Privacy Policy

Corsac Vantage LLC operates Financial Command Center. We are deeply committed to protecting your financial data and personal information. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

We collect the following categories of information to provide and improve our service:

• Account information: Your name and email address provided during registration.
• Financial data: Account balances, transaction history, and investment holdings retrieved via Plaid with your authorization.
• Self-reported data: Credit scores, manually entered assets, and financial goals you choose to add.
• Usage data: Features used, pages visited, and session duration to help us improve the platform.
• Payment information, which we do not hold. Card details go directly to Stripe and never reach our servers. We do not receive or store your full card number, expiration date, or security code. What we keep is a Stripe token that lets us bill the card, the card brand, and the last four digits, so you can tell which card is on file, along with your billing history.

• To provide and continuously improve Financial Command Center.
• To generate AI-powered financial insights via Anthropic Claude.
• To process subscription payments via Stripe.
• To send product notifications and important account updates.

Financial account connections are powered by Plaid Technologies Inc. When you connect a financial account, your credentials are handled directly by Plaid, we never see or store your banking username or password.

• We have read-only permissions only. We cannot initiate transactions, transfer funds, or modify your accounts.
• With your authorization, we retrieve the following categories of data from your financial institutions via Plaid: account information (name, type, mask, balances), transaction history (dates, amounts, merchant descriptions, categories), and, where you enable them, liabilities (loan balances, APRs, due dates) and investment holdings.
• You can revoke access at any time by disconnecting an institution in Settings → Connected Accounts, or by emailing info@corsacvantage.com to request disconnection and deletion of the associated data.
• We never sell or share data obtained through Plaid with third parties for their own use, and we do not use it for advertising.
• Plaid's privacy policy is available at plaid.com/legal/end-user-privacy-policy.

When you use Vantage AI, relevant financial data from your account is sent to the Anthropic Claude API to generate personalized insights and recommendations.

• We do not store individual AI conversations beyond your current session.
• Daily insight summaries generated by Vantage AI are saved in your account for your reference.
• Anthropic's use of data submitted through their API is governed by their Privacy Policy.

• All data is stored with AES-256 encryption at rest.
• All data is transmitted using TLS 1.3 encryption in transit.
• Row Level Security (RLS) is enforced at the database level, ensuring each user can only access their own data.
• We do not store your bank credentials, Plaid handles all financial institution authentication directly.

Internal access. Access to user data inside Corsac Vantage is governed by least-privilege: no one browses user financial data in the course of normal operations. Privileged (administrative) access is limited to designated personnel, used only to operate the service, support you have requested, security investigation, billing reconciliation, or a legal obligation, and runs through audited, server-side credentials that are never exposed to the browser. We never access your data out of curiosity, for marketing, or to train models.

People you choose to share with. If you invite a partner, household member, advisor, or accountant to see your finances, they see what you granted them, either everything or the specific accounts and items you selected, for as long as you leave the grant in place. This is the one way your financial information reaches another person, and it happens only because you asked for it. You can revoke at any time, on your own, without their agreement and without asking us.

If you and a partner have each granted the other access, we also show both of you a single combined household figure. It is the sum of what each of you contributed, so you both see the same number, and anything either of you held back is not in it. Ending the share ends the combined figure. It never moves, merges, or gives away anything in your own account.

We share your data with the following service providers, who operate parts of the platform:

• Plaid Technologies Inc., for financial account connections.
• Anthropic, for AI insight generation via the Claude API.
• Stripe, for secure payment processing.

Beyond the people you grant access to and the providers above, we do not share your data with any other third party, and we do not disclose it except where the law requires it. We do not sell your data. Ever.

You have the following rights with respect to your personal data:

• Access: Request a complete copy of all data we hold about you.
• Correction: Update or correct inaccurate personal information.
• Deletion: Request complete deletion of your account and all associated data within 30 days.
• Portability: Export your transaction data as CSV at any time from the Reports page in your dashboard.

To exercise any of these rights, email us at AISolutions@CorsacVantage.com.

• Active accounts: Data is retained for the duration of your subscription.
• Deleted accounts: All personal data is permanently purged within 30 days of a deletion request.
• Transaction data: May be retained for up to 7 years to comply with applicable financial and legal regulations.

• We use only essential cookies required for authentication and session management.
• We do not use advertising or tracking cookies of any kind.
• We do not use third-party analytics cookies.

California residents have specific rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information is collected about you.
• The right to delete personal information we hold about you.
• The right to opt out of the sale of personal information, we do not sell your data, so this right is inherently satisfied.

To exercise your CCPA rights, contact us at AISolutions@CorsacVantage.com.

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island, have rights similar to those described in the California section above. Depending on your state, these include the right to:

• confirm whether we process your personal data and access it;
• correct inaccuracies in your personal data;
• delete personal data you provided or we obtained about you;
• obtain a portable copy of your data in a usable format;
• opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects; and
• appeal a decision we make about a privacy request.

We do not sell your personal data, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We do not sell or share the personal data of anyone under 16.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal where your browser sends it, and we treat it as a valid opt-out request under the laws that recognize it.

How to exercise your rights. Email AISolutions@CorsacVantage.com from the address on your account, or use the export and delete controls in your account settings. We respond within 45 days and may extend once where the law allows, and we will tell you if we do. We will not discriminate against you for exercising a privacy right.

Appeals. If we decline your request, you may appeal by replying to our decision with the word Appeal. We will respond in writing within 45 days with our decision and the reasons for it. If your appeal is denied, you may contact your state attorney general.

Authorized agents. You may use an authorized agent to submit a request. We will ask for proof of the agent's authority and may ask you to verify your identity directly.

Because Financial Command Center works with information from your financial accounts, we treat all of it as nonpublic personal information and hold it to the standard the Gramm-Leach-Bliley Act sets for financial institutions, whether or not that law applies to us directly.

In practice, that means:

• We do not sell your financial information. Not to data brokers, not to advertisers, not to lenders, not to anyone, and there is no opt-out to manage because there is no sharing to opt out of.
• We share it only as described in Data Sharing above: with the service providers who make the product work, with people you explicitly grant access to such as a partner or advisor, and where the law requires it.
• We do not share it with affiliates for their own marketing.
• We maintain administrative, technical, and physical safeguards designed to protect it, and we restrict internal access to the small number of people who need it to operate or support the service.

Your financial institution has its own privacy notice governing what it shares with Plaid and with us. Those notices are separate from this one and we do not control them.

If we determine that a security incident has compromised the security, confidentiality, or integrity of your personal information, we will notify you without unreasonable delay, and in any event within the timeframe required by the law of your state, using the email address on your account.

Our notice will describe what happened, the categories of information involved, what we have done in response, and the steps we recommend you take. Where the law requires it, we will also notify the relevant regulators and, if applicable, the consumer reporting agencies.

We will not delay a notice to you in order to complete our own investigation, except where a law enforcement agency asks us in writing to do so.

Financial Command Center is operated from the United States and is intended for use by residents of the United States. Your information is stored and processed in the United States.

If you access the service from outside the United States, you do so on your own initiative and are responsible for compliance with your local law. By using the service, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

We do not currently offer the service in the European Economic Area, the United Kingdom, or Switzerland, and we do not target users in those regions.

Financial Command Center is a financial service for adults. It is not directed to children, it is not intended for users under the age of 18, and you must be at least 18 to open an account. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 as that term is used in the Children's Online Privacy Protection Act (COPPA).

If we learn that we have collected personal information from someone under 18, we will delete it and close the account.

For parents and guardians. If you believe a child has provided us with personal information, email AISolutions@CorsacVantage.com with the account email address. We will confirm, delete the information and the account, and write back to tell you it is done. You do not need an account with us to make this request, and we will not ask you for anything beyond what we need to find the record.

We also do not sell or share the personal data of anyone under 16, as described in Other State Privacy Rights above.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify users of any material changes via email and in-app notification before the changes take effect.

If you have questions about this Privacy Policy or how we handle your data, please contact us: