Privacy Policy

This Privacy Policy explains how Plumb Finance Inc. ("Plumb," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Plumb app, our website at plumbfinance.com, and our related services (together, the "Services"). Plumb is a financial-wellbeing subscription that includes an AI money coach, cash-flow and net-worth tracking, and optional human financial counseling.

Counsel note: This policy is drafted as a nationwide baseline aligned to CCPA/CPRA and the ~20 state comprehensive privacy laws in effect in 2026, plus GLBA/Regulation P scoping. Because Plumb is very likely a GLBA "financial institution," GLBA-covered nonpublic personal information ("NPI") is handled under the separate GLBA Privacy Notice and is largely data-level-exempt from state privacy laws; non-NPI data (marketing, website analytics, app telemetry, prospect data) is in scope. Confirm the entity-name, the subprocessor list, and retention periods against signed vendor contracts and the data map before publishing.

1. The short version (plain-language summary)

We built Plumb to be paid for by you, not by advertisers or data brokers. That changes everything about how we treat your information.

• We will never sell your financial data. We do not sell your personal information for money, and we do not "share" your financial data for cross-context behavioral advertising in the CCPA/CPRA sense.
• We do not use your financial data for advertising. We do not run third-party advertising or retargeting cookies, and we do not build advertising profiles about you. The subscription is our entire business model.
• We never see your bank login credentials. Bank and account connections run through our open-banking aggregator, Array. Your bank credentials go to Array, not to us.
• You're in control. You can access, correct, delete, and port your information, opt out of any sale/share, limit the use of sensitive information, and ask us a question — see Section 10.
• You must be 18 or older to use Plumb. The Services are not directed to children.

The rest of this policy gives you the full detail.

2. Two kinds of data: GLBA financial data vs. everything else

Plumb is very likely a "financial institution" under the federal Gramm-Leach-Bliley Act ("GLBA"). That means the financial information we collect to provide your Services — for example, your bank-account and transaction data obtained through Array — is "nonpublic personal information" ("NPI") governed by GLBA and the FTC's Regulation P.

• GLBA-covered financial data (NPI) is described in our separate GLBA Privacy Notice, which controls how we collect, use, and share that data. Under most state privacy laws, GLBA NPI is exempt at the data level, so the specific state-law rights in Section 10 generally do not apply to that data. Our practices for NPI are still strict: we do not share it for marketing, and there is little or nothing for you to opt out of.
• All other personal information — for example, website and marketing analytics, app-usage telemetry not tied to providing the financial service, prospect and lead data, and support communications — is covered by this Privacy Policy and by applicable state privacy laws.

Counsel note: Several states (e.g., California, Connecticut, Montana, Minnesota, Oregon) narrowed or removed the entity-level GLBA exemption in 2025, leaving only a data-level NPI exemption. This policy therefore treats Plumb as in-scope for state privacy law as to all non-NPI personal data. Validate the NPI/non-NPI boundary against the data map.

Please read this Privacy Policy together with our GLBA Privacy Notice and our Cookie Policy.

3. Information we collect, and where it comes from

We collect the categories of personal information below. The table maps each category to a CCPA-style description, our sources, and whether we treat it as sensitive.

We flag financial-account and credential-related data and household/income data as "sensitive." We collect and use sensitive information only to provide and improve the Services you ask for — not for advertising or any unrelated purpose.

Sources, in summary: (a) directly from you; (b) automatically from your device and our app/website; (c) from Array, our open-banking aggregator, when you connect accounts; (d) from our payment processor; and (e) from our AI/model vendor and analytics provider acting on our behalf.

4. How and why we use your information (business purposes)

We use personal information for these business and commercial purposes:

1. Provide the Services — power the AI money coach, cash-flow and net-worth tracking, alerts, exports, year-end reports, and (if you choose) human financial counseling.
2. Account, billing, and subscription management — process payments, manage your tier and renewals, and provide receipts and required notices.
3. Personalize your coaching — generate insights, plans, and summaries tailored to your finances.
4. Communicate with you — service messages, security and renewal notices, and (with consent where required) product updates.
5. Security, fraud prevention, and integrity — protect your account and our Services, including under our Safeguards Rule program (Section 8).
6. Improve and develop the Services — analyze usage to fix bugs and build features. Where we use your content with our AI vendor, we contractually restrict the vendor from using it to train its general models except as needed to provide the service to us.
7. Legal and compliance — comply with law, respond to lawful requests, and enforce our terms.

What we do NOT do: we do not sell your personal information, and we do not use your financial data for advertising.

5. How we share information, and with whom

We share personal information only as described here. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Service providers / subprocessors (categories and named vendors):

• Array — open-banking aggregator that connects your financial accounts. Your bank credentials go to Array, not to us. Array operates under a written services agreement with Plumb that limits its use of your data to providing the connection service to us. Array’s own end-user terms and privacy commitments are published at array.com/legal.
• Payment processor — to process subscription payments and store payment tokens securely (we do not store full card numbers).
• AI / model vendor — to power the AI money coach. We contractually limit this vendor's use of your data to providing the service to us.
• Analytics provider — privacy-respecting, first-party analytics to understand and improve the Services (see our Cookie Policy).
• Operational vendors — hosting, email/notification delivery, customer support tooling, and print/fulfillment vendors.
• Human counselors — if you use counseling, the CFP/AFC professional who provides your session, under confidentiality obligations.

Each service provider is bound by contract to use personal information only to perform services for us, consistent with this policy.

Other limited disclosures:

• Legal and safety — to comply with law, legal process, or lawful government requests; to protect rights, safety, and property; and to prevent fraud or harm.
• Business transfers — if Plumb is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will require the successor to honor this policy or provide notice and choices consistent with applicable law.
• With your direction or consent — when you ask us to share, or otherwise consent.

Counsel note: Confirm the named subprocessor list and ensure each contract includes "service provider"/"processor" language (CCPA §1798.140) and the Safeguards Rule vendor-oversight terms. Add or remove named vendors to match production.

6. GLBA financial data (cross-reference)

The financial NPI we collect to provide the Services — your bank-account and transaction data via Array — is governed by our separate GLBA Privacy Notice, which describes what we collect, how and why we share it (we do not share it for marketing), and how we protect it. Because that data is GLBA NPI, the specific state-privacy rights in Section 10 generally do not apply to it, but our protections for it remain strict.

7. Cookies, analytics, and tracking

Plumb is built to avoid the ad-tech model. We do not use third-party advertising or retargeting cookies, and we do not sell or share your data for advertising. We use only strictly necessary, functional, and first-party analytics technologies. For full detail, categories, and controls, see our Cookie Policy.

We honor browser-based opt-out preference signals, including the Global Privacy Control ("GPC"), where applicable law requires. Because we do not engage in cross-context behavioral advertising, there is little or nothing to opt out of — but we still honor these signals as a "do not sell/share" request for any in-scope data.

8. How we protect your information (security)

Because Plumb is a GLBA financial institution, we maintain a written information security program designed to meet the FTC Safeguards Rule, including a designated qualified individual, risk assessments, access controls, encryption of data in transit and at rest, multi-factor authentication, vendor oversight, monitoring and testing, and a written incident-response plan. We will notify the FTC and affected consumers of qualifying security incidents as required by law (including, where applicable, notification to the FTC within 30 days of discovering a breach affecting 500 or more consumers).

No system is perfectly secure, but we work hard to protect your information and to limit who can access it.

9. How long we keep your information (retention)

We keep personal information only as long as needed for the purposes described in this policy, then delete or de-identify it. General guidelines:

Counsel note: Replace these guidelines with finalized retention periods per category from the data-retention schedule. CPRA and several states require specific periods or criteria.

10. Your privacy rights and how to exercise them

Depending on where you live, you may have some or all of the following rights as to personal information that is not GLBA NPI:

• Right to know / access — what personal information we collect, use, and disclose.
• Right to delete — request deletion of your personal information.
• Right to correct — fix inaccurate personal information.
• Right to portability — receive a copy in a portable format.
• Right to opt out of sale/sharing — though we do not sell or share for advertising, you may still submit a request (see "Do Not Sell or Share" below).
• Right to limit use of sensitive personal information — we already limit sensitive information to providing the Services, but you may submit a request.
• Right to non-discrimination — we will not deny service, charge a different price, or provide a different level of service because you exercised your rights.
• Right to appeal — if we deny your request, you may appeal (see below).

How to exercise your rights. Submit a request:

• by email to privacy@plumbfinance.com; or
• through the in-app or website privacy request form (where available).

We will verify your identity before fulfilling certain requests, to protect your information. You may use an authorized agent to submit a request on your behalf; we may require proof of the agent's authorization and verification of your identity.

Appeals. If we deny your request, we will tell you why and how to appeal. To appeal, reply to our decision or email privacy@plumbfinance.com with "Appeal" in the subject line. If you are unsatisfied with the outcome, you may contact your state attorney general.

Note on GLBA data. These rights generally do not apply to GLBA-covered financial data (NPI), which is handled under the GLBA Privacy Notice. Where a request would reach both NPI and non-NPI data, we will apply each set of rules to the appropriate data.

11. Do Not Sell or Share My Personal Information; Global Privacy Control

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because the ad-tech "sale/share" model does not apply to Plumb, our "Do Not Sell or Share My Personal Information" mechanism is largely confirmatory — but it is available to you. You can:

• email privacy@plumbfinance.com with "Do Not Sell or Share" in the subject line; or
• use the "Do Not Sell or Share My Personal Information" / "Cookie Preferences" links in our website footer.

We honor the Global Privacy Control (GPC) and similar universal opt-out signals as a valid opt-out of sale/share for any in-scope data, in the states that require it.

12. Sensitive personal information

We treat financial-account and credential-related data and household/income data as sensitive. We collect and use sensitive information only to provide and secure the Services you request — never for advertising, profiling unrelated to the Services, or sale. Because we do not use sensitive information beyond these purposes, the "limit the use of sensitive personal information" right has little to operate on, but you may still submit a request as described in Section 10.

13. Children

Plumb is for adults. You must be 18 or older to use the Services. We do not knowingly collect personal information from anyone under 18 (or from children under 13 under COPPA). If you believe a minor has provided us information, contact privacy@plumbfinance.com and we will delete it.

14. Where this policy applies (states and coverage)

Plumb serves users across the United States. This policy is a nationwide baseline built to satisfy California (CCPA/CPRA) and the other state comprehensive privacy laws in effect in 2026. Specific rights and processes may vary by state; we apply the protections required where you live. Plumb does not knowingly offer the Services outside the United States.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app, by email, or on our website. Your continued use of the Services after an update means you accept the revised policy.

16. Contact us

Questions, requests, or concerns about privacy:

• Privacy / rights requests: privacy@plumbfinance.com
• General support: support@plumbfinance.com
• Legal notices: legal@plumbfinance.com
• Mailing address (notices): Plumb Finance Inc., 30 N Gould St Ste N, Sheridan, WY 82801

Plumb Finance Inc. is a corporation formed in Wyoming.