Privacy Policy

We process your information to: provide, operate, and maintain our Services; facilitate account creation and authentication; deliver and personalize Services to you; process transactions and manage orders; send administrative information, updates, and security alerts; respond to inquiries and provide customer support; request feedback and analyze usage trends; send marketing communications (with opt-out option); protect our Services and prevent fraud; comply with legal obligations; and improve our Services through internal analytics and product development. For EEA/UK users (GDPR), our legal bases include: your consent, performance of a contract, our legitimate business interests (improving Services, fraud prevention, marketing), and compliance with legal obligations. For Canadian users, we process information with your express or implied consent, or as otherwise permitted by PIPEDA.

We implement appropriate technical and organizational security measures including bank-level 256-bit AES encryption for data transmission and storage, secured servers behind firewalls, access restricted to authorized personnel, application error and performance monitoring to detect and remediate issues, and regular security audits. However, no electronic transmission over the Internet or storage technology is guaranteed 100% secure. You should protect your password, limit device access, and sign off after use. Transmission of personal information is at your own risk.

We use cookies and similar technologies (pixel tags, web beacons, local storage) in the following categories: Essential Cookies (authentication, security, and remembering your cookie choices) which are always active and do not require consent; and Analytics & Diagnostics Cookies (usage patterns, page views, feature interactions, and error monitoring), which are provided through our analytics and error-monitoring providers. These tools collect your IP address and device data and may set cookies or use local storage. We do not load any non-essential cookie or tracker until you give consent through our cookie banner in regions where consent is required (including the EEA, UK, and Switzerland), and we treat a Global Privacy Control (GPC) or similar browser opt-out signal as a valid request to disable non-essential tracking. Error monitoring may run to protect the security and integrity of the Services; where required by law it also loads only after consent. You can accept or reject analytics at any time through the cookie banner or the 'Cookie Preferences' link in our footer. We do not use cookies for cross-site advertising or retargeting, and we do not sell the information collected through cookies. Because there is no finalized industry standard for the Do-Not-Track (DNT) browser setting, we respond to the GPC signal instead. The specific analytics and monitoring providers we use are listed on our Subprocessors page.

We give you direct control over the tracking technologies used on our website. On your first visit from a consent-required region (including the EEA, UK, and Switzerland), no analytics or non-essential cookies load until you accept them in our cookie banner; essential cookies needed to run the site and remember your choice are always active. You can change your decision at any time using the 'Cookie Preferences' link in the footer. If your browser or device sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of non-essential tracking and any 'sale' or 'sharing' of information, and we will not load our non-essential analytics tools. Where our analytics provider offers one, you may also use its official browser opt-out add-on. Because your IP address is collected by these analytics tools and can identify you, declining analytics or sending a GPC signal prevents your IP address from being processed for analytics purposes. Essential logging of IP addresses for security, fraud prevention, and error monitoring may continue to the extent permitted by law. The providers we use for analytics and error monitoring are listed on our Subprocessors page.

We rely on a limited set of trusted third-party service providers ('subprocessors') that process personal data on our behalf, and we share only the data each provider needs to perform its function. These fall into the following categories: cloud hosting and file storage; website and product analytics; application error and performance monitoring; messaging and push notifications; payment processing; financial data aggregation (to securely connect your accounts with read-only access); AI providers (solely to power optional AI features); and maps and location services. We may also disclose information in connection with Business Transfers (merger, acquisition, sale of assets). When you consent to analytics, technical data such as your IP address and device information is shared with our analytics providers; our error-monitoring provider receives technical diagnostics, IP address, and account identifiers when errors occur. We may also disclose information to comply with legal obligations, enforce our terms, or protect rights and safety. We may share aggregated, de-identified data for lawful business purposes. We do not sell your personal or financial data for monetary consideration, and we do not 'share' it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws. Certain analytics activity may be considered a 'sale' or 'share' under some state laws; where that is the case, you can opt out as described in the 'Your Choices About Tracking' and 'U.S. State Privacy Rights' sections below. A current list of the specific providers in each category is maintained on our Subprocessors page.

We use a limited set of trusted third-party providers ('subprocessors') to operate our Services and process personal data on our behalf, across categories such as cloud hosting and storage, analytics, error and performance monitoring, messaging and push notifications, payment processing, financial data aggregation, AI providers, and maps and location services. We maintain a current, categorized list of these providers – including what each one does – on our Subprocessors page, which we update as our providers change. Each subprocessor is bound by a written agreement to protect your information and to process it only as needed to provide its service.

Our AI features (such as AI chat and AI insights) are powered by third-party AI service providers, accessed through their APIs or via cloud platforms. The specific providers we use are listed on our Subprocessors page. When you use AI features, we share only the data necessary to provide the functionality, which may include financial summaries, transactions, plan inputs, goals, simulation outputs, and the contents of documents you choose to upload (such as receipts or statements) for AI processing. We do NOT share your name, email, payment information, or authentication data with AI providers. Your prompts and outputs are: NOT available to other customers; NOT available to our AI providers or any other third parties beyond what is needed to return a response to you; NOT used to train, retrain, or improve any AI foundation models; NOT used to improve any third-party products or services. We use these providers under enterprise/API terms that contractually prohibit training on your data. AI models are stateless-no prompts or outputs are stored in the model itself. AI features are entirely optional; your data is not processed by AI unless you actively choose to use these features.

Our servers are located in the United States. If you are located outside the United States – including the European Economic Area (EEA), United Kingdom (UK), Switzerland, Canada, or any other jurisdiction – your information may be transferred to, stored, and processed in the United States. For residents of the EEA and UK, we implement appropriate safeguards as required by GDPR, including the European Commission's Standard Contractual Clauses (SCCs) for international data transfers. For Canadian residents, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We ensure all transfers are protected in accordance with applicable data protection laws regardless of your location.

Some of the information we handle – such as financial account information, transaction history, and account credentials – is treated as 'sensitive personal information' under laws like the California Privacy Rights Act (CPRA) and comparable state statutes. We use and disclose sensitive personal information only for the purposes of providing and securing the Services you request, processing transactions, preventing fraud, and complying with law. We do not use or disclose your sensitive personal information to infer characteristics about you, and we do not use it for targeted advertising or sell it. Where a state law grants you the right to limit the use of sensitive personal information, we already limit our use to these permitted purposes; you may still contact us at privacy@wealthtron.com with any request.

We retain your personal information for as long as necessary to provide our Services or fulfill the purposes for which it was collected. When establishing retention periods, we consider the nature and sensitivity of the data, potential risk of unauthorized use, and our legal obligations. After account termination, we will delete or anonymize your information within three (3) months, unless retention is required by law. We may retain anonymous or aggregated data that cannot identify you.

We maintain incident-response procedures to detect, investigate, and respond to security incidents. In the event of a data breach affecting your personal information, we will notify you and the relevant supervisory authorities without undue delay and within the timeframes required by applicable laws (for example, U.S. state breach-notification statutes, the GDPR, and PIPEDA). Our notice will describe, to the extent known, the nature of the incident, the categories of information involved, and the steps we and you can take to reduce potential harm.

We do not knowingly collect or solicit personal data from children under 18 years of age. If you are under 18, please do not register for or use our Services. If we learn we have collected personal information from a child under 18, we will delete that information as quickly as possible. If you believe a child under 18 may have provided us personal data, please contact us immediately.

Depending on your location, you may have rights under applicable data protection laws such as GDPR (EEA/UK), the Swiss Federal Act on Data Protection, or PIPEDA (Canada). These include the right to: request access to and obtain a copy of your personal information; request rectification or erasure; restrict or object to processing; request data portability; withdraw consent at any time (without affecting prior lawful processing); and not be subject to solely automated decision-making that produces legal effects. For EEA/UK residents, you may lodge a complaint with your local data protection authority. For Swiss residents, you may contact the Federal Data Protection and Information Commissioner. For Canadian residents, you may contact the Office of the Privacy Commissioner of Canada. Exercise these rights via your account settings, our data request form, or by emailing privacy@wealthtron.com.

If you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive privacy law (including the CCPA/CPRA), you may have the right to: know and access the personal information we collect; obtain a portable copy of your data; request deletion; correct inaccurate data; opt out of any 'sale' or 'sharing' of personal information and of targeted advertising; and limit the use of sensitive personal information. We do not sell your personal information for monetary consideration. To exercise the opt-out that applies to website analytics, you can reject analytics in our cookie banner, enable a Global Privacy Control (GPC) signal in your browser (which we honor automatically), or email us. Nevada residents may separately submit a verified request not to have covered personal information sold under Nevada law. California residents also have a 'Shine the Light' right to request information about disclosures of personal information to third parties for their direct marketing purposes; we do not disclose personal information for third-party direct marketing. We will not discriminate against you for exercising any of these rights. You may designate an authorized agent to make a request on your behalf, and if we deny a request you may appeal by replying to our decision. To submit a request, email privacy@wealthtron.com or use the data request form in your account settings.

We may update this Privacy Policy from time to time. We will notify you of material changes by placing a notice on our website or sending you an email. Your continued use of the Services after changes have been posted constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at: privacy@wealthtron.com or by post at: Wealthtron Inc., San Francisco, CA, United States.