1. Information We Collect

We collect personal information in three primary ways: information you provide directly, information collected automatically when you use the Services, and information obtained through integrations you choose to connect.

1.1 Information You Provide Directly

You may choose to provide personal information when you interact with the Services. This may include:

Account and profile information. You may provide information such as your name, email address, password or authentication method, business name, business type, and related profile details when you create or manage an account.

Business information. You may provide information about your business, such as industry, revenue ranges, time in business, or funding goals, when you use our tools or complete onboarding flows.

Authentication via third parties. If you choose to sign in using a third-party provider such as Google, we receive information needed to create or maintain your account, such as your name and email address.

Communications. When you contact us for support, feedback, or other inquiries, we collect the information you choose to share in your messages, including contact details and the content of your communications.

1.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain technical and usage information. This may include:

Device and usage information. We collect information such as your IP address, browser type, device type, operating system, referring URLs, pages viewed, time spent on pages, and the date and time of your visits.

Log data. Our systems automatically record information such as access timestamps, authentication events, error logs, and security-relevant events to maintain the integrity and security of the Services.

Analytics information. We use analytics tools (such as Google Analytics) to collect aggregated information about how the Services are used so that we can understand usage patterns and improve the user experience.

All automatically collected information is used in accordance with this Privacy Policy and is typically processed in aggregated or pseudonymized form where feasible.

1.3 Information From Connected Financial Accounts (Plaid)

If you choose to connect a financial account for Covmont™ scoring or cash-flow analysis, we obtain information through Plaid Inc. ("Plaid"), a third-party service that securely connects financial institutions to our platform.

When you connect an account, Plaid authenticates your financial account directly with your bank. Covmont does not receive and does not store your bank login credentials.

Once authenticated, Plaid transmits select financial information from your connected account to us, such as account identifiers, masked account numbers, balances, transaction details (including dates, amounts, and descriptions), and institution metadata.

We use this information solely for real-time or near real-time analysis to generate Covmont™ scores and related cash-flow insights.

Use of Plaid is governed by Plaid's End User Privacy Policy, which is available at: https://plaid.com/legal/#end-user-privacy-policy

1.4 Payment Information

When you purchase paid Services, payment processing is handled by Stripe, Inc. ("Stripe"). Stripe collects and processes your payment card details and billing information directly on its systems. Covmont does not receive or store complete payment card numbers or bank account numbers. We receive Stripe-generated identifiers, transaction metadata, and limited billing information necessary for account management, payment confirmation, and financial recordkeeping.

1.5 Information From Emails and Marketing Interactions

If you request early access, join a waitlist, subscribe to updates, or interact with our emails, we may collect your company name, contact name, email address, monthly deal volume, current CRM, and any preferences or details you provide in sign-up forms. We use this information to manage your request, contact you about early access, and maintain related customer-relationship records. Our email service providers (such as Loops and Resend) may collect engagement information, such as whether emails were delivered, opened, or clicked, to help us understand which communications are effective and to maintain system reliability.

2. How We Use Personal Information

We use personal information to operate, improve, and protect the Services and to support you as a business user. We process personal information for the following purposes:

To operate and deliver the Services. We use personal information to create and manage accounts, authenticate users, connect financial accounts through Plaid, generate Covmont™ scores, and present cash-flow insights and related analytics within the application.

To provide support and communicate with you. We use personal information to respond to questions, provide technical support, send service-related notices, inform you of changes to the Services or to our policies, and maintain records of communications.

To process payments and manage billing. We use Stripe-related identifiers and transaction metadata to process payments, manage paid plans, reconcile billing, and maintain legally required financial records.

To maintain security and prevent abuse. We use log data, device information, and security-related telemetry to protect accounts, detect fraudulent activity, prevent unauthorized access, monitor for suspicious behavior, and safeguard the integrity of our systems and your data.

To analyze usage and improve the Services. We use aggregated and anonymized usage data, analytics information, and performance metrics to understand how the Services are used, identify opportunities to improve features, and optimize the overall user experience.

To conduct research and develop new capabilities. We use de-identified or aggregated data (including trends derived from Covmont™ scoring) to evaluate patterns, improve scoring methodologies, and develop new features or services that may benefit users.

To comply with legal and regulatory obligations. We use personal information as necessary to comply with applicable laws, regulations, legal processes, and law enforcement requests, and to enforce our Terms of Service and other policies.

We do not use personal information to make binding credit decisions, and we do not provide lending or underwriting services.

3. Use of Covmont and Automated Technologies

The Services may include automated analysis and AI-supported functionality ("Covmont") to help interpret business and financial data.

We use automated technologies to identify cash-flow patterns, categorize transactions, detect anomalies, and generate scoring insights and recommendations. All AI-generated outputs are provided for informational and educational purposes only. We do not use automated processing to make legal determinations, lending decisions, or other decisions that produce legal or similarly significant effects about you or your business.

We do not train AI models on raw transaction-level data tied to identifiable individuals or businesses. When we improve models or develop new analytical methods, we rely on anonymized or de-identified data so that individuals and specific businesses cannot reasonably be identified. You remain responsible for any business or financial decisions you make based on insights or outputs from Covmont.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to help the Services function properly, to keep you signed in, and to understand how the Services are used.

4.1 Types of Cookies and Technologies

Essential cookies. Required to operate the Services, authenticate users, maintain secure sessions, and enable basic features.

Analytics cookies. Help us understand how users interact with the Services (e.g., Google Analytics).

Email and engagement tracking. Used by email providers to measure delivery and engagement.

4.2 Cookie Choices and Consent

You can manage cookies through your browser settings. If we display a cookie banner or preference center, it is used to honor your choices where required by law. Disabling certain cookies may limit functionality.

5. Information Sharing and Service Providers

We share personal information only as necessary to support the Services, comply with law, or as otherwise described in this Privacy Policy.

5.1 Service Providers

We use trusted third-party service providers, including Plaid, Stripe, Supabase, Vercel, Google Analytics, Loops, and Resend, to perform functions on our behalf. They are permitted to use personal information only as needed to provide their services.

5.2 Affiliates and Financial Offers

From time to time, the Services may display or reference offers from third-party financial providers, such as lenders or other funding providers. We may receive affiliate or referral compensation if you click on a link or engage directly with a financial provider. Any such compensation does not influence your Covmont™ score or the analytical outputs generated by our Services.

We do not share Plaid-derived raw financial data with financial providers, and we do not transmit your transaction data or bank credentials to them. Your interactions with any financial provider are governed by that provider's own terms and privacy policies.

5.3 Legal and Safety Disclosures

We may disclose personal information if we believe in good faith that such disclosure is required by law, necessary to protect the rights, property, or safety of Covmont, our users, or the public, or necessary to detect, prevent, or respond to fraud, security incidents, or other harmful activity.

5.4 Business Transfers

If Covmont is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We do not sell personal information and do not share personal information with third parties for their own cross-context behavioral advertising.

6. Financial Information via Plaid

When you choose to connect a financial account, you authorize Plaid to access your account data and transmit it to Covmont. We use Plaid-transmitted information only to perform cash-flow analysis, generate Covmont™ scores, provide related insights, and support internal security and operational requirements. We do not share Plaid-derived raw financial data with lenders, brokers, or other financial providers, and we do not use Plaid-derived raw transaction data for advertising or marketing by third parties.

For details about how long Plaid-connected account data, raw transactions, and derived outputs are retained, see our Data Retention & Deletion Policy.

7. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, to comply with legal obligations, to maintain security and operational continuity, and to resolve disputes. In general, we retain account information while your account is active; derived financial information (such as Covmont™ scores) for a limited period; and system logs for the minimum period necessary.

Our current retention periods, deletion paths, legal-hold process, and records preserved for tax or audit reasons are described in our Data Retention & Deletion Policy.

8. Your Rights and Choices

Your rights and choices may vary based on where you live, but we strive to provide a consistent baseline of control for all users, including rights to access, correct, delete, or limit certain uses of your personal information, and to opt out of marketing communications.

To submit any privacy rights request, you may contact us at privacy@covmont.com.

If your request involves deletion timing or retained financial records, please also review our Data Retention & Deletion Policy.

9. Do Not Track and Global Privacy Control

Some browsers include "Do Not Track" (DNT) or similar settings. Because there is no widely accepted standard for responding to these signals, the Services do not respond to DNT at this time. Where required by law, we will make reasonable efforts to honor valid Global Privacy Control (GPC) signals as opt-outs from certain forms of tracking or processing.

10. Security

We use technical, administrative, and organizational measures designed to protect personal information from unauthorized access, loss, misuse, alteration, or destruction, including encryption in transit, access controls, monitoring, and working with reputable service providers such as Plaid, Stripe, Supabase, and Vercel. No method of transmission or storage is completely secure; you are responsible for maintaining the confidentiality of your credentials and notifying us of any suspected unauthorized activity.

11. Children's Privacy

The Services are intended for business use by adults and are not directed to children under thirteen (13) years of age. We do not knowingly collect personal information from children under 13. If you believe we may have done so, please contact us so we can take appropriate steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy and, where appropriate, provide additional notice. Your continued use of the Services after changes take effect constitutes your acceptance of the updated policy.

13. Contact Information

If you have questions, concerns, or requests related to this Privacy Policy or our privacy practices, you may contact us at: