Privacy Policy

This site has no forms, analytics or advertising cookies. Our host (Vercel) keeps standard server logs, such as IP address and pages requested, to run and secure the site. If you email us or book a call, we use what you send only to reply and to provide the services you ask about.

We use Plaid Inc. to connect bank and card accounts. You sign in on a page hosted by Plaid, or directly with your bank. We never see or store your bank username, password or security answers. When you connect, you authorize Plaid to share the information below with us. Plaid’s handling of your data is described in the Plaid End User Privacy Policy.

• Institution name, and account name, type and last four digits of the account number.
• Transactions: date, amount, merchant name, description, category and pending status.
• Connection status (for example, when a bank asks you to sign in again).

We do not request account balances, full account or routing numbers, identity information or investment data.

To protect the connection step, we also keep the account holder’s name and email (to send the private connect link), and their sign-in verification setup: an authenticator-app key, stored encrypted, and the public part of any passkey they add. A passkey’s private key and biometrics (Face ID, fingerprint) never leave their device.

Only to reconcile the business’s card and bank transactions against its own accounting and project records, on behalf of the business client that engaged us. That means matching charges to jobs, finding missing or duplicate expenses, and similar bookkeeping. We do not use it for advertising or marketing, we do not sell it, and we do not use it to make credit decisions.

• The business client that engaged us. It is their own account activity.
• Service providers that run the service for us, under confidentiality and security obligations: Plaid (account connection) and Google Cloud (hosting).
• When required by law, or to protect our rights or the security of the service.

We do not sell or rent personal information.

Data is sent only over TLS 1.2 or higher. It is stored on encrypted Google Cloud infrastructure, and the credentials that let us read your account are additionally encrypted (AES-256-GCM). Administrative access requires multi-factor authentication. Our Information Security Policy is available on request.

We keep connected-account data only while the business engagement is active and the data is needed for reconciliation. When an account is disconnected, we revoke our access through Plaid and delete its stored transactions and credentials. When an engagement ends, everything is deleted within 30 days, including the account holder’s contact details and verification setup. Encrypted backups expire within 14 days.

• Stop sharing at any time: disconnect through the Plaid Portal or your bank’s connected-apps settings, or ask us to disconnect.
• Access or deletion: email ak@jarvislabs.dev to ask what we hold about you or to have it deleted. We respond within 30 days.

Our services are for businesses and are not directed to anyone under 18.

We will post any changes here with a new effective date. Material changes will be communicated to affected business clients before they take effect. Questions: ak@jarvislabs.dev, Jarvis Labs LLC.