Legal / Version 2026-10-25-draft
Privacy Policy
Draft for counsel review (updated 2026-10-25). Not yet in force. Bracketed items need a decision. Written from how the product actually handles data; not legal advice. Counsel should also confirm whether Ombudly is a "financial institution" under the Gramm-Leach-Bliley Act and whether a GLBA privacy notice is needed.
This policy explains what personal information [Legal entity] ("Ombudly", "we") collects, why, who we share it with, how long we keep it, and your rights. It covers the Ombudly website, apps, API and MCP server.
1. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, sign-in and MFA records | You, Clerk (our sign-in provider) |
| Household facts | Household size, income, state, filing status, children, insurance, employment | You (Settings or answers to the advocate's questions) |
| Financial accounts | Account names, balances, transactions, investment holdings | Plaid (with your permission) or files you upload |
| Documents | Receipts, bills, statements, tax forms, EOBs, letters (and text extracted from them) | You |
| Only finance-related messages (receipts, refunds, bills, renewals, claims, insurance and medical bills) and their attachments; messages you approve sending | Your mailbox, by IMAP with an app password you provide | |
| Vault | Logins, card details and identity numbers you save so the advocate can fill them in | You. Encrypted; agents never see the values |
| Advocate activity | Opportunities, cases, messages, approvals, decisions, results, follow-ups | Created as you use the Service |
| Devices | Push notification tokens, device type | Our apps |
| Technical | IP address, logs, error reports | Automatically |
| Payments | Plan and billing records (card details are held by Stripe, not us) | Stripe |
| Invitations and programs | Consented invitation and attribution records, accepted rule versions, affiliate application/channel information, reward and commission ledger entries, eligibility review status | You, the invitation you choose, and subscription payment evidence from Stripe |
We don't intentionally collect information from children under 13 [or under 16 in the EEA/UK].
2. How we use it
- To provide the Service: find money you're owed, prepare and send requests you've allowed or approved, follow up, and verify results against your accounts.
- To run screens and organizers you ask for (benefits, tax, settlements, investments).
- To secure the Service: detect abuse, protect accounts, keep audit logs.
- To communicate with you: approvals, questions, receipts, service notices.
- To administer optional referral and affiliate programs: remember an invitation you accept, check eligibility and payment evidence, prevent duplicate or self-referrals, calculate rewards and reversals, and review affiliate applications and payouts.
- To improve the Service using aggregated or de-identified information. [We don't use your personal information to train AI models.]
- To comply with law and enforce our terms.
Legal bases (EEA/UK): performance of our contract with you; your consent (for connecting accounts and email, which you can withdraw); our legitimate interests in securing and improving the Service; and legal obligations.
3. AI processing
The advocate sends the parts of your records it needs for a task to AI model providers (listed below) to analyze them and draft messages. Those providers process the data under contracts and API terms that [don't allow them to train on it and limit retention]. Some judgments (for example whether a merchant is a settlement program's company) use a classification model (TypeSafe Jev, via OpenRouter). Consequential actions always need your approval.
4. Who we share it with
- Service providers (subprocessors) that run the Service for us, under contracts limiting their use of your data: see the subprocessor list.
- Companies you're dealing with, only what a request needs (for example your order number and the amount, sent to that merchant), and only within your permission settings.
- Professionals you choose (for example legal aid), only when you approve sharing a case packet.
- Referral and affiliate participants see their own aggregate totals and ledger amounts and dates. They do not receive invited customers' names, emails, bank records, documents, cases or credentials. Invitation attribution uses optional first-party storage described in the Cookie Notice, not a third-party advertising pixel.
- Legal and safety: when required by law, or to protect rights and safety.
- Business transfers: in a merger or acquisition, subject to this policy.
We don't sell or share personal information for cross-context behavioral advertising, and we don't use advertising trackers.
5. How long we keep it
See the data retention schedule. While your account is open we keep the records needed to provide the Service. After deletion, live account data is removed within 30 days except records retained for applicable legal obligations (for example billing records for [7] years). Encrypted backups retain 35 daily, 8 weekly and 6 monthly snapshots, so older copies may remain for approximately six months. Offline owner copies are updated when the backup mirror next runs. Expired, unclaimed invitations are purged by retention jobs; claimed attribution and reward records follow account and payment retention rules.
6. Security
Encryption in transit (TLS) and at rest; field-level encryption for documents, emails, vault items and household facts; per-household vault keys; app-managed passkeys/security keys, encrypted TOTP and one-use recovery codes; least-privilege access; logging and monitoring. Face ID and Touch ID biometric data stays with your device or authenticator; we receive a verification result, not the biometric. No system is perfectly secure; we'll notify you of a breach as the law requires.
7. Your rights and choices
Depending on where you live (for example California under the CCPA/CPRA, or the EEA/UK under the GDPR), you can:
- access and export your data (Settings, Download my data);
- correct it;
- delete it (Settings, Delete account);
- withdraw consent by disconnecting accounts or email, or pausing the advocate;
- object to or restrict certain processing;
- appeal a decision on your request; and
- not be discriminated against for exercising these rights.
Make a request in the app or at [privacy@ombudly.com]. We'll verify your identity and respond within the time the law requires (generally 30–45 days). EEA/UK residents can also complain to their data protection authority.
8. International transfers
We're based in the United States and store data in [region]. If you're outside the US, your data is transferred to the US under [Standard Contractual Clauses / the EU-US Data Privacy Framework].
9. Changes
We'll notify you of material changes before they take effect.
10. Contact
[Legal entity], [postal address], [privacy@ombudly.com]. [EU/UK representative, if required.]