone number (optional)
• Username and password (or third-party auth tokens)
• Profile and account settings

When you connect a bank account, Plaid retrieves transaction history, account balances, and institution details on our behalf. PatraX receives read-only access — we never initiate transfers or move funds. Your use of Plaid is also governed by Plaid's End User Privacy Policy.

When you use the PatraX app we may collect:

• Geolocation — for mileage and location-based deduction tracking (with your permission)
• Camera — for receipt scanning (with your permission)
• Push notifications — for tax reminders and account alerts

You can revoke any of these permissions at any time in your device settings.

If you sign in with Apple or Google, we receive limited profile information (name, email) from those providers. Their own privacy policies govern that data. We do not receive your social media passwords.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not process sensitive personal information such as Social Security numbers, government IDs, racial or ethnic origin, religious beliefs, sexual orientation, health data, or biometric identifiers. If you believe we have collected any such information inadvertently, please contact us at [email protected] immediately.

We may receive information about you from other sources to supplement what you provide directly, including:

• Public databases — to verify identity or detect fraud
• Financial institutions — via Plaid when you connect a bank account
• Social login providers — profile data from Apple or Google when you authenticate through their platforms

Any information received from third-party sources is used only in accordance with this Policy and is treated with the same protections as information you provide directly.

• Create and manage your account
• Provide income tracking, expense categorization, and tax estimation features
• Connect and sync your linked financial accounts
• Send administrative emails, push notifications, and tax deadline reminders
• Detect and prevent fraud and unauthorized access
• Improve our product through aggregated, de-identified analytics
• Comply with applicable legal obligations

We share data with trusted third parties that help us operate the Services:

• Plaid — bank connectivity
• Supabase — database and authentication infrastructure
• Google & Apple — sign-in authentication
• Resend — transactional email delivery
• Anthropic (Claude) — AI-powered expense categorization

If PatraX is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or in-app notice before your data is transferred and becomes subject to a different privacy policy.

We may disclose your information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of PatraX, our users, or the public.

Certain features — including receipt scanning and expense categorization — are powered by Anthropic's Claude AI. When you use these features, relevant data (such as receipt images or transaction descriptions) is processed by Anthropic in accordance with their terms and our Privacy Policy. We do not use your financial data to train AI models without your explicit consent.

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS encryption for all data in transit
• Row-level security policies on our database
• Access controls limiting data to authorized personnel only

No system is 100% secure. You use the Services at your own risk and should access them only from secure environments.

You may withdraw consent to our processing at any time by contacting us. Note that withdrawal does not affect the lawfulness of processing prior to withdrawal.

Unsubscribe from marketing emails via the unsubscribe link in any email, or reply STOP to SMS messages. You will still receive essential service communications.

No mobile information is shared with third parties for marketing purposes.

You may review, update, or delete your account at any time through in-app settings or by contacting [email protected].

If we decline to act on your privacy request, you may appeal by emailing [email protected]. If your appeal is denied, you may contact your state attorney general.

In the past 12 months we have collected personal information from the following sources:

• Directly from you (registration, in-app input, receipt uploads)
• Automatically from your device (app usage data, crash logs)
• Plaid, when you connect a bank account
• Apple and Google, when you sign in via social login
• Anthropic's Claude API, which returns AI-processed results based on data you submit

We use and share personal information for the business purposes described in Sections 2 and 3 of this Policy. In the past 12 months we have not sold personal information and have not shared personal information for cross-context behavioral advertising. We use personal information to:

• Provide, maintain, and improve the Services
• Process transactions and send related information
• Verify identity and prevent fraud
• Comply with legal obligations

Depending on your state of residence, you may have the following rights:

• Right to Know — what personal information we collect, use, share, or sell
• Right to Access — obtain a copy of the personal information we hold about you
• Right to Correct — request correction of inaccurate personal information
• Right to Delete — request deletion of your personal information (subject to legal exceptions)
• Right to Data Portability — receive your data in a portable, machine-readable format
• Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights
• Right to Opt Out of Sale/Sharing — we do not sell or share personal information, so this right is not applicable

Additional rights by state:

• California (CCPA/CPRA) — right to limit use of sensitive personal information; right to know categories of third parties with whom we share data
• Virginia (VCDPA) — right to opt out of profiling for decisions with significant legal effects
• Colorado (CPA), Connecticut (CTDPA) — right to opt out of profiling; right to appeal a denial of your request
• Minnesota, Oregon, Florida — right to obtain a list of specific third parties to whom we have disclosed personal information

To exercise any of these rights, submit a data subject access request or email [email protected]. We will respond within 45 days (extendable by an additional 45 days where reasonably necessary with notice to you).

To protect your privacy, we must verify your identity before acting on access, correction, deletion, or portability requests. Depending on the nature of the request, verification may require you to:

• Confirm the email address associated with your account
• Answer security questions about your account activity
• Provide additional documentation if the above is insufficient

We will use the information you provide for verification only and will not retain it for any other purpose.

California residents may request a list of third parties to whom we have disclosed personal information for direct marketing purposes. Submit your request to [email protected].