Privacy Policy
Effective Date: October 1, 2026
Last Updated: October 8, 2026
Calverda LLC ("Calverda," "we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, https://www.calverda.com (the "Site"); when you use the Calverda platform at https://app.calverda.com and our iPhone and iPad apps (together, the "Platform"); and when you contact us or otherwise interact with us. It also describes the rights and choices available to you.
Please read this Policy together with our Terms of Service. If you do not agree with our practices, please do not use the Site or the Platform.
1. Who We Are
Calverda LLC, 169 Madison Ave, Suite 15023, New York, NY 10016, is responsible for the personal information described in this Policy. The Platform is a private financial operations platform for businesses, family offices, and the individuals and families they serve. Access is available only to clients we approve.
When a client organization uses the Platform under a written agreement with us, we process the information it puts into the Platform on that organization's behalf and under its instructions. If you are a member of such an organization, you may also direct privacy requests to it.
2. Information We Collect
On the Site
The Site has no forms and no accounts. If you email, call, or write to us, we receive what you choose to send, such as your name, email address, phone number, organization, job title, and the contents of your message. We also collect aggregate, non-identifying usage statistics through cookieless analytics (Section 8).
On the Platform
- Account information: your name, email address, password (stored only as a salted hash), and two-factor authentication settings and backup codes.
- Financial account data from Plaid: when you connect a financial account, we receive the institution name, account names, account type, the last four digits of the account number, current and available balances, and transaction history (dates, amounts, descriptions, merchants, and categories). We do not receive or store your online banking username or password.
- Information you enter or upload: legal entities, assets, obligations, insurance, budgets, scenarios, tax information, notes, and documents such as statements, deeds, contracts, and tax returns. This may include sensitive information such as Social Security numbers, employer identification numbers, dates of birth, and full account numbers.
- Organization and membership information: the organizations you belong to, your role, and the invitations you send or receive.
- Security and usage information: IP address, browser and device type, approximate location derived from your IP address (country, region, city), login history, and an audit log of significant actions in your organization.
- Billing information: billing contact details and subscription history. Payment card and bank details are collected and held by Stripe; we receive only limited details such as card brand and last four digits.
- AI requests: if your organization turns on AI features, the questions you ask and the results returned (Section 6).
- Mobile app information: if you allow notifications in our iPhone or iPad app, a device token used to send them.
3. How We Use Information
We use personal information to:
- Provide the Platform, including cash flow, runway, liquidity, and consolidated reporting
- Connect and synchronize the financial accounts you choose to link
- Authenticate you, enforce two-factor authentication, and keep accounts secure
- Send transactional messages such as verification, security alerts, reminders, and invoices
- Bill for the Platform and keep financial records
- Provide AI features where your organization has turned them on
- Respond to inquiries and provide support
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Maintain and improve the Site and the Platform
- Comply with legal obligations and enforce our agreements
We do not sell personal information, share it for cross-context behavioral advertising, or use financial data for advertising or marketing. We do not use your data to train AI models.
4. Legal Bases for Processing (EEA and UK)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performance of a contract (providing the Platform you or your organization signed up for); legitimate interests (operating, securing, and improving the Site and Platform, where not overridden by your rights); consent (for example, connecting a financial account or enabling AI features, which you may withdraw at any time); and legal obligation.
5. Connecting Financial Accounts Through Plaid
We use Plaid Inc. ("Plaid") to gather your data from financial institutions. When you connect an account, you authorize Calverda and Plaid to access and transmit your personal and financial information from that institution on your behalf, and you agree to your information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.
You enter your bank credentials in Plaid's interface, not ours, and we never see or store them. Before you can connect an account, your Calverda login must use two-factor authentication. We use Plaid data only to provide the Platform to you and your organization.
You can disconnect an account at any time from its account page. Disconnecting deletes the stored access token and asks Plaid to remove the connection, which stops any further data from that institution. You can also manage the connections you have made through Plaid at my.plaid.com.
6. AI Features
AI features are off until an administrator of your organization turns them on and records consent. When they are on, the information needed to answer a request, which may include transaction descriptions and amounts, account names and balances, entity and category information, and the contents of documents you ask it to analyze, is sent to Anthropic through its commercial API. Under its commercial terms, Anthropic does not use this data to train its models and keeps it only for a limited period. An administrator can turn AI features off at any time.
9. Data Retention and Deletion
We keep personal information only as long as we need it for the purposes in this Policy, then delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Platform account and organization data | While your account or organization is active. Deleted within 30 days after you close it or ask us to delete it, as described below. |
| Bank connection credentials (Plaid access tokens) | Until you unlink the account. Unlinking deletes the token and removes the connection at Plaid. |
| Imported balances and transactions | Part of your organization's records until you delete them or close the organization. |
| Documents you upload | Until you delete them or close the organization. Uploads never completed are deleted after 24 hours. |
| Login history (IP address, device, approximate location) | 90 days after the session ends. |
| AI audit logs (what data an AI request used) | Your organization's setting: 90 days by default, adjustable from 1 to 365 days. |
| AI usage records (token counts and cost, no content) | While the organization is active, for billing. |
| Error reports | Up to 90 days. |
| Billing and tax records | As long as tax and accounting law requires, generally seven years. |
| Correspondence with us | As long as needed to respond and keep a record of the relationship. |
| Database backups | Expire on a rolling basis within 30 days, so deleted data leaves backups within 30 days of deletion. |
You can delete your own login from your account settings. An organization's data belongs to the organization, so closing an organization and deleting its data is done by its owner. To close an organization, or to ask us to delete specific information, email info@calverda.com. Before deleting, we disconnect every linked account at Plaid and offer you an export of your data. We may keep information where the law requires it, and we will tell you if we do.
10. How We Protect Information
- All traffic is encrypted with TLS 1.2 or higher, and browsers are required to use HTTPS
- The database and document storage are encrypted at rest with AES-256
- Plaid access tokens, Social Security numbers, employer identification numbers, dates of birth, account numbers, and two-factor secrets are additionally encrypted in our application with AES-256-GCM
- Two-factor authentication is required to connect a financial account and for all administrative access
- Each organization's data is isolated from every other organization's, and roles limit what each member can see and change
- Significant actions are recorded in an audit log available to your organization
- Error reports are scrubbed of credentials, cookies, and IP addresses before they leave our systems
- Access to production systems is limited to named personnel using multi-factor authentication and reviewed quarterly
No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
11. Where Information Is Processed
We are based in the United States and process personal information in the United States, except that Plausible processes aggregate Site statistics in the European Union. If you use the Site or Platform from outside the United States, your information will be transferred to the United States, where data protection laws may differ from those in your country.
12. Your Privacy Rights
Depending on where you live, you may have the right to:
- Know and access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your personal information
- Receive a portable copy of your information (the Platform also lets you export your data)
- Object to or restrict certain processing
- Withdraw consent, for example by disconnecting a financial account or turning off AI features
- Limit the use of sensitive personal information (we use it only to provide the Platform)
- Opt out of the sale or sharing of personal information (we do neither)
- Not be discriminated against for exercising these rights
California residents have these rights under the CCPA, as amended by the CPRA, and may use an authorized agent. Residents of other U.S. states with privacy laws have similar rights. EEA and UK residents may also lodge a complaint with their local data protection authority.
To make a request, email info@calverda.com. We will verify your identity, usually by confirming control of the email address on your account, and respond within 45 days, or sooner where the law requires. If you are denied, you may appeal by replying with "Privacy Appeal" in the subject line.
13. Children's Privacy
The Site and Platform are not directed to anyone under 18, and we do not knowingly collect their personal information. Where an organization records information about a minor family member, such as a beneficiary, it does so under its own responsibility. If you believe we hold information about a child that we should not, contact us and we will delete it.
14. Changes to This Policy
We may update this Policy to reflect changes in our practices or for legal reasons. We will revise the "Last Updated" date above and, for material changes, notify Platform users by email or in the Platform before the change takes effect.
15. Contact Us
For questions, concerns, or requests about this Policy or your personal information, contact us at: