Privacy Policy

Information we collect

Depending on the accounts and features you authorize, we may receive:

• account identifiers, institution names, account names, types, subtypes, and masked account numbers;
• account balances and available-balance information;
• transaction information, including dates, amounts, merchant or counterparty descriptions, categories, and pending or posted status;
• investment accounts, holdings, securities, quantities, prices, cost basis, and investment transactions;
• credit-card, loan, and other liability information, including balances, payment information, interest rates, and due dates;
• connection status, consent, error, synchronization, device, security, and audit information; and
• information you provide when requesting support or exercising a privacy right.

We do not receive the username and password you enter at your financial institution. Plaid or the institution handles that authentication flow.

If you connect other sources or use other features, we may also receive:

• from QuickBooks Online: company name and identifiers, chart of accounts, accounting transactions, and financial reports, as described in QuickBooks Online data;
• from Gmail: messages in the mailbox you authorize that match the selections configured for your workspace, including sender, recipients, subject, date, message content, and supported attachments, as described in Google user data;
• from Google Drive: files, file names, file content, and file metadata in the shared drives you choose, as described in Google user data;
• your name, email address, and sign-in identifiers when you sign in to the application; and
• the questions you ask through Claude and the information our service returns to answer them, as described in Questions and AI-generated answers.

Sources of information

We receive information directly from you; from financial institutions and other sources you choose to connect through Plaid; from other accounting, email, file, or financial services you separately authorize, including Intuit QuickBooks Online, Gmail, and Google Drive; and automatically from your use of the application for security and operations.

How we use information

We use information to:

• connect and synchronize the accounts you authorize;
• provide financial organization, reporting, search, alerts, and answers to your authorized questions;
• maintain, secure, troubleshoot, and improve the application;
• prevent fraud, misuse, unauthorized access, and security incidents;
• respond to support and privacy requests; and
• comply with law, contracts, and valid legal process.

We do not initiate payments or transfers through Plaid. We do not sell consumer financial information, use it for targeted advertising, or use it to make automated credit, employment, housing, insurance, or eligibility decisions.

Consent and account connections

We obtain your affirmative consent before Plaid Link is displayed and before we collect, process, or store information from a connected financial institution. Plaid Link separately displays the data and accounts you are authorizing. We record the applicable policy version, consent time, authorized data categories, and connection.

You may revoke access by disconnecting an institution in the application, through the applicable financial institution or Plaid consumer portal, or by contacting us. Revocation stops future collection after the disconnection is processed but does not require deletion of information that we must retain by law or for a documented legal claim.

Plaid’s own collection and processing are governed by the Plaid End User Privacy Policy.

QuickBooks Online data

When an authorized user connects a QuickBooks Online company, Intuit’s authorization screen shows the access being granted. We use that connection read-only to retrieve the company’s name and identifiers, its chart of accounts, its accounting transactions (purchases, deposits, transfers, journal entries, bills, bill payments, customer payments, and vendor credits), and standard reports (profit and loss, balance sheet, statement of cash flows, and trial balance).

We use QuickBooks data only to provide the service to the family that connected it: reconciling the books with bank and document records, reporting, and answering that family’s authorized questions. We do not create, change, or delete anything in QuickBooks. We do not sell QuickBooks data, use it for advertising, or make it available to anyone other than the family’s authorized users and the providers described in How we disclose information. QuickBooks connection tokens and company identifiers are encrypted at the application level before they are stored.

You may disconnect a QuickBooks company at any time in the application, from within QuickBooks Online, or by contacting us. When a company is disconnected, we stop collecting its data, revoke or delete its connection tokens, and handle information already collected as described in Retention and deletion. Intuit’s own handling of your information is governed by the Intuit Global Privacy Statement.

Google user data

What we access

• Gmail (read-only). With the mailbox owner’s authorization, we use Google’s read-only Gmail permission (gmail.readonly) to read messages in the family office mailbox that match the search, label, or sender selections configured for the family’s workspace, including sender, recipients, subject, date, message content, and supported attachments. We cannot send, delete, or change mail.
• Google Drive (read-only). For a shared drive the family chooses, the family adds a Google service account operated for its workspace as a member. We read the files in the shared drives configured for that family’s workspace, including file names, content, and metadata. We cannot change or delete files.

How we use it

We use Google user data only to provide and improve the user-facing features of Family Office Core for the family that authorized it: indexing the selected messages and files in that family’s private workspace, keeping that index current, and letting the family’s authorized users search and ask questions about them.

How we transfer it

We transfer Google user data only as needed to provide those features: to Adapter, which indexes and retrieves the information on our behalf, and, when an authorized user asks a question through Claude, to that user’s Claude session as described in Questions and AI-generated answers. We may also transfer it when necessary to comply with applicable law or to protect against fraud, abuse, or security threats, or as part of a merger, acquisition, or sale of assets with notice to you.

What we do not do

• We do not use or transfer Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
• We do not sell Google user data, or transfer it to data brokers or information resellers.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not use Google user data, or any other information from connected sources, to develop, improve, or train generalized artificial-intelligence or machine-learning models, and we do not authorize our service providers to do so.
• We do not allow people to read Google user data unless you have given affirmative agreement for specific messages or files, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Revoking access

You can remove the Gmail permission at any time from your Google Account’s third-party access settings, remove the workspace’s service account from a shared drive, disconnect the source in the application, or contact us. Removal stops future collection; information already collected is handled as described in Retention and deletion.

Questions and AI-generated answers

Adapter, our evidence-processing provider, indexes the information from your connected sources in an index kept separately for your family, and retrieves it to answer questions on our behalf.

Family Office Core lets authorized users ask questions through Claude, an AI assistant provided by Anthropic. When you connect Claude to Family Office Core and ask a question, Claude sends the question to our service, and our service returns relevant information from your family’s workspace to your Claude session. Anthropic processes your questions, the returned information, and Claude’s responses under your own agreement with Anthropic and your Claude account settings, including any setting that governs whether your conversations may be used to improve Anthropic’s models. We recommend reviewing those settings before connecting.

AI-generated answers can be incomplete or wrong. They are not financial, tax, legal, or investment advice and should be checked against the source records.

How we disclose information

We disclose information only as needed to operate the service or as required by law, including to:

• Plaid and connected financial institutions;
• Intuit and Google, to the extent needed to maintain the connections you authorize;
• Adapter, which indexes and retrieves information from connected sources to answer questions on our behalf;
• Anthropic, through Claude, when an authorized user asks a question as described above;
• approved cloud hosting, database, authentication, evidence-processing, monitoring, and support providers acting for us;
• professional advisers subject to confidentiality obligations;
• a successor in a merger, financing, reorganization, or sale, subject to applicable law; and
• government authorities or other parties when required by valid legal process or necessary to protect rights, safety, and security.

Service providers may process information only for documented purposes and are subject to contractual and security review. We do not allow them to use consumer financial information for their independent advertising purposes.

Security

We use administrative, technical, and organizational safeguards designed to protect information. These include sign-in through a managed identity provider, a sign-in within the last hour before a source can be connected or disconnected, role-based access control, encryption using TLS 1.2 or better in transit, encryption of all persisted Plaid consumer data at rest, additional application-level AES-256-GCM encryption for long-lived connector tokens, logging, dependency and secret scanning, and a separate application environment and database for each client.

No security program eliminates all risk. If a security incident affects your information, we will investigate and provide notices required by law or contract.

Retention and deletion

We retain information only for the period needed to provide the service, meet legal and contractual obligations, resolve disputes, and maintain necessary security and audit records.

After a verified deletion request or service termination, we delete consumer financial information from active systems within 30 days unless a documented legal hold or mandatory retention requirement applies. Protected backup copies expire within 90 days and are not restored for ordinary business use. Connection credentials are revoked or deleted promptly when an account is disconnected. We retain a minimal record of the request and its completion when necessary to demonstrate compliance.

Our retention schedule and deletion procedures are reviewed at least annually and after material changes.

Your privacy rights

Subject to applicable law, you may ask us to:

• confirm whether we process your information and provide access to it;
• correct inaccurate information;
• provide a portable copy of information you supplied or authorized;
• delete information;
• revoke consent or disconnect an account; and
• appeal a denied request where applicable.

Submit a request to privacy@wesleydickens.com. We will verify your identity and authority before acting. We acknowledge requests within 10 days and aim to complete them within 30 days, or sooner when required by law. We will not discriminate against you for exercising a privacy right.

Children’s privacy

The application is not directed to children under 18, and we do not knowingly collect their financial information through Plaid.

Changes to this policy

We review this policy at least annually and when our data practices materially change. We will post the revised policy with a new “Last updated” date and provide additional notice when required.

Contact