VSTA Privacy Policy

This Privacy Policy describes our data practices and does not replace any separate notice or consent required by law. Your use of the Services is also governed by our Terms of Service.

1. Privacy Principles

VSTA is designed to help users understand and organize their finances. Because the Services process sensitive financial information, we follow these principles:

• We collect and use personal information to provide, secure, maintain and improve the Services.
• We do not sell connected financial-account data.
• We do not use connected financial-account data to target third-party advertisements to you.
• We do not store the username or password you use to access a connected financial institution.
• We disclose personal information to service providers only as reasonably necessary to operate and support VSTA, as otherwise described in this Privacy Policy or at your direction.
• We do not use connected financial-account data to train general-purpose artificial intelligence models, and we do not authorize AI providers to use your connected financial-account data, AI conversations, voice content, saved memories or personalized financial information for that purpose.
• You may disconnect financial accounts and request access to, correction of or deletion of your personal information, subject to applicable law and lawful exceptions.

Certain privacy laws use broad definitions of terms such as “sell,” “share” and “targeted advertising.” Those terms may include some disclosures of website or device information through cookies and similar technologies even when no money is exchanged. Any such public-website tracking is addressed separately below and does not include the sale or use of your connected financial-account data for advertising.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information VSTA processes through the Services and through communications with us.

It does not apply to:

• the independent processing activities of financial institutions, account aggregators or other third parties whose services you connect to VSTA;
• websites, applications or services we do not own or control;
• employment-related information concerning employees, contractors or job applicants; or
• information that has been aggregated or deidentified so that it cannot reasonably be linked to an identifiable individual or household.

Third-party services maintain their own privacy policies. We encourage you to review those policies before providing information directly to them. This exclusion does not remove VSTA's responsibility for processing that VSTA directs or that its service providers perform on its behalf.

3. Personal Information We Collect

The information we collect depends on how you interact with VSTA and which features you use.

A. Account and Profile Information

When you create or manage a VSTA account, we may collect:

• your name;
• email address;
• telephone number, if you provide one or if telephone-based features are made available;
• login and authentication information;
• multi-factor authentication settings;
• profile information, including a profile photo or profile-image URL if provided;
• communication preferences;
• subscription status;
• referral or promotional information, if those programs are offered; and
• other information you choose to add to your account.

If you use a third-party sign-in service, such as Google, we may receive information that you authorize that provider to disclose, such as your name, email address, account identifier and profile-image URL, where supplied.

Profile-photo files hosted by VSTA are available through publicly accessible image URLs. Anyone who has or obtains an image URL may be able to view the photo without signing into VSTA. Use a photo only if you are comfortable with that visibility, and do not upload an image containing financial documents or other information you want to keep private.

You may request removal of a profile photo by contacting hello@vstamoney.com. If a photo-removal control is available in the Services, you may also use that control. Removal does not recall copies that other people have already downloaded or retained. Retention and deletion are described in Sections 9 and 11.

B. Connected Financial Account Information

When you choose to connect a financial account, VSTA uses third-party account-connection providers, including Plaid, to retrieve information that you authorize.

Depending on the account, institution, connection and VSTA features you use, we may receive:

• financial institution name;
• account name, type and subtype;
• provider account identifiers and masked account numbers;
• current and available balances;
• transaction amounts, dates and descriptions;
• merchant, payee and counterparty information;
• transaction categories and transaction-associated merchant locations, including addresses, store numbers, latitude and longitude coordinates when supplied by the provider;
• pending and posted transaction status;
• recurring-transaction and potential income patterns derived by VSTA or its providers from transaction history;
• account connection, authorization and synchronization status;
• raw provider responses and associated metadata containing account and transaction information, including information not displayed in the app;
• an encrypted Plaid access token and related connection identifiers used to retrieve authorized account information over time; and
• other account information you expressly authorize the provider to disclose.

When a financial account is first connected, VSTA requests up to 730 days, approximately two years, of transaction history. The history actually returned depends on the institution and provider. We receive subsequent updates while the connection remains authorized and operational. The initial lookback is not a retention limit: the history accumulated during an ongoing connection may cover more than two years.

Merchant latitude and longitude can identify a specific store or transaction location. This information can reveal places associated with your financial activity. Receiving transaction-location information from Plaid is distinct from collecting your device's live GPS location.

VSTA currently uses connected financial information primarily to provide transaction tracking, financial organization, categorization, recurring-activity analysis, MoneyPaths, alerts and AI-powered insights. VSTA does not currently use connected account information to execute trades, initiate bank transfers, extend credit or provide investment-advisory services.

VSTA does not receive or store the bank username or password entered in the financial-account connection flow. Those credentials are handled by Plaid, the financial institution or another applicable connection provider. The encrypted Plaid access token stored by VSTA is a separate, long-lived connection credential used to retrieve authorized data; it is not your bank password.

Plaid's handling of information is described in its End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy and the notices shown during the account-connection process. VSTA's handling of information received from Plaid is covered by this Privacy Policy.

C. Information You Enter or Create

We collect information you provide or create through the Services, including:

• financial goals and preferences;
• transaction categories and corrections;
• budgets, buckets, MoneyPaths and rules;
• notes, labels and account nicknames;
• manually entered transactions, balances or accounts;
• anticipated income, expenses or financial events;
• feedback, ratings and survey responses;
• files or documents you upload, if that functionality is offered; and
• other information you choose to provide.

D. AI Conversations and Personalization Information

VSTA uses OpenAI for AI features, including text and voice conversations, saved memories, proactive suggestions and conversation titles. These features may process information during an interaction or in the background. We collect and process:

• prompts, questions, instructions and microphone audio submitted through voice features;
• AI responses;
• relevant connected financial information supplied to the AI feature;
• conversation history, voice transcripts and conversation titles;
• feedback on AI responses;
• actions or features requested through the AI interface;
• preferences, goals and other facts or inferences saved as memories, including memories created automatically without an explicit request to remember them; and
• technical information relating to the generation and delivery of responses.

VSTA saves conversation history and may automatically select or infer preferences, goals and other information from your conversations to personalize future interactions. You do not need to say "remember this" for a memory to be saved. Saved memories may be incomplete, inaccurate or outdated and may be used as context in later AI processing.

VSTA does not currently provide a dedicated screen to view or manage saved memories. You may request access to, correction of or deletion of saved memories by emailing hello@vstamoney.com. Section 11.C explains the difference between chat history, saved memories and support records.

VSTA sends OpenAI information needed for the AI feature being operated. Depending on the feature, this can include your messages, relevant conversation history, saved memories, preferences, and a financial snapshot containing balances, transactions, categories, recurring activity, bills, income, amounts, dates, goals and account information. The information sent varies by feature and context.

Some AI processing runs without a new chat message or an active conversation. For example, VSTA may send financial context to OpenAI to generate proactive suggestions, or process conversation content to create titles and save or update memories. Not opening a chat does not, by itself, stop these background features.

When you use voice and allow microphone access, microphone audio is sent to OpenAI to process and respond during the voice session. VSTA saves transcripts as ordinary chat messages. Audio and transcripts may contain sensitive information you speak or that is audible during the session. Voice transcription can contain errors. Only submit audio you have the right to share, and obtain any permission required before including another person's voice or private information. Provider processing and retention are described below.

We do not use connected financial-account data to train general-purpose AI models, and we do not authorize OpenAI or other AI providers to use your connected financial-account data, AI conversations, voice content, saved memories or personalized financial information for that purpose.

OpenAI processes information under the API services agreement applicable to VSTA. OpenAI's standard API terms restrict its use of customer content and provide that it will not use that content to develop or improve its services unless the API customer explicitly agrees. VSTA does not opt the information described in the preceding paragraph into that training use.

Restrictions on model training are separate from retention. OpenAI may process and retain information for service operation, security, abuse prevention and legal compliance under the applicable agreement and service settings. Some API features store application data. This Policy does not promise zero retention or immediate deletion of all provider copies. OpenAI's API data-control documentation is available at https://developers.openai.com/api/docs/guides/your-data.

We may use aggregated, deidentified or non-financial product-usage information to evaluate and improve VSTA's prompts, AI features, evaluation processes, safety systems and user experience. Saving a user-specific memory, generating an insight and evaluating a response are separate activities from training a general-purpose model. These activities remain subject to the purposes, access restrictions and training commitments in this Policy.

E. Subscription and Payment Information

If you purchase a subscription, we and our payment processor may collect:

• name;
• billing address;
• payment method type;
• payment-card expiration information;
• transaction and receipt information;
• subscription plan;
• renewal and cancellation status; and
• limited payment identifiers supplied by the payment processor.

Full payment-card details are generally collected and processed directly by our payment processor rather than stored by VSTA.

F. Device Usage and Log Information

When you use the Services, we may automatically collect:

• internet protocol address;
• browser type and version;
• device type and operating system;
• device identifiers;
• application version;
• referring and exit pages;
• dates and times of access;
• pages, screens and features viewed;
• buttons, links and functions used;
• session and diagnostic information;
• crash and performance information;
• approximate location derived from an IP address;
• security and authentication events; and
• cookie and similar technology information.

We use this information to operate, secure, troubleshoot, analyze and improve the Services.

G. Communications and Support Information

When you contact us, we may collect:

• your contact information;
• the content of your request;
• support correspondence;
• screenshots or files you provide;
• information needed to investigate account or connection issues; and
• records of our response.

Support records may include copies of relevant AI messages or conversations used to investigate or resolve an issue. These records are maintained separately from the conversation displayed in your chat history. Deleting that conversation does not automatically delete its support copy. We use and retain support records for the purposes and periods described in Sections 4 and 9; you may request deletion as described in Section 11.

Please do not send passwords, full payment-card numbers or other information that is not needed to resolve your request.

H. Information From Other Sources

We may receive information from:

• Plaid and other financial-account connection providers;
• financial institutions you authorize;
• authentication providers;
• payment processors;
• fraud-prevention and security providers;
• analytics and infrastructure providers;
• app stores, if VSTA distributes or bills through an app store;
• referral partners, if a referral program is offered;
• publicly available sources, if relevant to a feature you choose to use; and
• another user who invites you to a shared or household feature.

4. How We Use Personal Information

We may use personal information to:

A. Provide the Services

This includes using information to:

• create and maintain your account;
• connect and synchronize financial accounts;
• display balances and transactions;
• categorize and organize financial activity;
• identify recurring transactions and financial patterns;
• operate MoneyPaths, buckets, goals, rules and alerts;
• generate AI-powered text and voice responses, transcripts, summaries, conversation titles and proactive insights, including through background processing;
• personalize the Services using conversation history and saved memories, including automatically created memories;
• provide shared or household features;
• process subscriptions and payments; and
• respond to your requests.

Depending on the feature, these activities may occur automatically without a new chat message. For example, financial information may be processed to generate a proactive suggestion, and conversation content may be processed to create or update a saved memory. Section 3.D describes the information involved and Section 11 describes available controls.

B. Maintain and Improve the Services

We may use information to:

• analyze product usage and performance;
• develop and test new features;
• improve categorization and recurring-activity detection;
• evaluate the quality and safety of AI outputs;
• identify and correct errors;
• maintain integrations;
• conduct research and analytics; and
• create aggregated or deidentified information.

VSTA does not routinely review individual financial information or AI conversations. Authorized personnel and service providers may access such information when reasonably necessary to respond to a support request, investigate security or abuse, diagnose a product problem, comply with law or perform a specifically authorized evaluation using restricted access.

C. Communicate With You

We may use your information to send:

• verification and authentication messages;
• security alerts;
• financial-account connection notices;
• transaction or recurring-activity alerts you enable;
• subscription and payment communications;
• customer-support responses;
• service announcements;
• changes to our Terms or Privacy Policy;
• surveys and feedback requests; and
• marketing communications, where permitted.

You may unsubscribe from promotional email by following the instructions in the message. You may still receive non-promotional communications necessary to operate your account or provide the Services.

D. Protect VSTA Users and Others

We may use personal information to:

• verify identity and account access;
• detect and prevent fraud, abuse and unauthorized access;
• investigate suspicious activity;
• enforce our Terms of Service;
• maintain the integrity and security of the Services;
• protect the rights, safety and property of VSTA, our users and others; and
• respond to security incidents.

E. Comply With Legal Obligations

We may use information to:

• comply with applicable laws, regulations and legal process;
• respond to lawful government, regulatory or law-enforcement requests;
• establish, exercise or defend legal claims;
• maintain legally required records; and
• satisfy tax, accounting, audit and compliance obligations.

5. How We Disclose Personal Information

We may disclose personal information to the following recipients.

A. Service Providers

We engage companies that process information on our behalf to help operate VSTA. These providers may include:

• financial-account connection providers, including Plaid;
• cloud hosting, database, storage and content-delivery providers;
• AI and machine-learning providers, including OpenAI for the processing described in Section 3.D;
• authentication and identity providers, including Google when you choose Google sign-in;
• payment processors;
• email and communications providers;
• customer-support providers;
• product analytics and error-monitoring providers;
• cybersecurity, fraud-prevention and incident-response providers;
• accountants, attorneys, auditors and other professional advisers; and
• other vendors needed to provide the Services.

Providers processing information on VSTA's behalf are permitted to process it only for the services they provide to VSTA and other purposes permitted by applicable law and the agreements governing that processing, subject to confidentiality, security and legal obligations. Independent financial institutions and providers may also process information in their own capacity as described in their notices. Our use of any provider remains subject to VSTA's commitments in this Policy, including the AI-training restrictions in Section 3.D.

B. Financial Institutions and Connection Providers

We disclose information to Plaid, financial institutions and other connection providers as necessary to establish, maintain, troubleshoot or revoke account connections and authorizations.

C. AI Providers

We disclose information to OpenAI to operate the AI features described in Section 3.D. This includes relevant prompts, conversation history, saved memories, financial context, voice audio and related information, depending on the feature. Disclosures support both direct interactions and background tasks such as proactive suggestions, titles and memory processing.

The model-training restrictions and provider-retention explanation in Section 3.D apply to these disclosures. Naming OpenAI does not mean your use of VSTA is governed by the data-use settings of a separate personal ChatGPT account.

D. Payment and Subscription Providers

We disclose billing and subscription information to payment processors and, if applicable, app stores and related providers to process payments, manage subscriptions, prevent fraud and comply with financial and legal requirements.

E. Shared and Household Features

If you use a shared, household or collaborative feature, information may be visible to the people you invite according to the permissions and features available.

You are responsible for choosing whom to invite and reviewing what information is shared. Removing a person’s access does not prevent that person from retaining information they previously viewed, exported or otherwise obtained.

F. Legal Safety and Security Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with law, regulation, subpoena, court order or legal process;
• respond to lawful requests from public authorities;
• investigate fraud, abuse, security incidents or violations of our agreements;
• protect the rights, property or safety of VSTA, our users or others; or
• establish, exercise or defend legal claims.

G. Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale of assets or similar business transaction.

Any successor receiving personal information will be required to process it consistently with applicable law and the privacy commitments that apply to the information.

H. With Your Direction or Consent

We may disclose information when you direct us to do so, authorize an integration, request that information be sent to another person or service, or otherwise consent to disclosure.

I. Public Profile Photos

Profile-photo files hosted by VSTA are accessible through public image URLs as described in Section 3.A. This access is not limited to invited household members or people signed into VSTA. Photo-removal requests and the limits of removing previously copied information are addressed in Sections 3.A and 11.A.

6. Sale Sharing and Advertising

VSTA does not sell connected financial-account data.

VSTA does not use or disclose connected financial-account data for cross-context behavioral advertising, targeted advertising by third parties or the promotion of third-party financial products based on your transaction history.

We do not sell personal information in exchange for money.

We may use analytics, attribution or advertising technologies on VSTA’s public website to understand website traffic, measure marketing performance and reach people who may be interested in VSTA. These technologies may collect identifiers, device information, browsing activity and approximate location.

We do not permit advertising technologies placed on public marketing pages to access your connected financial-account data, AI conversations or authenticated VSTA financial dashboard.

Some state laws may define disclosures of public-website browsing or device information to advertising partners as a “sale,” “sharing” or “targeted advertising,” even where no money is exchanged. VSTA does not provide a general opt-out from these practices where an opt-out is not required by law. Where applicable law gives you an opt-out right and applies to VSTA, you may exercise that right by contacting hello@vstamoney.com, and VSTA will process qualifying browser-based opt-out preference signals as required by law.

7. Cookies and Similar Technologies

We and our service providers may use cookies, software development kits, pixels, local storage and similar technologies.

These technologies may be used for:

• authentication and account security;
• maintaining sessions and preferences;
• fraud detection;
• remembering choices;
• measuring website and product usage;
• diagnosing errors and performance issues;
• analytics;
• attribution and campaign measurement; and
• advertising on public marketing pages, where used.

You may control cookies through your browser settings and any cookie-preference controls we make available. Blocking certain cookies may prevent parts of the Services from functioning correctly.

VSTA does not currently respond to browser “Do Not Track” signals, which are not interpreted consistently across the industry. VSTA will recognize qualifying opt-out preference signals only where required by applicable law.

8. Aggregated and Deidentified Information

We may create information that has been aggregated or deidentified so that it cannot reasonably be linked to you or your household.

We may use and disclose aggregated or deidentified information for lawful purposes, including:

• measuring product performance;
• understanding broad financial and product-usage trends;
• improving categorization and AI features;
• developing new functionality;
• conducting research;
• maintaining security; and
• preparing internal or public reports.

We will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted by law to test whether our deidentification processes are effective.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, resolving disputes, enforcing our agreements and satisfying legal, accounting and regulatory obligations.

The retention period depends on:

• the type, amount and sensitivity of the information;
• the purposes for which it was collected;
• whether the information remains necessary to provide the Services;
• the potential risk of harm from unauthorized use or disclosure;
• contractual and legal obligations;
• fraud-prevention and security needs; and
• whether the information can be aggregated or deidentified.

While your account is active, we generally retain information needed to provide the Services, including connected financial data and raw provider responses, connection credentials, account settings, MoneyPaths, conversation history, voice transcripts and saved memories. Support records and profile photos are retained for their respective purposes, subject to deletion requests and lawful exceptions. A 730-day initial transaction request does not set a two-year deletion schedule.

Conversation history, saved memories and support records are distinct records. Deleting a conversation does not necessarily remove a memory derived from it and does not automatically remove a copy retained for support. We retain support copies only for as long as reasonably necessary to investigate or resolve the issue or for a valid legal, security or dispute-related purpose. A support record is not an exception allowing indefinite retention of all chat content.

To request deletion of a conversation, associated saved memories, support copies or a profile photo, contact hello@vstamoney.com and identify the information you want removed. Removing a photo from VSTA cannot recall copies other people have already saved. Provider copies of AI data are subject to the processing and retention arrangements described in Section 3.D and applicable law.

We process account and personal-information deletion requests in accordance with applicable law and any applicable deletion commitment previously made to you. After any necessary identity verification, we delete or deidentify information covered by the request unless continued retention is permitted by law for a specific purpose described below. We meet applicable response and deletion deadlines; this Policy does not extend a legal deadline or retroactively remove an existing deletion commitment.

Residual copies may remain in secured backups until removed through the applicable backup-retention cycle, subject to applicable law. Retention of backup copies does not authorize their continued ordinary use. We limit access to retained copies and do not retain them longer than permitted for the relevant purpose.

We may retain limited information for longer where necessary to:

• complete a transaction or process a refund;
• comply with tax, accounting or legal requirements;
• detect or prevent fraud and security incidents;
• maintain records of consent, deletion or privacy requests;
• resolve disputes;
• enforce our agreements; or
• establish, exercise or defend legal claims.

When you disconnect a financial account, VSTA will take reasonable steps to stop future retrieval through that connection. When processing account deletion, VSTA will use available provider tools to revoke active Plaid or other account connections and make any deletion requests required by applicable law or our provider agreements. Disconnecting a connection is separate from deleting information previously collected. Plaid, your financial institution and other independent third parties may retain information under their own policies and legal obligations, and you may also use their privacy tools separately.

10. Security

We use administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration and disclosure.

These safeguards may include:

• encryption of information in transit and at rest;
• access controls and authentication requirements;
• multi-factor authentication for sensitive systems;
• restricted production access;
• logging and monitoring;
• secure software-development practices;
• vendor security review;
• vulnerability management;
• backup and recovery measures;
• incident-response procedures; and
• employee and contractor confidentiality obligations.

No system, network, transmission or storage method is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered or destroyed without authorization.

You are responsible for protecting your account credentials, devices and authentication methods. Contact us promptly if you believe your VSTA account has been compromised.

11. Your Choices and Controls

A. Account Information

You may review or update certain profile and account information through the Services. To request removal of a profile photo, contact hello@vstamoney.com or use a photo-removal control if one is available. Public-photo visibility and previously saved copies are explained in Section 3.A.

B. Financial Connections

You may disconnect a financial account through VSTA where that functionality is available. You may also be able to manage or revoke the connection through Plaid Portal or your financial institution.

Disconnecting an account stops future retrieval through that connection but may not automatically delete information previously received by VSTA. To delete previously received information, you should delete the account data or submit a deletion request.

C. AI Conversations and Memory

You may delete individual conversations using the chat-deletion controls made available in the Services. Saved memories and support copies are handled separately: deleting a chat may leave saved memories derived from it, and does not automatically remove a support copy.

There is currently no dedicated memory-management screen. To request access to, correction of or deletion of saved memories, email hello@vstamoney.com. You can also ask us to delete support copies associated with a conversation. Identify the conversation or information as specifically as reasonably possible; you do not need to repeat sensitive content unnecessarily. We may verify your identity and will handle requests subject to applicable law and the retention limits in Section 9.

You can stop a voice session and revoke microphone permission through your device or browser controls. Revoking microphone permission does not itself delete existing transcripts, memories or support records. Not using chat or voice does not, by itself, disable background AI processing. For questions about background processing or to exercise an applicable privacy right, contact hello@vstamoney.com.

Deleting a conversation may reduce VSTA’s ability to provide continuity or personalized responses.

D. Marketing Communications

You may opt out of promotional email by using the unsubscribe link in the message.

You cannot opt out of necessary service, security, legal, billing or account communications while maintaining an active account.

E. Cookies and Advertising Choices

You may manage cookies through your browser or any cookie-preference controls provided on our website.

F. Access Export and Deletion

You may request:

• access to personal information we maintain about you;
• a portable copy of certain personal information;
• correction of inaccurate information;
• deletion of personal information; or
• additional information about our privacy practices.

Requests may be submitted by contacting hello@vstamoney.com.

Canceling a VSTA subscription does not automatically delete your VSTA account or personal information. To request account and data deletion, contact hello@vstamoney.com. You may also use an account-deletion control if one is available; contact us if it does not complete your request. Submitting a request or removing an item from view does not itself confirm that every retained copy has been deleted. We will process the request under Section 9 and applicable law.

12. US State Privacy Rights

Depending on your state of residence and whether an applicable law covers VSTA’s processing, you may have the right to:

• confirm whether we process your personal information;
• access personal information;
• obtain a portable copy of personal information;
• correct inaccurate personal information;
• request deletion;
• obtain information about the categories of information collected, sources, purposes and recipients;
• opt out of the sale of personal information;
• opt out of sharing for cross-context behavioral advertising;
• opt out of targeted advertising;
• opt out of certain profiling that produces legal or similarly significant effects;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent where processing is based on consent;
• appeal the denial of a privacy request; and
• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

VSTA does not use AI features to make decisions that produce legal or similarly significant effects concerning credit, employment, housing, insurance or access to essential goods or services.

Submitting a Request. You may submit a request by emailing hello@vstamoney.com. Please describe the right you wish to exercise and provide sufficient information for us to locate your account.

We may need to verify your identity before completing a request. Verification may involve confirming control of the email address associated with your account, signing into your account or providing other reasonably necessary information.

We will use information submitted in connection with a privacy request only to verify and process that request, maintain legally required records and prevent fraud.

Authorized Agents. Where permitted by law, you may authorize another person to submit a request for you. We may require evidence of the agent’s authority and may ask you to verify your identity or confirm the request directly.

Appeals. If we deny a request and applicable law provides a right to appeal, you may appeal by replying to our decision or contacting hello@vstamoney.com with the subject line “Privacy Appeal.”

Non-Discrimination. We will not unlawfully discriminate against you for exercising an applicable privacy right.

13. California Privacy Notice

This section supplements the rest of the Privacy Policy for California residents.

During the preceding 12 months, VSTA may have collected the following categories of personal information:

• Identifiers, such as your name, email address, IP address, VSTA account identifier and device identifiers.
• Personal information described in California Civil Code Section 1798.80(e), such as your billing address and limited payment-related information.
• Commercial information, such as your VSTA subscription plan, payment history and use of VSTA features.
• Financial information, such as connected financial-account information, account names and types, balances, transaction history, merchant information and recurring financial activity.
• Internet or other electronic network activity information, such as device, browser, log, session and information about your interaction with VSTA’s website and applications.
• Geolocation information, including approximate location derived from your IP address and transaction-associated merchant addresses, store numbers and precise latitude and longitude when provided by Plaid. Merchant coordinates are distinct from live device GPS data. VSTA does not collect precise device geolocation unless we provide notice and obtain any permission required by law.
• Audio, visual and electronic information, including profile photos or image URLs, voice audio processed during voice sessions, saved voice transcripts, AI conversations, customer-support records and materials you submit to VSTA. Voice is a current feature; its processing and retention are described in Section 3.D.
• Professional or employment-related information, such as employer or income-source information contained in connected transaction data or information you voluntarily provide.
• Inferences, such as recurring expense patterns, likely income or spending patterns, financial preferences, transaction categories, automatically created memories and personalized insights derived from the information available through VSTA.
• Sensitive personal information, including VSTA account login and authentication information that permits account access, connection credentials such as Plaid access tokens, and any financial information, location information or content in your conversations that qualifies as sensitive personal information under applicable law. VSTA does not collect or store the passwords you use in the financial-institution connection flow.

We collect these categories from you, your devices, Plaid, connected financial institutions, service providers and other sources described in Section 3.

We use these categories for the business and commercial purposes described in Section 4.

We may disclose these categories for business purposes to the recipients described in Section 5, including Plaid, OpenAI, cloud and database providers, authentication providers such as Google when used, payment processors, communications providers, security providers and professional advisers. The categories disclosed depend on the recipient's role. Profile photos hosted by VSTA are accessible through public image URLs as described in Section 5.I.

We do not sell personal information for money.

We do not sell or share connected financial-account data for cross-context behavioral advertising.

Public-website device and browsing information may be disclosed to analytics, attribution or advertising providers in a manner that may be considered “sharing” under California law. To the extent California law applies to VSTA and provides an opt-out right, California residents may submit a request by emailing hello@vstamoney.com. VSTA will also process qualifying opt-out preference signals where required by applicable law.

We use and disclose sensitive personal information only for purposes reasonably necessary to provide, secure and maintain the Services, process requests, prevent fraud, comply with law and for other purposes permitted without offering a right to limit under California law. We do not use sensitive personal information to infer characteristics about you for advertising purposes.

California residents may exercise the rights described in Section 12.

California’s “Shine the Light” law permits certain residents to request information about disclosures of personal information to third parties for their own direct-marketing purposes. VSTA does not disclose connected financial data to third parties for their own direct marketing.

14. Privacy for Children

The Services are intended only for individuals who are at least 18 years old.

We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to VSTA, contact us at hello@vstamoney.com. We will take reasonable steps to investigate and delete the information where appropriate.

15. International Users

The Services are currently intended for users in the United States.

Personal information may be processed and stored in the United States or in other countries where VSTA’s service providers operate. Those countries may have privacy laws that differ from the laws where you live.

If we offer the Services in another country, we may provide additional notices and protections required by local law.

16. Third Party Services and Links

The Services may contain links to or integrations with third-party websites, applications and services.

VSTA does not control the independent privacy practices of third parties. Information you provide directly to an independently operated third-party service is governed by that party's privacy policy, even when the service is accessible through VSTA. Processing that VSTA directs or that providers perform on VSTA's behalf remains subject to this Policy and VSTA's legal obligations.

This includes Plaid, financial institutions, payment processors, app stores if used and any external services you choose to connect.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our data practices, service providers, technology or applicable law.

When we make changes, we will update the "Last Updated" date. If changes materially affect your rights or how we collect, use or disclose personal information, we will provide clear additional notice through email, the Services or another appropriate method, with any advance notice required by law.

Where required by law, we will obtain consent before applying a material change, including to information previously collected. Posting an updated policy does not by itself authorize a new use of previously collected information that conflicts with an applicable prior privacy commitment. We will honor applicable prior commitments unless a change is lawfully made.

18. Contact Us

For questions, complaints or privacy requests, contact:

VSTA LLC
68 Harrison Ave STE 605 NUM 781616
Boston MA 02111
hello@vstamoney.com

Privacy, Support, Legal: hello@vstamoney.com

Please include “Privacy Request” in the subject line when exercising a privacy right.