Privacy Policy

What we collect

Your account details (email, name), documents you upload, and — only if you connect Gmail on a paid plan — email metadata and the content of commercial messages (bills, receipts, agreements). We collect what's needed to find and dispute fees on your behalf, nothing more.

How your data is protected

• Document text, email content, access tokens, and the name and address we keep for your dispute letters are encrypted at rest (AES-256-GCM) with keys we control; stored files are additionally encrypted before they reach our storage provider.
• Social Security numbers (including last four), dates of birth, and card and bank account or routing numbers are removed from your documents and never stored. Your name and address are saved only in encrypted form and replaced in the document with a placeholder. Long account and card numbers are masked before any content is sent to our AI provider. Redaction is automated and best-effort, so please redact highly sensitive documents before uploading.
• All data in transit uses TLS.

What we never do

• We never sell your data or share it with the vendors you dispute.
• We never use your documents or email to train AI models, and our AI provider (Anthropic) does not train on data submitted via its API.
• We never send, modify, or delete your email — Gmail access is read-only, and our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep data

• Non-commercial email metadata: deleted after 30 days.
• Original uploaded files: not kept. As soon as a document is read, the original is replaced by a redacted copy (or deleted, if a redacted copy can't be verified).
• Redacted copies: deleted after 18 months (your fee analyses are kept).
• Disconnecting Gmail immediately deletes all stored email data.
• Account deletion: everything is permanently purged 30 days after your request (the grace period lets you change your mind).

Your rights

Export everything we hold about you (Settings → Export) or delete your account and all data (Settings → Delete) at any time, no questions asked. For anything else, contact us and we'll respond within 30 days.

Service providers

We use Vercel (hosting and file storage), Neon (database), Anthropic (AI analysis), Stripe (payments — we never see your card number), and Google (sign-in and, with your consent, Gmail access). Each receives only what its function requires.