PRIVACY POLICY

This Privacy Policy covers information we collect when you create an account, connect financial accounts through third-party account connectivity services (e.g., Plaid and similar providers), use our AI/LLM features, visit our website, or otherwise interact with us through the Services.

This Privacy Policy does not cover the privacy practices of third parties that we do not own or control, including your financial institutions, third-party account connectivity providers, third-party identity/authentication providers, and third-party AI services, each of which may have their own privacy policies and terms.

We may collect information you provide, such as:

• Account information: name, email address, password (or other authentication credentials), and account settings/preferences.
• User content: budgeting categories, goals, notes, labels, and any information you input into Thrive.
• Support and communications: messages you send to us (for example, when you contact customer support) and information you choose to share in those communications.

If you choose to link financial accounts, you do so through a third-party account connectivity provider. When you connect accounts, we may receive financial data made available through that provider and your financial institutions, such as:

• Account details: institution name, account name, account type (e.g., checking, savings, credit, brokerage), and limited identifiers (such as last 4 digits where available).
• Balances: current and available balances.
• Transactions: transaction dates, amounts, descriptions/merchant information, categories, and related metadata.
• Holdings (if applicable): investment holdings and related information if your linked accounts support it.

Read-only access: Thrive’s connection is designed to be read-only. We do not initiate transfers, move money, or execute payments from your linked accounts through these connections.

Bank login credentials: We do not receive your online banking username/password when you link accounts through an account connectivity provider. Those credentials, if required for linking, are entered directly into the provider’s connection flow.

Thrive may allow you to sign in or connect certain third-party accounts using an authorization method (often called “OAuth” or similar). When you choose to connect an account this way, we access only the data permitted by the permissions (“scopes”) you authorize.

To be clear and comprehensive, here are the categories of third-party user data we may access depending on what you enable:

1) Data Accessed (Types of Data)

• Basic profile information (such as display name)
• Email address
• Profile picture (if provided)
• A unique account identifier used to associate your third-party sign-in with your Thrive account
• Authorization tokens (access tokens and, if applicable, refresh tokens) needed to keep you signed in and maintain the connection you authorized

If you enable optional import/export or file-based features using a connected third-party account, we may access:

• File metadata (such as file name, file ID, timestamps), and/or
• File contents for the specific file(s) you choose to import, export, open, or create through the feature

We do not access third-party data that we do not need to provide the specific feature you requested.

2) Data Usage (How We Use It)

We use third-party user data accessed via authorization-based connections to:

• Authenticate you and create/maintain your Thrive account (for example, sign-in),
• Provide the requested functionality (for example, importing/exporting a report to a file you choose),
• Secure the Services (fraud prevention, abuse detection, and troubleshooting), and
• Provide support (for example, resolving connection issues you report).

We do not use third-party user data obtained through these authorization-based connections for:

• Advertising targeting (including interest-based advertising), or
• Selling your data to data brokers or other third parties.

3) Storage and Retention of Authorization Data

• We store authorization tokens securely and restrict access to them.
• We keep third-party user data and tokens only as long as needed to provide the connected feature, unless a longer retention period is required or permitted by law.
• You can typically revoke this access at any time via your third-party account settings and/or by disconnecting the integration within Thrive (if available).

Thrive offers an AI/LLM feature that allows you to ask questions about your finances and receive explanations, summaries, and insights.

When you use this feature, we may process:

• Your prompt (what you type), and
• Abstracted or derived financial calculations needed to answer the question (for example: monthly totals by category, spending trends, budget vs. actual summaries, cashflow summaries, and similar computed outputs).

Design principle: We aim to minimize what is shared with the AI service. We do not send your bank login credentials to any AI system.

We may automatically collect:

• Device and network data: IP address, device type, operating system, browser type, and app version.
• Usage data: pages/screens viewed, feature usage, timestamps, crash logs, performance diagnostics, and security logs.

Our website may use cookies and similar technologies to keep the website working, remember preferences, measure usage/performance, and protect against fraud/abuse.

You can control cookies through your browser settings. Some site features may not function correctly without cookies.

We retain information for as long as needed to provide the Services, maintain your account and requested connections, comply with legal obligations, resolve disputes, enforce agreements, and protect the Services from fraud/abuse.

Account Deletion

You can request deletion of your account and associated data by contacting us at support@thrivemoney.ai.

After a deletion request, we will delete or de-identify information consistent with applicable law. Certain limited data may persist for a period of time in backups, security logs, or as required for legal compliance.