Privacy Policy — PennyBot

Effective Date: October 25, 2026 Version: 1.23

For accounts opened before October 25, 2026: this version takes effect for your account on November 24, 2026, even if you accept it sooner; until then, version 1.22 of the Privacy Policy continues to apply to your account. For accounts opened on or after October 25, 2026, it takes effect when you accept it.

1. Introduction

PennyBot is operated by Nailsmith Investments LLC, an Ohio limited liability company doing business as PennyBot ("PennyBot," "we," "us," or "our"). We operate PennyBot (the "Service") at https://pennybot.io. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service, including the website, web application, and mobile app.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Name, email address, and password at registration. Passwords are hashed using bcrypt and are never stored in plaintext.
• Profile information: Time zone, business type (personal or business), accounting method, and fiscal year preferences.
• Contact information: Phone number, if optionally provided.
• Financial account connections: When you connect a bank account or accounting platform, we receive and store an access token from that provider — we never receive or store your bank username or password.
• Chat input: Text messages you submit to the AI chat feature. Until October 21, 2026, PennyBot also offered voice chat; voice recordings from that feature were sent to OpenAI as described in Section 4.1 and are deleted on the schedule in Section 6. No new voice recordings are collected.
• Receipts: Images you capture or upload for expense tracking.
• Trip data: Start/stop location, route, and distance when you record a mileage trip.
• Support communications: Messages you send us.

2.2 Information Collected Automatically

• Usage data: Pages and features accessed, actions taken, and time spent in the Service.
• Device and connection data: Browser type, operating system, IP address, device type, and general location derived from IP.
• Error and diagnostic data: Application errors, crash reports, and performance data collected via Sentry (see Section 4).
• Session data: To keep you signed in, we keep a record of each sign-in session in our database. It holds your account identifier and, while a step is in progress, the state of a two-factor login or of a connection you are setting up to an accounting or payment platform (QuickBooks, Xero or Stripe) or an AI assistant, which can briefly include that connection's access tokens. Session records are encrypted (Section 7) and deleted 24 hours after your last activity or sooner when you sign out (Section 6).

2.3 Financial Data from Connected Accounts

When you connect a financial account or accounting platform, we receive:

• Bank accounts (via Teller): Account names, account types, balances, and transaction history including dates, amounts, merchant names, and categories.
• Accounting software (via QuickBooks, Xero or Wave): Chart of accounts, transactions, invoices, vendors, and customers.

We use this financial data only to provide the Service. We do not sell it or use it for advertising. We do not store your bank login credentials.

2.4 Location Data (Mobile App)

If you use the mileage tracking feature, we access your device's GPS to record trip routes while a trip is actively in progress. We do not access location in the background. Location access stops when you end the trip. You can deny location permission and still use all other features of the app.

2.5 Camera and Microphone (Mobile App)

• Camera: Used only when you choose to capture a receipt photo.
• Microphone: Not used by the app.

The camera is never accessed passively or in the background, and the microphone is not accessed at all.

3. How We Use Your Information

We use your information to:

• Create and maintain your account and authenticate your identity.
• Connect to and sync data from your linked financial accounts and accounting platforms.
• Automatically categorize transactions and provide AI-powered bookkeeping suggestions.
• Provide conversational AI financial guidance through text chat.
• Generate financial reports, budget summaries, and mileage logs.
• Send transactional emails: account verification, security alerts, budget notifications, and system announcements.
• Respond to support requests.
• Detect and prevent fraud, abuse, and security incidents.
• Monitor and fix application errors.
• Analyze aggregate usage patterns (without identifying individuals) to improve the Service.
• Comply with legal obligations.

We do not use your financial data to train AI models. We do not sell your personal information to third parties.

4. How We Share Your Information

We share your information only as described below.

4.1 AI Processing Providers

To provide AI features, we transmit relevant data to:

• Anthropic, PBC — Transaction descriptions, amounts, and categories are sent to Anthropic's API to power automatic transaction categorization. (This is PennyBot's use of Anthropic's API on your behalf; it is separate from connecting your own Claude account, described below.) Anthropic processes this data under their API terms and does not use API data to train public models.
• OpenAI, LLC — Your chat messages in PennyBot's own chat feature are sent to OpenAI to power conversational financial guidance. (This is PennyBot's use of OpenAI's API on your behalf; it is separate from connecting your own ChatGPT account, described below.) OpenAI processes this data under their API terms and may retain API inputs for up to 30 days for abuse monitoring, then deletes them. Until October 21, 2026, PennyBot's voice chat feature also sent your voice audio to OpenAI on the same terms; OpenAI's 30-day retention of that audio ends by November 20, 2026.

Information that comes from an accounting platform you connect (QuickBooks, Xero or Wave) is part of the financial data these providers process for us when you use these features, on the same terms.

We do not send your bank login credentials, full account numbers, Social Security numbers, or passwords to any AI provider.

AI assistants you connect (for example, Grok by xAI, ChatGPT by OpenAI, Claude by Anthropic, Gemini by Google or Perplexity). If you connect an AI assistant to PennyBot, the information PennyBot sends it at your request becomes part of your conversation with that assistant and is handled under its provider's terms, not ours. The provider is your service, not ours: it acts for you, and we do not control what it keeps or how it uses it. For Grok, under xAI's terms as of October 2026, xAI keeps conversations until you delete them, may use them to improve its services, and trains its models on them unless you turn off "Improve the model" in Grok's Data Controls or use Private Chat. For ChatGPT, under OpenAI's terms as of October 2026, OpenAI keeps conversations until you delete them and removes deleted chats within 30 days unless it must keep them for legal or safety reasons; if Memory is on, ChatGPT may keep details from PennyBot as saved memories until you delete those; on personal plans (Free, Go, Plus and Pro) OpenAI may use the conversation to train its models unless you turn off "Improve the model for everyone" in ChatGPT's Data Controls or use a Temporary Chat, and it does not train on Business, Enterprise or Edu workspace content by default. For Claude, under Anthropic's terms as of October 2026, Anthropic keeps conversations until you delete them and removes deleted conversations within 30 days unless it must keep them for safety or legal reasons; if Memory is on, Claude may keep details from PennyBot as memories until you delete those; on Free, Pro and Max plans Anthropic may use the conversation to train its models unless you turn off "Help improve our AI models" in Claude's Privacy settings (Anthropic states that raw connector results are not used for training, but what Claude writes into the chat from them is part of the conversation), and it does not train on Team or Enterprise plan content by default. For Gemini, under Google's terms as of October 2026, custom apps like PennyBot require Gemini's Keep Activity setting to be on, so Google keeps the conversation in your Gemini Apps Activity (auto-deleted after 18 months by default, or sooner if you delete it), uses it to improve its services including training its AI models, and may have human reviewers read it, in which case a copy disconnected from your account is kept for up to three years; there is no setting that turns this off while PennyBot stays connected, and deleting the conversation also stops Gemini using it to personalize your answers. For Perplexity, under Perplexity's terms as of October 2026, what PennyBot sends it stays in your thread for as long as you keep it (Perplexity publishes no fixed deletion period); if Memory is on, Perplexity may keep details from PennyBot as memories until you delete those, and keeps a log of cleared memories for up to 30 days; on Pro and Max plans Perplexity uses your data to train its models unless you turn off "AI data retention" in Account settings › Preferences, and it does not use Enterprise data for training. If you connect a program running on your own computer (for example, a coding assistant), we can tell that the connection comes from your computer but not which program it is; that program, and any AI service it uses, handle the information under their own terms, which you should read before connecting.

4.2 Bank and Accounting Integration Providers

• Teller, Inc. — Provides secure read-only access to your bank accounts via their API. Teller does not store your bank login credentials either; authentication uses a one-time OAuth grant.
• Intuit (QuickBooks Online), Xero, Wave — We read and write accounting data on your behalf when you connect these accounts.
• Stripe, Inc. — Payment processing for subscriptions purchased on our website. Your payment card details are submitted directly to Stripe; we do not receive your card number.
• Apple Inc. (App Store) and Google LLC (Google Play) — If you subscribe inside our iPhone or Android app, the purchase is billed by Apple or Google under their privacy policies. At purchase, the app sends the store a random account identifier (not your name or email) so the purchase can be linked to your account. We receive from the store the product purchased, a transaction or purchase-token identifier, the purchase and expiry dates, whether the purchase was made in a test or production environment, and any refund or revocation status, and we keep those on your subscription record. We never receive your payment card details from the store.
• Google LLC — Google's mapping, geocoding and distance services receive the addresses you type, for address autocomplete (Google Places API), turning an address into map coordinates (Geocoding API) and mileage distance calculation (Google Maps Distance Matrix API), when you enter addresses or log trips. No user identity is sent to Google for these calls.

4.3 Infrastructure and Operations Providers

• Hetzner Online GmbH — Hosting provider. The Service and its production database run on servers we operate in Hetzner's Ashburn, Virginia (United States) datacenter.
• Cloudflare, Inc. — DNS, content delivery, and reverse proxy; all traffic to the Service passes through Cloudflare's network. Cloudflare R2 is also our cloud storage provider: it stores the receipt images and statement files you upload in private storage, encrypted at rest. We also store offsite backups of the production database there; those backups are additionally encrypted before they leave our infrastructure using asymmetric (age) encryption, and the decryption key is held off-host, so Cloudflare cannot read them.
• Resend — Email delivery service. We send them your email address and email content to deliver account notifications.
• Whop, Inc. — Until August 2026, Whop was our merchant of record for subscription payments. If you began a checkout, the checkout link carried your name and email address to Whop; Whop received any payment details you entered on its payment form. We no longer share any information with Whop. Whop may retain records it collected under its own privacy policy.
• Sentry — Application error monitoring. Sentry receives stack traces and technical details of application errors. We do not send it your user ID or email address, and we configure Sentry to strip request bodies, auth headers, cookies, and breadcrumb data from error reports. 4xx (client) errors are filtered and not sent.
• Langfuse — AI observability. For each AI request PennyBot makes, this provider receives a pseudonymous account identifier, the model name, token counts and the names of the PennyBot tools the request used, so we can monitor cost and reliability. It does not receive the content of your messages or financial data. Before August 15, 2026, it also received truncated request and response content; that content stays with the provider until we delete it, no later than August 15, 2028.
• Go High Level — Until October 2026, when you created an account, your name and email address were sent to Go High Level, a customer-relationship platform, for our customer communications. We no longer send it any information. Go High Level may retain the records it received under its own terms.

4.4 Analytics

• Umami — We use a self-hosted instance of Umami Analytics to track aggregate usage of the Service, on both our public pages and inside the authenticated application. Umami does not use cookies for tracking, does not collect personal information, and does not share data with third parties. We collect page views and feature interactions on an anonymized basis.
• Google Analytics (Google LLC) — We use Google Analytics 4 on our public pages and inside the authenticated application. On authenticated pages it receives the address and title of the page you are viewing (which can indicate which features you use, such as budgets or mileage logs), the referring page, your device, browser and operating system, and an approximate location derived from your IP address. It sets first-party cookies to tell one visit apart from another. We use Google Analytics in its default page-view configuration and send it no custom event data: it does not receive your financial data — no account balances, transaction details, account numbers, connected-bank information, receipts, or document contents — and the page addresses it receives do not contain record identifiers. Google signals, ads personalization, data sharing with Google, and links to Google's advertising products are all turned off for our Google Analytics property.
• Cloudflare Web Analytics — Enabled at the network edge for every page of the Service, including the authenticated application. It is cookieless and aggregate-only, collecting the page address, referring page, and general device and performance information. It does not use cookies and does not track you across other websites.
• Microsoft Clarity — removed July 28, 2026. From February 4, 2026 until July 28, 2026, our public website pages, our login page and the signed-in application loaded Microsoft Clarity, a session-recording and heatmap tool. It captured how pages were used (clicks, scrolling, page navigation) and the page as it was displayed on screen, which inside the signed-in application could include financial information shown on that screen. Microsoft states that Clarity masks certain input fields; we did not independently verify the scope of that masking. Microsoft processed this data under its own terms and for its own purposes as well as to provide analytics to us. We removed Clarity on July 28, 2026 and no longer use any session-recording or heatmap tool. Microsoft states that it keeps recordings for 30 days and aggregated click data for 9 months from collection, so data collected before July 28, 2026 may remain with Microsoft until about April 28, 2027. Microsoft does not offer deletion of a single person's data from that tool. To ask whether data about you was collected during that period, contact us at the address in Section 14.
• Exact Match Marketing (Visitor Pixel) — removed August 29, 2026. Until that date, our public marketing, blog, and sign-up pages (never the authenticated application where your financial data lives) used a first-party visitor analytics and attribution pixel provided by Exact Match Marketing. It collected page interactions, referral and traffic-source information, and information submitted through forms on those public pages (such as an email address). The pixel no longer runs. Information collected before it was removed may be retained by Exact Match Marketing under its own privacy policy. It was never used for third-party advertising.

4.5 Legal Requirements

We may disclose your information when required by law, subpoena, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.6 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or in-app notice before your information becomes subject to a different privacy policy.

5. Your Financial Privacy (Gramm-Leach-Bliley Act Notice)

PennyBot is a financial institution under the Gramm-Leach-Bliley Act. This notice tells you what nonpublic personal information we collect about you and how we share it.

What we collect. Information you give us (such as your name, email address, receipts, expenses and mileage logs); information from accounts you connect (such as bank and accounting transactions and balances); and information about how you use the Service.

Who we share it with. Only:

• service providers that process it for us under contracts that limit its use to providing the Service, listed in Section 4;
• others at your direction, such as an accounting platform you connect;
• AI assistants you connect to PennyBot, at your direction. That assistant's provider handles what PennyBot sends it under its own terms, not ours (see Section 4.1); and
• as the law permits or requires, for example to prevent fraud or to respond to legal process.

We do not share it with anyone else, including companies outside PennyBot for their own marketing, so there is nothing to opt out of.

How we use your financial data. Only to provide the Service to you. We do not use one person's financial data to build models or analytics across our users, and we do not use it for marketing.

How we protect it. Only you, and PennyBot staff who need it to operate or support the Service, can access your information. We protect it with the security measures described in Section 7, including encryption in transit and at rest.

Questions: [email protected].

6. Data Retention

Upon account deletion, we delete or anonymize your personal information within 30 days, except where retention is required by law (for example, records of payments you made to us). Billing records held by our payment processor, including your consent to automatic renewal, are kept after your account is deleted for as long as tax and payment rules require.

7. Data Security

We implement the following security measures:

• Encryption in transit: All data is transmitted over TLS 1.2 or higher.
• Encryption at rest: Our production database is stored on encrypted disk volumes (LUKS full-volume encryption).
• Backups: Offsite database backups are encrypted before leaving our infrastructure using asymmetric (age) encryption; the decryption key is stored off-host.
• Password security: Passwords are hashed with bcrypt. Plaintext passwords are never stored or logged.
• Data isolation: Access to your data is scoped to your account on every request.
• Authentication: Optional two-factor authentication (TOTP) with backup codes.
• Session management: Sign-in sessions are stored server-side in our database and encrypted at the application level in addition to the disk encryption above. They expire 24 hours after your last activity and are deleted on sign-out, password change or reset, account suspension, and account deletion.

No method of security is 100% foolproof. In the event of a breach affecting your data, we will notify you as required by applicable law.

8. Cookies and Tracking

We use a minimal number of cookies:

• Session cookie: A single server-side session cookie is used to keep you logged in. This cookie contains only a session identifier — no personal information.
• Preference cookies: Used to remember UI preferences (e.g., dark mode).
• Google Analytics cookies: Google Analytics sets first-party cookies (for example _ga) to tell one visit apart from another. These are set on our public pages and inside the authenticated application.

We use analytics to measure traffic, referral sources, feature usage, and sign-up conversions. Each provider, and what it receives, is described in Section 4.4.

Not all of these are limited to our public pages, and we want to be precise about which are:

• Public pages only (historical): the Exact Match Marketing visitor pixel ran only on our public marketing, blog, and sign-up pages and was removed on August 29, 2026. It was never loaded inside the authenticated application.
• Public pages and inside the authenticated application: Google Analytics, Cloudflare Web Analytics, and our self-hosted Umami. On authenticated pages these receive the addresses of pages you visit — which can indicate which features you use — together with device, browser, and referral information. They do not receive your financial data: no account balances, transaction details, account numbers, connected-bank information, receipts, or document contents.
• Public pages, the login page and inside the authenticated application (historical): Microsoft Clarity ran on all of these from February 4, 2026 until July 28, 2026, when we removed it. See Section 4.4.

We do not sell your personal information and we do not use it for third-party advertising. Umami and Cloudflare Web Analytics are cookie-free; Google Analytics sets the cookies described above.

9. California Privacy Rights (CCPA)

We are not currently a "business" under the California Consumer Privacy Act (CCPA). We extend the following rights to all users voluntarily, wherever they live:

• Right to Know: Request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

To exercise your rights, contact us at [email protected] or delete your account directly in Settings.

10. Your Rights and Choices

You may:

• Access and update your profile information through your account settings.
• Delete your account directly in the app or web app under Settings > Danger Zone > Delete Account, or from the plan-selection page. This immediately initiates deletion of your data. Account deletion completes within 30 days.
• Disconnect integrations at any time from your account settings, revoking our access to those accounts.
• Export your data yourself: download your transactions as a CSV file from Settings, or from the plan-selection page. For a copy of any other information we hold about you, contact us at [email protected].
• Opt out of marketing emails via the unsubscribe link in any marketing email.
• Deny or revoke location permission on your mobile device at any time. This disables mileage tracking but does not affect other features.

11. Geographic Scope — United States Only

PennyBot is intended for use by residents of the United States only. The Service is not directed to users outside the United States and is not designed to comply with the laws of other jurisdictions (including GDPR, UK GDPR, PIPEDA, or similar frameworks). If you are located outside the United States, you may not use the Service. All data is stored and processed in the United States.

12. Children's Privacy

The Service is only for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at [email protected] and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

The current version and effective date are displayed at the top of this document. Previous versions are available upon request.

Version history (most recent first)

• 1.23 (October 25, 2026): Privacy Policy 1.23: names the company that operates PennyBot, Nailsmith Investments LLC, and its mailing address. Effective on acceptance for accounts opened on or after October 25, 2026, and on November 24, 2026 for accounts opened before then.
• 1.22 (October 25, 2026): Privacy Policy 1.22: names our AI-observability provider, says where uploaded receipts and statements are stored, adds geocoding to the mapping services, and records that error reports no longer carry your user ID. Nothing about how we collect or use your data has changed. Effective on posting.
• 1.21 (October 21, 2026): Privacy Policy 1.21: explains what happens when you connect a program running on your own computer to PennyBot, and removes FreshBooks and Zoho Books from the accounting-connection lists; no user data was ever sent to either. Nothing else about how we collect or use your data has changed. Effective on posting.
• 1.20 (October 21, 2026): Privacy Policy 1.20: PennyBot no longer has voice chat, so no voice recordings are collected. Nothing else about how we collect or use your data has changed. Effective on posting.
• 1.19 (October 20, 2026): Privacy Policy 1.19: explains what happens when you connect Perplexity to PennyBot. Nothing else about how we collect or use your data has changed. Effective on posting.
• 1.18 (October 20, 2026): Privacy Policy 1.18: explains what happens when you connect Claude or Gemini to PennyBot. Nothing else about how we collect or use your data has changed. Effective on posting.
• 1.17 (October 14, 2026): Privacy Policy 1.17: sign-in sessions are now kept, encrypted, in our database for up to 24 hours after your last activity, so updates to PennyBot no longer sign you out. Nothing else about how we collect or use your data has changed. Effective on posting.
• 1.16 (October 13, 2026): Privacy Policy 1.16: explains what happens when you connect an AI assistant such as ChatGPT or Grok to PennyBot. Nothing else about how we collect or use your data has changed. Effective on posting.

14. Contact Us

For privacy-related questions, data requests, or to exercise your rights:

PennyBot (Nailsmith Investments LLC) 3660 Briarcliff Rd, Nashport, Ohio 43830 Email: [email protected] Website: https://pennybot.io