PRIVACY POLICY

This Privacy Policy covers information we collect when you create an account, connect financial accounts through third-party account connectivity services (e.g., Plaid and similar providers), use our AI/LLM features, visit our website, or otherwise interact with us through the Services.

This Privacy Policy does not cover the privacy practices of third parties that we do not own or control, including your financial institutions, third-party account connectivity providers, third-party identity/authentication providers, and third-party AI services, each of which may have their own privacy policies and terms.

We may collect information you provide, such as:

• Account information: name, email address, password (or other authentication credentials), and account settings/preferences.
• User content: budgeting categories, goals, notes, labels, and any information you input into Thrive.
• Support and communications: messages you send to us (for example, when you contact customer support) and information you choose to share in those communications.

If you choose to link financial accounts, you do so through a third-party account connectivity provider. When you connect accounts, we may receive financial data made available through that provider and your financial institutions, such as:

• Account details: institution name, account name, account type (e.g., checking, savings, credit, brokerage), and limited identifiers (such as last 4 digits where available).
• Balances: current and available balances.
• Transactions: transaction dates, amounts, descriptions/merchant information, categories, and related metadata.
• Holdings (if applicable): investment holdings and related information if your linked accounts support it.

Read-only access: Thrive’s connection is designed to be read-only. We do not initiate transfers, move money, or execute payments from your linked accounts through these connections.

Bank login credentials: We do not receive your online banking username/password when you link accounts through an account connectivity provider. Those credentials, if required for linking, are entered directly into the provider’s connection flow.

Thrive may allow you to sign in or connect certain third-party accounts using an authorization method (often called “OAuth” or similar). When you choose to connect an account this way, we access only the data permitted by the permissions (“scopes”) you authorize.

To be clear and comprehensive, here are the categories of third-party user data we may access depending on what you enable:

1) Data Accessed (Types of Data)

• Basic profile information (such as display name)
• Email address
• Profile picture (if provided)
• A unique account identifier used to associate your third-party sign-in with your Thrive account
• Authorization tokens (access tokens and, if applicable, refresh tokens) needed to keep you signed in and maintain the connection you authorized

If you enable optional import/export or file-based features using a connected third-party account, we may access:

• File metadata (such as file name, file ID, timestamps), and/or
• File contents for the specific file(s) you choose to import, export, open, or create through the feature

We do not access third-party data that we do not need to provide the specific feature you requested.

2) Data Usage (How We Use It)

We use third-party user data accessed via authorization-based connections to:

• Authenticate you and create/maintain your Thrive account (for example, sign-in),
• Provide the requested functionality (for example, importing/exporting a report to a file you choose),
• Secure the Services (fraud prevention, abuse detection, and troubleshooting), and
• Provide support (for example, resolving connection issues you report).

We do not use third-party user data obtained through these authorization-based connections for:

• Advertising targeting (including interest-based advertising), or
• Selling your data to data brokers or other third parties.

3) Storage and Retention of Authorization Data

• We store authorization tokens securely and restrict access to them.
• We keep third-party user data and tokens only as long as needed to provide the connected feature, unless a longer retention period is required or permitted by law.
• You can typically revoke this access at any time via your third-party account settings and/or by disconnecting the integration within Thrive (if available).

Thrive offers an AI/LLM feature that allows you to ask questions about your finances and receive explanations, summaries, and insights.

When you use this feature, we may process:

• Your prompt (what you type), and
• Abstracted or derived financial calculations needed to answer the question (for example: monthly totals by category, spending trends, budget vs. actual summaries, cashflow summaries, and similar computed outputs).
• Documents you upload (for example, a paystub or an account statement), which an AI service provider reads so we can extract the information the feature needs.

Design principle: We aim to minimize what is shared with the AI service. We do not send your bank login credentials to any AI system.

We may automatically collect:

• Device and network data: IP address, device type, operating system, browser type, and app version.
• Usage data: pages/screens viewed, feature usage, timestamps, crash logs, performance diagnostics, and security logs.

Our website may use cookies and similar technologies to keep the website working, remember preferences, measure usage/performance, and protect against fraud/abuse.

You can control cookies through your browser settings. Some site features may not function correctly without cookies.

We use two providers to understand how people find Thrive and to manage our relationship with our customers. Neither receives your connected financial data, balances, transactions, holdings, uploaded documents, or AI conversations.

• Meta Platforms (Meta Conversions API). When you start a free trial and when you become a paying subscriber, our servers send Meta an event naming that step (for example, “StartTrial” or “Subscribe”), the time it happened, the name of the plan step (“ThriveMoney Trial” or “ThriveMoney Premium”) with a fixed placeholder value and currency (not the price you pay), the fact that the event came from our website and the web address it relates to, and a hashed (SHA-256) copy of your email address and of your Thrive account ID (an “external ID”). We do this to measure whether our ads on Meta’s services, such as Facebook and Instagram, lead to sign-ups. Hashing does not make this information anonymous: Meta can match the hashed values to a Meta account you hold, and Meta’s own terms and privacy policy govern how Meta uses it.
• GoHighLevel (customer relationship management). We keep a contact record for you in GoHighLevel. It holds your email address, your first and last name (when you provide them), and tags that record where your account is in its lifecycle: account created, subscription page seen, free trial started, free trial cancelled, subscribed, and subscription cancelled. We use it to keep track of our customers and to manage our communications with you. GoHighLevel stores this information for us as our service provider.

You can opt out of both at any time; see Section 9.E.

We retain information for as long as needed to provide the Services, maintain your account and requested connections, comply with legal obligations, resolve disputes, enforce agreements, and protect the Services from fraud/abuse.

Account Deletion

You can request deletion of your account and associated data by contacting us at support@thrivemoney.ai.

After a deletion request, we will delete or de-identify information consistent with applicable law. Certain limited data may persist for a period of time in backups, security logs, or as required for legal compliance.

De-identified records of feedback you gave about our calculations and suggestions (with no name, email, account number or other identifier) may be kept after deletion to test and improve those features.