NuvoCent Privacy draft

Draft details

DRAFT FOR OWNER AND COUNSEL REVIEW — NOT IN EFFECT

Operator: Vanguard Reputation Solutions LLC

Contact: [Privacy/support contact]

Effective date: [Effective date — set only after counsel approval]

1. Who we are

NuvoCent is operated by Vanguard Reputation Solutions LLC. Contact: [Privacy/support contact].

2. Information we handle

- Account information: your email address, account identifier and sign-in tokens. On the website you can sign in with an email link/code or, where offered, Apple or Google (Apple may provide a private relay email). The iPhone source supports numeric email codes and explicit pasting of an original unused sign-in verification link on the configured authentication host; it is not an automatic Mail redirect. Pasted links/codes are used only for authentication, not sent to AI or saved to app storage/logs; input clears on background/logout/identity changes. The returned verified email must match the requested address before guarded session installation. Website sessions are stored in your browser; app sessions are stored in your device's secure storage.

- Local CSV statements (website only): when you choose a CSV file, its contents are read locally for column/date/sign/currency and duplicate review. Only confirmed dates, masked merchant descriptions, amounts/currencies, categories and file/row provenance enter this tab’s session memory, bound to verified sign-in and invitation admission. Account/card columns are ignored; do not include sensitive identifiers. Invalid rows are shown without repeating raw contents. No external upload, app database/browser-storage persistence, model request or ChargeWise sharing is performed. PDF/scanned statements are not supported.

- Bank data (only if you connect a bank): read-only account names/types, balances (which may be cached), and transaction records received through Plaid. You sign in to your bank through Plaid's or your bank's own hosted authorization screens; we do not receive your bank password. The resulting access tokens are stored encrypted on our servers.

- AI chat (only if you consent): your questions, a bounded recent chat history, and minimized spending summaries (such as category totals and counts).

- Numeric sign-in and upgrade status: web and native source support an 8-digit code verified against the requested email; actual numeric delivery requires the managed sign-in email template to include its code variable and is not configured by this change. Current link sign-in remains available. Upgrade screens read verified beta/owner access status only; no payment details, purchases, subscription receipts or paid entitlement records are collected by this increment.

- Sample data: signed-out demo data is fictional. Edits you make to it may be saved locally in your browser. If you ask the demo coach a question, your question and the demo context are sent for AI processing.

- Technical data: our hosting, authentication, Plaid and AI providers, and loaded web resources (such as fonts), may receive request information such as IP address, device/browser details and error diagnostics. We have not yet fully catalogued this.

- Cancellation and issuer handoffs: chosen merchant/billing channel, editable request, review choice and page-open status remain local session memory, not cancellation/filing receipts. Native background/logout/identity change or leaving clears this work. No request is automatically delivered. Opening fixed official destinations shares ordinary browser/network metadata with that provider, not appended bank records, letters or sign-in tokens. Explicit copying/downloading/sharing an approved request or ChargeWise letter creates an external copy outside NuvoCent’s control. Direct issuer delivery requires a verified connected delivery service or accepted issuer channel; none is implemented by this source increment.

- ChargeWise manual case: jurisdiction, payment type, issuer, merchant, amount/currency, transaction/first-statement-sent dates if supplied, status, issue, narrative and contact/cancellation/delivery history. With separate case AI opt-in, these fields plus question and bounded completed ChargeWise history go to Lovable AI / OpenAI. Visible consent names Lovable AI/OpenAI and explains that entered charge details and this ChargeWise chat are shared for this case, separately from NuvoCent AI bank summaries. An expandable “How your information is used” section explains these fields, memory clearing, provider uncertainty and revocation limits. No bank snapshot or regular coach transcript is sent. Do not enter full card/account/routing numbers, CVV/PIN, passwords/codes or SSN. Complete customer identity/account-reference/signature placeholders only in the issuer secure process. Manual facts remain personal financial data.

3. How we use it

To provide summaries and possible-recurring-payment estimates, generate coaching you request, secure accounts, prevent abuse, and operate the beta. [Owner/counsel: confirm sale, advertising, analytics and tracking status after inspecting deployed SDKs and agreements before making any statement here.]

4. AI processing

When you ask a question with AI consent enabled, we send your question, a bounded recent chat history and a minimized financial summary to Lovable AI, which uses a model provider such as OpenAI. The summary can include account types, balances with currency and as-of time, institution and sync status, spending totals, counts, possible-recurring estimates and savings scenarios. This is still personal financial information; it is not anonymous. Our requests set a provider option asking that the request not be stored, but that option does not guarantee the provider will not keep or train on it, and we have not verified their retention, logging or training practices. In NuvoCent, private chat transcripts are kept in app memory and cleared when you leave, sign out, or revoke consent; we do not intentionally save them to our database.

CSV statements and their selected source remain in this tab’s memory across website pages for the same verified identity. Reload, tab closure, logout (including pending/failed logout), account change or Clear imports removes them from the feature. Local merchant/summary and recurring answers use confirmed records without AI or bank-summary consent and state record-date coverage, not guaranteed complete statement coverage. The CSV-source Coach never falls back to a bank/model request, and its conversation clears on leaving or source/record changes. Connected-bank coaching and ChargeWise remain separate; existing processor retention disclosures still apply to their separate network services.

Connected merchant and dated spending/category questions can be calculated on the server without sending transaction descriptions to a model, after verified access, consent and pause checks. Checking, savings and classified credit-card spending are supported; transfers and card payments are excluded, duplicate transaction identifiers counted once, currencies kept separate and credits not assumed to be proven refunds. Credit balances are not available cash, and this data does not establish complete cashflow or real-time monitoring.

ChargeWise case, draft and chat stay in app memory and clear on sign-out, unknown/different identity, background/leave/unmount or new case. Revoking its case AI opt-in aborts AI and clears conversation/approval; it cannot recall delivered data. Explicit web copy/.txt download or native share/selectable copy creates an external copy outside app control. No case/consent/approval/filing receipt is saved. Local accuracy approval is not a signature, legal acceptance or submission. store:false remains a request option only; processor/SDK/hosting retention, telemetry and training are unverified.

5. Sharing

We share information with service providers that help run NuvoCent, including Plaid, authentication/hosting and AI processing, and as required by law or to protect users and the service.

6. Retention

We keep information while needed for the beta. We do not currently promise specific retention periods. [Owner/counsel: set periods after reviewing provider terms.]

7. Your controls

- Disconnect a bank in My Bank; this stops new reads. We remove our stored data for that connection after Plaid confirms the connection was removed, which may be delayed while we retry. This does not guarantee erasure from Plaid, your bank, other processors or backups.

- Revoke AI consent in My Bank; this stops new AI use of your bank summaries. It does not recall information already sent.

- In the iPhone app, these controls open My Bank on the website in a separate browser.

- Full account deletion: a self-service full account deletion feature is not yet available. Contact [Privacy/support contact] to request deletion. This must be resolved before any public launch.

Depending on where you live, you may have rights to access, correct, delete or port your data, or to object; contact us to exercise them.

8. Security

We use measures such as encryption of bank access tokens, per-user access controls and verified sign-in. No system is perfectly secure.

9. Children

NuvoCent is only for people who are at least 18 and have reached the age of majority where they live, and is not directed to children.

10. Changes

We will post updates and notify you of material changes.