Privacy Policy

We collect information you provide directly to us when you create an account, use our services, or contact us for support. This includes: - Account information: name, email address, password - Business information: company name, state of formation, EIN - Payment information: credit card details (processed securely by Stripe — we do not store card numbers) - Financial data: bank transaction data synced via Plaid (with your explicit authorization) - Communications: messages you send to our support team

We use the information we collect to: - Provide, maintain, and improve our services - Process transactions and send related information - Send administrative messages, updates, and security alerts - Respond to your comments, questions, and support requests - Monitor and analyze trends, usage, and activities - Comply with legal obligations, including tax reporting requirements

We do not sell your personal information. We share information only in these circumstances: - Service providers: Stripe (payment processing), Supabase (database), Plaid (bank connectivity), Vercel (hosting), Resend (email delivery) - Legal requirements: when required by law, court order, or government authority - Business transfers: in connection with a merger, acquisition, or sale of assets - With your consent: for any other purpose with your explicit approval

We implement industry-standard security measures to protect your information: - All data is encrypted in transit (TLS/SSL) and at rest - Access to personal data is restricted to authorized personnel only - We use Supabase Row Level Security (RLS) to ensure data isolation between users - Payment card data is handled exclusively by Stripe and never stored on our servers

We use cookies and similar tracking technologies to: - Maintain your login session - Remember your language preference - Analyze site traffic and usage patterns You can control cookies through your browser settings. Disabling cookies may affect certain features of our service.

Depending on your location, you may have the following rights: - Access: request a copy of the personal data we hold about you - Correction: request correction of inaccurate data - Deletion: request deletion of your personal data (subject to legal retention requirements) - Portability: request a machine-readable export of your data - Objection: object to certain types of processing To exercise these rights, contact us at [email protected].

We retain your data for as long as your account is active or as needed to provide services. Financial and tax records may be retained for up to 7 years to comply with IRS requirements. Upon account deletion, we will delete or anonymize your personal data within 90 days, except where retention is required by law.

StartFormly operates from the United States. If you are located outside the US, your information will be transferred to and processed in the United States. By using our services, you consent to this transfer. We take appropriate steps to ensure your data receives adequate protection in accordance with this Privacy Policy.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us: Email: [email protected] StartFormly Inc. United States