# PlusClue Privacy Policy — privacy-v0-draft

> **DRAFT — NOT YET IN EFFECT. Attorney review pending (recorded launch
> gate). Flagged attorney items are marked inline. Nothing in this file is
> legal advice.**

*Version: privacy-v0-draft · Drafted 2026-07-12 · Supersede, don't edit
(AOCF §11.1).*

*Served copy: `web/public/legal/privacy-policy.md` (what subscribers open
from the signup screen). Update BOTH files and bump `PRIVACY_VERSION` in
`server/src/legal/versions.ts` together.*

## 1. What we collect

- **Account data**: your name, email, and login credentials.
- **Financial data you connect or upload**: bank and card transactions (via
  Plaid), payment-processor activity (via Stripe restricted keys), CSV
  imports, receipts and documents you upload, and the ledger the service
  builds from them.
- **Operational records**: the append-only action log — every agent,
  pipeline, and human action on your books, kept as a control requirement
  (AOCF §7.1), and billing events.
- We do **not** collect advertising identifiers, and we do not buy data
  about you from third parties.

## 2. How we use it

Solely to operate the service: classifying and posting your transactions,
running the control framework's checks, answering your questions from your
own records, billing, and support. **We do not sell your data. We do not
use your data for advertising.**

## 3. Who processes it (sub-processors)

| Processor | What they see | Why |
|---|---|---|
| Google Cloud (Firestore, Cloud Run) | All stored data | Hosting and database |
| AI model providers — Google, Anthropic, xAI | Transaction descriptions, amounts, counterparties, chart-of-accounts context sent per classification call | Automated classification, verification, and audit |
| Plaid | Your bank credentials/connection (held by Plaid, not us) | Bank feed |
| Stripe | Billing details; payment data for connected Stripe accounts | Subscription billing; payment feed |

Model calls send only what the classification task needs — never your login
credentials, connector secrets, or other clients' data. *[ATTORNEY: confirm
each provider's API data-use terms support a "not used for training"
representation before making that claim in the published version; execute
DPAs where required.]*

## 4. Practitioner access (marketplace)

If you engage a practitioner through the marketplace, they receive **scoped
access only** (AOCF §9.5): the specific records the engagement requires —
for a re-performance run, exactly the sampled items; for an AOCF Check, the
evidence you authorize. Every grant and every access is on the audit trail
visible to you. Practitioners are independent controllers of their own
working papers and are bound by professional confidentiality obligations
and the partner terms.

## 5. What we publish (Trust Feed)

Aggregate operational metrics only — counts and rates across the platform.
Nothing published identifies you, your business, a counterparty, or any
transaction. Where a metric has no real data yet, we publish an honest null
rather than a simulation.

## 6. Security

Tenant isolation is enforced on every route and verified by automated gates.
Connector credentials are encrypted (AES-256-GCM) with keys held outside
the database. Secrets are never logged or displayed. Owner and partner
sessions are disjoint token audiences — a partner token cannot exercise
owner routes or vice versa.

## 7. Retention and deletion

Your ledger is append-only by design — that immutability is the product's
core control, so records are not edited or selectively deleted while your
account is open. You can export everything at any time, including after
non-payment. AI assistant conversation history is retained for up to seven
years from each exchange, then may be deleted — and you can permanently
delete any conversation yourself at any time (a dated deletion marker,
without the content, remains on the audit trail). On account closure we delete your data after a wind-down
period, except records we must retain for legal, tax, or audit-trail
obligations. *[ATTORNEY: reconcile append-only retention with
CCPA/GDPR-style deletion rights — likely via the legal-obligation and
integrity exemptions plus defined closure-deletion SLA; also confirm
retention periods.]*

## 8. Your rights

You may access and export all your data in-product, correct account
information, and close your account. Requests beyond that (including
deletion requests) go to the contact below. *[ATTORNEY: add
jurisdiction-specific rights sections (California, EU if applicable) and
verify contact/DPO requirements.]*

## 9. Changes and contact

New versions get a new version string; prior versions are retained.
Material changes are notified before they take effect.

Contact: *[founder to confirm support address before publication]*