Privacy Policy

By using the Services, you acknowledge the practices described in this Privacy Policy. Your use of the Services is also governed by our Terms of Service.

1. Privacy Principles

VSTA is designed to help users understand and organize their finances. Because the Services process sensitive financial information, we follow these principles:

1. We collect and use personal information to provide, secure, maintain and improve the Services.
2. We do not sell connected financial-account data.
3. We do not use connected financial-account data to target third-party advertisements to you.
4. We do not store the username or password you use to access a connected financial institution.
5. We disclose personal information to service providers only as reasonably necessary to operate and support VSTA, as otherwise described in this Privacy Policy or at your direction.
6. We do not use or permit connected financial-account data to be used to train general-purpose artificial intelligence models.
7. You may disconnect financial accounts and request access to or deletion of your personal information, subject to legal and operational exceptions.

Certain privacy laws use broad definitions of terms such as “sell,” “share” and “targeted advertising.” Those terms may include some disclosures of website or device information through cookies and similar technologies even when no money is exchanged. Any such public-website tracking is addressed separately below and does not include the sale or use of your connected financial-account data for advertising.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information VSTA processes through the Services and through communications with us.

It does not apply to:

1. financial institutions, account aggregators or other third parties whose services you connect to VSTA;
2. websites, applications or services we do not own or control;
3. employment-related information concerning employees, contractors or job applicants; or
4. information that has been aggregated or deidentified so that it cannot reasonably be linked to an identifiable individual or household.

Third-party services maintain their own privacy policies. We encourage you to review those policies before providing information to them.

3. Personal Information We Collect

The information we collect depends on how you interact with VSTA and which features you use.

A. Account and Profile Information

When you create or manage a VSTA account, we may collect:

• your name;
• email address;
• telephone number, if you provide one or if telephone-based features are made available;
• login and authentication information;
• multi-factor authentication settings;
• profile information;
• communication preferences;
• subscription status;
• referral or promotional information, if those programs are offered; and
• other information you choose to add to your account.

If you use a third-party sign-in service, such as Google, we may receive information that you authorize that provider to disclose, such as your name, email address and account identifier.

B. Connected Financial-Account Information

When you choose to connect a financial account, VSTA uses third-party account-connection providers, including Plaid, to retrieve information that you authorize.

Depending on the account, institution, connection and VSTA features you use, we may receive:

• financial institution name;
• account name, type and subtype;
• masked account identifiers;
• current and available balances;
• transaction amounts, dates and descriptions;
• merchant, payee and counterparty information;
• transaction categories and merchant-location information associated with certain transactions;
• pending and posted transaction status;
• recurring-transaction and potential income patterns derived by VSTA or its providers from transaction history;
• account connection, authorization and synchronization status; and
• other account information you expressly authorize the provider to disclose.

VSTA currently uses connected financial information primarily to provide transaction tracking, financial organization, categorization, recurring-activity analysis, MoneyPaths, alerts and AI-powered insights. VSTA does not currently use connected account information to execute trades, initiate bank transfers, extend credit or provide investment-advisory services.

VSTA does not receive or store the username or password you use to sign into your financial institution. Authentication information needed to establish the connection is handled by Plaid, the financial institution or another applicable connection provider.

Plaid’s collection and use of information is governed by Plaid’s End User Privacy Policy and the notices shown during the account-connection process.

C. Information You Enter or Create

We collect information you provide or create through the Services, including:

• financial goals and preferences;
• transaction categories and corrections;
• budgets, buckets, MoneyPaths and rules;
• notes, labels and account nicknames;
• manually entered transactions, balances or accounts;
• anticipated income, expenses or financial events;
• feedback, ratings and survey responses;
• files or documents you upload, if that functionality is offered; and
• other information you choose to provide.

D. AI Conversations and Personalization Information

When you interact with VSTA’s AI features, we may collect and process:

• prompts, questions and instructions;
• AI responses;
• relevant connected financial information supplied to the AI feature;
• conversation history;
• feedback on AI responses;
• actions or features requested through the AI interface;
• preferences and facts you ask VSTA to remember; and
• technical information relating to the generation and delivery of responses.

VSTA may maintain conversation history and selected preferences or facts to make future interactions more useful and personalized.

We seek to send an AI service provider only the information reasonably necessary to respond to your request or operate the relevant feature. Depending on your question, that information may include transaction, balance, category, recurring-activity, goal or account information.

VSTA does not use or permit connected financial-account data, AI conversations or personalized financial information to be used to train a provider’s general-purpose AI models unless we first provide clear notice and obtain any consent required by law.

We may use aggregated, deidentified or non-financial product-usage information to evaluate and improve VSTA’s prompts, AI features, evaluation processes, safety systems and user experience.

E. Subscription and Payment Information

If you purchase a subscription, we and our payment processor may collect:

• name;
• billing address;
• payment method type;
• payment-card expiration information;
• transaction and receipt information;
• subscription plan;
• renewal and cancellation status; and
• limited payment identifiers supplied by the payment processor.

Full payment-card details are generally collected and processed directly by our payment processor rather than stored by VSTA.

F. Device, Usage and Log Information

When you use the Services, we may automatically collect:

• internet protocol address;
• browser type and version;
• device type and operating system;
• device identifiers;
• application version;
• referring and exit pages;
• dates and times of access;
• pages, screens and features viewed;
• buttons, links and functions used;
• session and diagnostic information;
• crash and performance information;
• approximate location derived from an IP address;
• security and authentication events; and
• cookie and similar technology information.

We use this information to operate, secure, troubleshoot, analyze and improve the Services.

G. Communications and Support Information

When you contact us, we may collect:

• your contact information;
• the content of your request;
• support correspondence;
• screenshots or files you provide;
• information needed to investigate account or connection issues; and
• records of our response.

Please do not send passwords, full payment-card numbers or other information that is not needed to resolve your request.

H. Information From Other Sources

We may receive information from:

• Plaid and other financial-account connection providers;
• financial institutions you authorize;
• authentication providers;
• payment processors;
• fraud-prevention and security providers;
• analytics and infrastructure providers;
• app stores, if VSTA distributes or bills through an app store;
• referral partners, if a referral program is offered;
• publicly available sources, if relevant to a feature you choose to use; and
• another user who invites you to a shared or household feature.

4. How We Use Personal Information

We may use personal information to:

A. Provide the Services

This includes using information to:

• create and maintain your account;
• connect and synchronize financial accounts;
• display balances and transactions;
• categorize and organize financial activity;
• identify recurring transactions and financial patterns;
• operate MoneyPaths, buckets, goals, rules and alerts;
• generate AI-powered responses, summaries and insights;
• personalize the Services;
• provide shared or household features;
• process subscriptions and payments; and
• respond to your requests.

B. Maintain and Improve the Services

We may use information to:

• analyze product usage and performance;
• develop and test new features;
• improve categorization and recurring-activity detection;
• evaluate the quality and safety of AI outputs;
• identify and correct errors;
• maintain integrations;
• conduct research and analytics; and
• create aggregated or deidentified information.

VSTA does not routinely review individual financial information or AI conversations. Authorized personnel and service providers may access such information when reasonably necessary to respond to a support request, investigate security or abuse, diagnose a product problem, comply with law or perform a specifically authorized evaluation using restricted access.

C. Communicate With You

We may use your information to send:

• verification and authentication messages;
• security alerts;
• financial-account connection notices;
• transaction or recurring-activity alerts you enable;
• subscription and payment communications;
• customer-support responses;
• service announcements;
• changes to our Terms or Privacy Policy;
• surveys and feedback requests; and
• marketing communications, where permitted.

You may unsubscribe from promotional email by following the instructions in the message. You may still receive non-promotional communications necessary to operate your account or provide the Services.

D. Protect VSTA, Users and Others

We may use personal information to:

• verify identity and account access;
• detect and prevent fraud, abuse and unauthorized access;
• investigate suspicious activity;
• enforce our Terms of Service;
• maintain the integrity and security of the Services;
• protect the rights, safety and property of VSTA, our users and others; and
• respond to security incidents.

E. Comply With Legal Obligations

We may use information to:

• comply with applicable laws, regulations and legal process;
• respond to lawful government, regulatory or law-enforcement requests;
• establish, exercise or defend legal claims;
• maintain legally required records; and
• satisfy tax, accounting, audit and compliance obligations.

5. How We Disclose Personal Information

We may disclose personal information to the following recipients.

A. Service Providers

We engage companies that process information on our behalf to help operate VSTA. These providers may include:

• financial-account connection providers, including Plaid;
• cloud hosting, database, storage and content-delivery providers;
• AI and machine-learning providers;
• authentication and identity providers;
• payment processors;
• email and communications providers;
• customer-support providers;
• product analytics and error-monitoring providers;
• cybersecurity, fraud-prevention and incident-response providers;
• accountants, attorneys, auditors and other professional advisers; and
• other vendors needed to provide the Services.

Service providers are permitted to process information only for the services they provide to VSTA, subject to applicable contractual, confidentiality, security and legal obligations.

B. Financial Institutions and Connection Providers

We disclose information to Plaid, financial institutions and other connection providers as necessary to establish, maintain, troubleshoot or revoke account connections and authorizations.

C. AI Providers

We may disclose prompts, relevant account information, transaction information and other necessary context to AI providers to generate responses and operate AI features.

As described in Section 3.D, VSTA does not authorize its AI providers to use VSTA customer data to train general-purpose AI models.

D. Payment and Subscription Providers

We disclose billing and subscription information to payment processors and, if applicable, app stores and related providers to process payments, manage subscriptions, prevent fraud and comply with financial and legal requirements.

E. Shared and Household Features

If you use a shared, household or collaborative feature, information may be visible to the people you invite according to the permissions and features available.

You are responsible for choosing whom to invite and reviewing what information is shared. Removing a person’s access does not prevent that person from retaining information they previously viewed, exported or otherwise obtained.

F. Legal, Safety and Security Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with law, regulation, subpoena, court order or legal process;
• respond to lawful requests from public authorities;
• investigate fraud, abuse, security incidents or violations of our agreements;
• protect the rights, property or safety of VSTA, our users or others; or
• establish, exercise or defend legal claims.

G. Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale of assets or similar business transaction.

Any successor receiving personal information will be required to process it consistently with applicable law and the privacy commitments that apply to the information.

H. With Your Direction or Consent

We may disclose information when you direct us to do so, authorize an integration, request that information be sent to another person or service, or otherwise consent to disclosure.

6. Sale, Sharing and Advertising

VSTA does not sell connected financial-account data.

VSTA does not use or disclose connected financial-account data for cross-context behavioral advertising, targeted advertising by third parties or the promotion of third-party financial products based on your transaction history.

We do not sell personal information in exchange for money.

We may use analytics, attribution or advertising technologies on VSTA’s public website to understand website traffic, measure marketing performance and reach people who may be interested in VSTA. These technologies may collect identifiers, device information, browsing activity and approximate location.

We do not permit advertising technologies placed on public marketing pages to access your connected financial-account data, AI conversations or authenticated VSTA financial dashboard.

Some state laws may define disclosures of public-website browsing or device information to advertising partners as a “sale,” “sharing” or “targeted advertising,” even where no money is exchanged. VSTA does not provide a general opt-out from these practices where an opt-out is not required by law. Where applicable law gives you an opt-out right and applies to VSTA, you may exercise that right by contacting hello@vstamoney.com, and VSTA will process qualifying browser-based opt-out preference signals as required by law.

7. Cookies and Similar Technologies

We and our service providers may use cookies, software development kits, pixels, local storage and similar technologies.

These technologies may be used for:

• authentication and account security;
• maintaining sessions and preferences;
• fraud detection;
• remembering choices;
• measuring website and product usage;
• diagnosing errors and performance issues;
• analytics;
• attribution and campaign measurement; and
• advertising on public marketing pages, where used.

You may control cookies through your browser settings and any cookie-preference controls we make available. Blocking certain cookies may prevent parts of the Services from functioning correctly.

VSTA does not currently respond to browser “Do Not Track” signals, which are not interpreted consistently across the industry. VSTA will recognize qualifying opt-out preference signals only where required by applicable law.

8. Aggregated and Deidentified Information

We may create information that has been aggregated or deidentified so that it cannot reasonably be linked to you or your household.

We may use and disclose aggregated or deidentified information for lawful purposes, including:

• measuring product performance;
• understanding broad financial and product-usage trends;
• improving categorization and AI features;
• developing new functionality;
• conducting research;
• maintaining security; and
• preparing internal or public reports.

We will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted by law to test whether our deidentification processes are effective.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, resolving disputes, enforcing our agreements and satisfying legal, accounting and regulatory obligations.

The retention period depends on:

• the type, amount and sensitivity of the information;
• the purposes for which it was collected;
• whether the information remains necessary to provide the Services;
• the potential risk of harm from unauthorized use or disclosure;
• contractual and legal obligations;
• fraud-prevention and security needs; and
• whether the information can be aggregated or deidentified.

While your account is active, we generally retain the information needed to provide the Services, including connected financial data, account settings, MoneyPaths and conversation history.

When you request deletion of your account, we generally delete or deidentify account and connected financial information from active production systems within 90 days, unless retention is necessary for a permitted purpose. Residual copies may remain in secured backups until they are overwritten through ordinary backup and recovery processes.

We may retain limited information for longer where necessary to:

• complete a transaction or process a refund;
• comply with tax, accounting or legal requirements;
• detect or prevent fraud and security incidents;
• maintain records of consent, deletion or privacy requests;
• resolve disputes;
• enforce our agreements; or
• establish, exercise or defend legal claims.

When you disconnect a financial account, VSTA will take reasonable steps to stop future retrieval through that connection. When you delete your VSTA account, VSTA will use available provider tools to revoke active Plaid or other account connections. Plaid, your financial institution and other third parties may retain limited information under their own privacy policies or as required by law, and you may also use their privacy tools separately.

10. Security

We use administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration and disclosure.

These safeguards may include:

• encryption of information in transit and at rest;
• access controls and authentication requirements;
• multi-factor authentication for sensitive systems;
• restricted production access;
• logging and monitoring;
• secure software-development practices;
• vendor security review;
• vulnerability management;
• backup and recovery measures;
• incident-response procedures; and
• employee and contractor confidentiality obligations.

No system, network, transmission or storage method is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered or destroyed without authorization.

You are responsible for protecting your account credentials, devices and authentication methods. Contact us promptly if you believe your VSTA account has been compromised.

11. Your Choices and Controls

A. Account Information

You may review or update certain profile and account information through the Services.

B. Financial Connections

You may disconnect a financial account through VSTA where that functionality is available. You may also be able to manage or revoke the connection through Plaid Portal or your financial institution.

Disconnecting an account stops future retrieval through that connection but may not automatically delete information previously received by VSTA. To delete previously received information, you should delete the account data or submit a deletion request.

C. AI Conversations and Memory

You may delete individual conversations or personalization information where those controls are available. You may also request deletion by contacting us.

Deleting a conversation may reduce VSTA’s ability to provide continuity or personalized responses.

D. Marketing Communications

You may opt out of promotional email by using the unsubscribe link in the message.

You cannot opt out of necessary service, security, legal, billing or account communications while maintaining an active account.

E. Cookies and Advertising Choices

You may manage cookies through your browser or any cookie-preference controls provided on our website.

F. Access, Export and Deletion

You may request:

• access to personal information we maintain about you;
• a portable copy of certain personal information;
• correction of inaccurate information;
• deletion of personal information; or
• additional information about our privacy practices.

Requests may be submitted by contacting hello@vstamoney.com.

Canceling a VSTA subscription does not automatically delete your VSTA account or personal information. To request account and data deletion, use any available account-deletion controls or contact hello@vstamoney.com.

12. U.S. State Privacy Rights

Depending on your state of residence and whether an applicable law covers VSTA’s processing, you may have the right to:

• confirm whether we process your personal information;
• access personal information;
• obtain a portable copy of personal information;
• correct inaccurate personal information;
• request deletion;
• obtain information about the categories of information collected, sources, purposes and recipients;
• opt out of the sale of personal information;
• opt out of sharing for cross-context behavioral advertising;
• opt out of targeted advertising;
• opt out of certain profiling that produces legal or similarly significant effects;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent where processing is based on consent;
• appeal the denial of a privacy request; and
• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

VSTA does not use AI features to make decisions that produce legal or similarly significant effects concerning credit, employment, housing, insurance or access to essential goods or services.

Submitting a Request. You may submit a request by emailing hello@vstamoney.com. Please describe the right you wish to exercise and provide sufficient information for us to locate your account.

We may need to verify your identity before completing a request. Verification may involve confirming control of the email address associated with your account, signing into your account or providing other reasonably necessary information.

We will use information submitted in connection with a privacy request only to verify and process that request, maintain legally required records and prevent fraud.

Authorized Agents. Where permitted by law, you may authorize another person to submit a request for you. We may require evidence of the agent’s authority and may ask you to verify your identity or confirm the request directly.

Appeals. If we deny a request and applicable law provides a right to appeal, you may appeal by replying to our decision or contacting hello@vstamoney.com with the subject line “Privacy Appeal.”

Non-Discrimination. We will not unlawfully discriminate against you for exercising an applicable privacy right.

13. California Privacy Notice

This section supplements the rest of the Privacy Policy for California residents.

During the preceding 12 months, VSTA may have collected the following categories of personal information:

• Identifiers, such as your name, email address, IP address, VSTA account identifier and device identifiers.
• Personal information described in California Civil Code Section 1798.80(e), such as your billing address and limited payment-related information.
• Commercial information, such as your VSTA subscription plan, payment history and use of VSTA features.
• Financial information, such as connected financial-account information, account names and types, balances, transaction history, merchant information and recurring financial activity.
• Internet or other electronic network activity information, such as device, browser, log, session and information about your interaction with VSTA’s website and applications.
• Approximate geolocation information, such as general location derived from your IP address. VSTA does not collect precise device geolocation unless we provide notice and obtain any permission required by law.
• Electronic information, such as AI conversations, customer-support communications and materials you submit to VSTA. If and when VSTA offers voice functionality, this may include voice transcripts and, only if VSTA retains them, audio recordings.
• Professional or employment-related information, such as employer or income-source information contained in connected transaction data or information you voluntarily provide.
• Inferences, such as recurring expense patterns, likely income or spending patterns, financial preferences, transaction categories and personalized insights derived from the information available through VSTA.
• Sensitive personal information, such as VSTA account login and authentication information that permits access to your VSTA account. VSTA does not collect or store the passwords you use to access your connected financial institutions.

We collect these categories from you, your devices, Plaid, connected financial institutions, service providers and other sources described in Section 3.

We use these categories for the business and commercial purposes described in Section 4.

We may disclose these categories for business purposes to the recipients described in Section 5, including financial-data providers, cloud and database providers, AI providers, authentication providers, payment processors, communications providers, security providers and professional advisers.

We do not sell personal information for money.

We do not sell or share connected financial-account data for cross-context behavioral advertising.

Public-website device and browsing information may be disclosed to analytics, attribution or advertising providers in a manner that may be considered “sharing” under California law. To the extent California law applies to VSTA and provides an opt-out right, California residents may submit a request by emailing hello@vstamoney.com. VSTA will also process qualifying opt-out preference signals where required by applicable law.

We use and disclose sensitive personal information only for purposes reasonably necessary to provide, secure and maintain the Services, process requests, prevent fraud, comply with law and for other purposes permitted without offering a right to limit under California law. We do not use sensitive personal information to infer characteristics about you for advertising purposes.

California residents may exercise the rights described in Section 12.

California’s “Shine the Light” law permits certain residents to request information about disclosures of personal information to third parties for their own direct-marketing purposes. VSTA does not disclose connected financial data to third parties for their own direct marketing.

14. Children’s Privacy

The Services are intended only for individuals who are at least 18 years old.

We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to VSTA, contact us at hello@vstamoney.com. We will take reasonable steps to investigate and delete the information where appropriate.

15. International Users

The Services are currently intended for users in the United States.

Personal information may be processed and stored in the United States or in other countries where VSTA’s service providers operate. Those countries may have privacy laws that differ from the laws where you live.

If we offer the Services in another country, we may provide additional notices and protections required by local law.

16. Third-Party Services and Links

The Services may contain links to or integrations with third-party websites, applications and services.

VSTA does not control the privacy practices of those third parties. Information you provide directly to a third party is governed by that party’s privacy policy, even when the third-party service is accessible through VSTA.

This includes Plaid, financial institutions, payment processors, app stores if used and any external services you choose to connect.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our data practices, service providers, technology or applicable law.

When we make changes, we will update the “Last Updated” date. If changes materially affect your rights or how we use sensitive information, we may provide additional notice through email, the Services or another appropriate method.

Where required by law, we will obtain consent before applying a material change to information previously collected.

18. Contact Us

For questions, complaints or privacy requests, contact:

VSTA LLC
68 Harrison Ave STE 605 NUM 781616
Boston MA 02111
hello@vstamoney.com

Privacy, Support, Legal: hello@vstamoney.com

Please include “Privacy Request” in the subject line when exercising a privacy right.