Privacy Policy

1. Introduction

WealthVitals.io is operated by Robinson Consulting Group, LLC(“WealthVitals,” “we,” “us,” or “our”), which is the data controller responsible for your personal information. We provide a financial coaching application that helps you understand and improve your money habits. This Privacy Policy explains what information we collect about you, how we use and share it, the legal bases on which we process it, and the rights you have over your personal information. It applies to your use of the WealthVitals.io website, mobile experiences, and connected services (collectively, the “Service”).

By creating an account or using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

2. Information we collect

Account information

When you sign up, we collect your email address, a password (stored as a salted hash — we never see the plaintext), and, if you sign in with Google, your name and profile picture. We also store a two-factor authentication (TOTP) secret and recovery codes that you generate, used to verify your identity at each sign in.

Financial account data via Plaid

If you choose to link a bank, credit card, loan, or investment account, our partner Plaid Inc. (“Plaid”) collects your account credentials, account and routing numbers, balances, transaction history, identity information, and liability data, then shares that information with us so we can power coaching features. See Section 4 for details.

Information you provide

We store the information you enter into the Service, including budgets and transactions, debt accounts, assets, financial goals, credit scores, tax profile details, accreditation status, and messages you send to your coach or the AI assistant.

Documents you upload

You may upload documents such as accreditation letters, tax documents, credit reports, and asset documentation. These are stored in private storage buckets accessible only to you, your assigned coach, and authorized administrators.

Technical information

We automatically collect limited technical data such as IP address, browser type, device identifiers, and timestamps. We use cookies and similar technologies that are strictly necessary to keep you signed in and to operate the Service.

3. How we use your information

• Provide, maintain, and personalize the Service.
• Calculate your financial health score, budget vitals, debt strategy, and other coaching insights.
• Power AI-assisted explanations and suggestions you request.
• Enable secure messaging between you and your assigned coach.
• Send transactional notifications (security alerts, bill reminders, replies).
• Detect, prevent, and respond to fraud, abuse, or security incidents.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your financial data to target advertising.

Legal bases for processing (GDPR / UK GDPR)

If you are in the UK, EEA, or another jurisdiction with similar laws, we rely on the following legal bases to process your personal information:

• Performance of a contract — to create and operate your account, deliver the Service, process subscriptions through Stripe, and provide customer support.
• Consent — to link a financial account via Plaid, to enable optional features, and to send non-transactional marketing communications. You may withdraw consent at any time.
• Legitimate interests — to secure the Service, prevent fraud and abuse, improve product quality, and communicate operational updates, balanced against your rights and interests.
• Legal obligation — to comply with tax, accounting, anti-money- laundering, and other applicable laws.

4. Financial account data via Plaid

We use Plaid to connect your financial accounts to WealthVitals.io. When you link an account, you authorize Plaid to access information from your financial institution on our behalf. Plaid acts as a data processor for us and may also process your information under its own End User Privacy Policy.

By connecting an account, you grant WealthVitals.io and Plaid the right to access and transmit your account information as described here and in Plaid’s policy. The categories of data we receive include account balances, transactions, account and institution identifiers, account holder identity, and (where applicable) liability details such as loan terms and APRs.

You can disconnect a linked account at any time from the Connected Accounts page. Disconnecting stops future data refreshes; previously imported transactions remain in your account until you delete them or close your account.

For more information about how Plaid handles your data, see the Plaid End User Privacy Policy.

5. AI assistant processing

When you use the AI assistant, we send the assistant’s prompt — which may include relevant context drawn from your account (e.g., budget categories, transaction summaries, the question you asked) — to a third-party large language model provider through the Lovable AI Gateway. We instruct providers not to train their models on your data. We do not send credentials, full account numbers, or document contents to the model unless you explicitly paste them into a prompt.

6. How we share information

We share information only as described below.

• Stripe (payment processor). Payments are processed by Stripe, which receives your name, email, billing address, and payment details to handle checkout, subscription management, payments, tax calculation, invoicing, and refunds. Stripe acts as an independent controller for that data under its own Privacy Policy.
• Service providers. Plaid (account aggregation), Lovable Cloud (database, authentication, file storage), Lovable AI Gateway (AI inference), and email delivery providers. Each is bound by contract to process your data only as we instruct.
• Your assigned coach. A human coach assigned to you may view your financial dashboard, messages, and uploaded documents in order to provide guidance.
• Administrators. Authorized WealthVitals staff may access data strictly to support, secure, and operate the Service.
• Legal and safety. When required to comply with law, valid legal process, or to protect the rights, property, or safety of users or the public.
• Business transfers. In the event of a merger, acquisition, or sale of assets, your information may transfer subject to the surviving entity honoring this policy.

We do not sell or rent your personal information to third parties.

7. Data storage and security

We follow industry-standard practices to protect your information:

• All traffic is encrypted in transit with TLS.
• Data at rest is encrypted on our infrastructure providers.
• Database row-level security ensures that one user can never query another user’s data.
• Two-factor authentication (TOTP) is required on every account, and recovery codes are stored only as one-way hashes.
• Privileged credentials (service keys, third-party API secrets) are stored server-side and never sent to the browser.
• Access to administrative tools is logged and limited to authorized staff.

No method of transmission or storage is 100% secure. Please use a strong, unique password and keep your authenticator device safe.

8. Data retention

We retain your information for as long as your account is active. If you delete your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, accounting, or fraud- prevention purposes. Backups may persist for a limited additional period and are overwritten on a routine schedule.

9. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your account and personal information.
• Export your data in a portable format.
• Withdraw consent and disconnect any linked Plaid accounts.
• Object to or restrict certain processing, and lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us using the details in Section 13. We will verify your identity before responding.

10. Children’s privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

11. International data transfers

We operate primarily from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other jurisdictions where our service providers operate. We rely on appropriate safeguards (such as standard contractual clauses) where required.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service before the changes take effect. The “Last updated” date at the top reflects the most recent revision.

13. Contact us

Questions, requests, or complaints about this policy or your personal information? Contact our privacy team at privacy@wealthvitals.io.