Privacy Policy

Last updated: [DATE]. This policy applies to Navazia Pulse, available at navaziapulse.com.

The short version

We collect what you tell us and what's in the statements you upload. We use it to make the app work and to help you understand your money. We don't sell your data. You can download or delete your data anytime. We use Anthropic's Claude AI to read your statements and help with coaching — your data is never used to train AI models. If you have questions, email privacy@navaziapulse.com.

Who we are

Navazia Pulse ("Pulse," "we," "us") is a personal finance app operated by [Navazia Pulse], a California limited liability company. Our mailing address is [BUSINESS ADDRESS].

You can reach us at:

General questions: support@navaziapulse.com
Privacy questions or data requests: privacy@navaziapulse.com

What we collect

Information you give us directly

Account information: your first name, last name, email address, and password (which we store as a bcrypt hash — we never see your actual password).
Optional contact: WhatsApp number (only if you provide it, used for coaching messages you opt into).
Location context: ZIP code (optional, used to personalize cost-of-living advice).
Onboarding context: information you share during signup to help us personalize the app — age range, household size, income range, pets, and similar lifestyle questions.
Financial data you upload: bank, credit card, and loan statements you upload as PDF files, plus any transactions, bills, goals, or accounts you enter manually.
Your preferences: language, theme, background, notification settings, and similar.

Information we collect automatically

Timezone: we detect your browser's timezone so timestamps in our emails are shown in your local time.
IP address for security events: when you request a password reset, change your password, or verify your email, we record the IP address that made the request. This helps us detect abuse. We do NOT log IP addresses for normal app activity.
Session information: when you sign in, we record device and browser details so you can see your active sessions in Settings and revoke any you don't recognize.
Browser storage: we use your browser's local storage to remember your language and theme preferences, and session storage to keep you signed in. We do NOT use tracking cookies.

Information from third parties

Currently: none. We only have data you give us directly. In the future, if you connect a bank account via Plaid (a planned feature for a future tier), we would receive transaction data from your bank through Plaid. We will update this policy and notify you before introducing such features.

How we use your information

To run the app: show you your transactions, balances, bills, goals, debts, and loans; categorize spending; calculate savings recommendations and debt payoff plans.
To process statements with AI: when you upload a statement, we send the PDF to Anthropic's Claude AI to extract transactions, balances, and other structured data. See "AI processing" below for details.
To send you transactional emails: account verification, password resets, password-change confirmations, and (if you opt in) coaching messages.
To improve the app: understanding which features get used (in aggregate, not at the individual level).
To keep the app safe: detecting abuse, fraud, or unauthorized access.
To comply with the law: responding to legal requests, enforcing our Terms.

AI processing — what you should know

This deserves its own section because it's where many users have questions.

When AI sees your data

Statement parsing: when you upload a PDF statement, the entire document is sent to Anthropic's Claude AI. This includes account numbers, names, addresses, every transaction line, and balances visible in the PDF. The AI must read the whole document to extract structured data. We do NOT redact or sanitize the PDF before sending — doing so would prevent the AI from doing its job.
Transaction categorization: transaction descriptions (e.g. "STARBUCKS #1234 SEATTLE WA") are sent to AI to suggest categories.
Coaching and tips: when you ask the AI a financial question, a limited summary of your financial context (recent transactions, account summaries) is sent so the AI can give relevant advice.

What Anthropic does with your data

Under Anthropic's API terms applicable to our usage:

Your data is never used to train Anthropic's AI models.
API logs are retained for a limited period (approximately 30 days) for service operation and abuse prevention, then automatically deleted.
Anthropic does not share your data with other API customers or for advertising.

You can read Anthropic's terms at anthropic.com/legal.

Who we share your information with

We do not sell your personal information. We do not share it for advertising or marketing.

We share information only with these service providers, who help us run the app:

Supabase — our database provider. They host the data we store on your behalf. Supabase privacy policy
Netlify — our website and server hosting. They handle traffic, including IP-level information at the infrastructure level. Netlify privacy policy
Anthropic — AI processing for statement parsing, categorization, and coaching, under their API terms (see above).
Resend — sends our transactional emails (welcome, password reset, password-changed confirmations, etc.). Resend privacy policy
Stripe — payment processing for paid tiers. Stripe handles card data directly; we never see your full card number. Stripe privacy policy

We may also share information when legally required (court order, subpoena, valid legal process) or to protect rights, safety, and property.

Potential future sharing — partner deals

We are exploring features that may, in the future, offer you personalized partner deals (such as discounts on services that fit your spending patterns). If we introduce such features, we will update this policy before the change takes effect, and any such sharing will require your explicit opt-in. You will never be enrolled in partner-data-sharing without your active consent.

Business transfers

If Pulse is acquired by, merged with, or sells substantially all of its assets to another company, user information may transfer as part of that transaction. We will notify you by email and via the app if this happens, so you can review the new owner's privacy practices before continuing.

How long we keep your data

Active accounts: we keep your data for as long as your account is active.
Inactive accounts: if you don't sign in for 24 months, we will email you a warning at 18 and 23 months, and automatically delete your account and data at 24 months of inactivity.
Deleted accounts: when you delete your account from Settings, your account and personal data are permanently and irreversibly deleted from our active systems immediately. You will not be able to recover your account once deleted.
Backups: our backups are encrypted and rotate on a 30-day cycle. Your deleted data is fully purged from backups within 30 days of deletion.
Soft-deleted statements: if you delete a statement (not your account) from within the app, the statement and its transactions are marked deleted but kept in a recoverable state for approximately 30 days, during which you can undo the deletion. After that period, the data is permanently removed.
Legally required records: if you've made payments through Stripe, we may keep transaction receipts for the period required by tax law, typically 7 years. These records contain only payment metadata, not your detailed financial data.
Anthropic logs: as noted above, Anthropic retains API logs for a limited period independent of our retention. We have no ability to delete those logs faster.

Your rights

We give the same rights to all users, regardless of which state or country you live in. These rights include:

Access: see what data we have about you. You can do this directly in the app, or use our "Download My Data" feature in Settings.
Download: get a copy of your data in a portable format using the "Download My Data" feature in Settings.
Correction: fix any incorrect data. You can edit most things directly in the app; email us if you can't.
Deletion: delete your account and all your data from Settings, or by emailing us.
Object to processing: tell us to stop using your data for specific purposes. Note that some processing is required to run the app — if you object to all processing, the practical effect is account deletion.
Not be discriminated against: we won't degrade your service or charge you more for exercising any of these rights.

To exercise any of these rights, email privacy@navaziapulse.com. We respond within 30 days for most requests (45 days for complex ones, with notice).

California residents (CCPA / CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act. These are largely the same as the rights listed above, plus:

The right to know the specific categories of personal information we have collected about you and the categories of sources.
The right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising, so this is a non-event — but you have the right anyway.
The right to limit use of "sensitive personal information." Our use of sensitive personal information (such as account numbers in statements) is strictly limited to providing the service you requested.

You may also authorize an agent to make a request on your behalf. We will verify the agent's authorization before responding.

How we protect your information

Encryption in transit: all traffic between your device and our servers uses TLS encryption (HTTPS).
Encryption at rest: Supabase encrypts stored data using industry-standard methods.
Password protection: we store passwords as bcrypt hashes, an industry-standard one-way function. Even if our database were compromised, attackers would not see your actual passwords.
Database-level access control: we enforce row-level security on our database so that even if our application logic had a bug, your data would not be exposed to other users at the database layer.
Session security: when you change your password, we automatically sign you out of all other devices to protect against compromise.
Limited access: only the founder and (in the future) authorized employees can access user data, and only when necessary to support, debug, or improve the app.
No payment data on our servers: your full credit card information is handled by Stripe directly and never touches our servers.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you promptly as required by law.

Children

Pulse is not intended for users under the age of 18. We do not knowingly collect data from anyone under 18. During signup, we ask for your age range; users who select "Under 18" are not permitted to use the service and their accounts are immediately suspended. If you believe a child under 18 has created an account, please email privacy@navaziapulse.com and we will delete the account.

International users

Pulse is currently offered to users in the United States only. We are not actively serving users in the European Union, United Kingdom, or other jurisdictions outside the US. If you are accessing Pulse from outside the US, your data will be processed in the US, where data protection laws may differ from those in your country. By using Pulse, you consent to this processing.

Changes to this policy

We may update this policy from time to time. If we make material changes (changes that meaningfully affect your rights or how we use your data), we will notify you by email and via the app at least 30 days before the change takes effect. The "Last updated" date at the top of this policy tells you the most recent version.

Contact us

Privacy questions: privacy@navaziapulse.com
General support: support@navaziapulse.com
Mailing address: [BUSINESS ADDRESS]