Privacy Policy
This Privacy Policy explains how PAPPOE VENTURE LLC ("Company," "we," "our," or "us") collects, uses, discloses, and protects your information when you use our WJP Debt Tracking website and services (the "Service"). By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree with the practices described in this policy, please do not use the Service.
1. Introduction
PAPPOE VENTURE LLC is committed to protecting your privacy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you use our Service, and our practices for collecting, using, maintaining, protecting, and disclosing that information.
2. Information We Collect
We collect various types of information, including personal information, to provide and improve our Service. This may include:
- Identity and Account Information: Such as your name, email address, postal address, phone number, date of birth, and social security number (SSN) or other government-issued identification numbers, which may be collected when you create an account or use certain features.
- Subscription and Billing Information: Details related to your paid plans, payment methods, and billing history.
- Financial Account Information: Through authorized third-party providers like Plaid, we may collect information about your financial accounts, including bank account numbers, transaction history, and account balances. We do not store your banking credentials. Plaid acts as an intermediary to securely connect your financial institutions to our Service.
- Credit Report and Score Information: Through authorized third-party providers like Array, when expressly authorized by you, we may collect information from your credit report, including credit scores, credit history, and public records. This information is used for educational credit monitoring and planning tools.
- User-Entered Data: Any debts, budgets, notes, and planning data that you voluntarily enter into the Service.
- Technical and Usage Data: Information about your device, IP address, browser type, operating system, usage patterns, analytics data, fraud-prevention data, and security logs.
3. How We Use Your Information
We use the information we collect for various purposes, including:
- Providing and Maintaining the Service: To operate, maintain, and improve the functionality of our Service.
- Authentication and Security: To authenticate users, secure accounts, and prevent fraud, abuse, and unauthorized access.
- Processing Transactions: To process subscriptions, payments, and other transactions.
- Delivering Features: To deliver requested financial and credit-monitoring features, including personalized insights and recommendations.
- Compliance: To comply with legal and regulatory obligations, including those related to financial data and consumer credit reporting (e.g., GLBA, FCRA).
- Communication: To send you important notices, updates, and marketing communications (you can opt-out of marketing communications).
- Research and Development: To analyze usage patterns and improve our Service offerings.
4. Sensitive Data
Certain personal information we collect, such as SSN, date of birth, address, and credit-related information, is considered sensitive. We treat such data with the highest level of security and confidentiality. We implement commercially reasonable administrative, technical, and physical safeguards to protect your sensitive data from unauthorized access, use, or disclosure. We will only collect and process sensitive data with your explicit consent and for the purposes outlined in this Privacy Policy.
5. Sharing Your Information
We do not sell your personal information. We may share your information with third parties in the following circumstances:
- Service Providers: We use the following third parties to operate the Service. Each is named so you know exactly who handles your data:
- MoneyKit and Plaid — financial account linking. When you connect a bank, these providers handle the connection and supply us with your account balances, transactions and holdings. Your bank credentials are entered with them, not with us, and we never see them.
- Array — credit reports and scores, pulled only when you expressly authorize it.
- Google (Firebase) — sign-in and our database. Your account, financial data and any credit report we retrieve are stored here.
- Netlify — hosting and server functions. All requests to the Service pass through Netlify.
- Stripe — subscription payments. Stripe receives your email address and handles your card details directly; we never see or store your card number.
- Resend — transactional email, such as sign-in and account notices. Receives your email address.
- Twilio — SMS alerts to our own operations team.
- Anthropic and Groq — the WJP Assistant. See section 6 for exactly what is sent.
- Legal Requirements: When required by law, such as in response to a subpoena, court order, or other legal process, or to comply with applicable regulations (e.g., FCRA, GLBA).
- Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity.
- With Your Consent: We may share your information with third parties when we have your explicit consent to do so.
- Aggregated or Anonymized Data: We may share aggregated or anonymized data that cannot reasonably be used to identify you. If we use anonymized End User Data, this will be clearly and conspicuously disclosed, including a description of how it is used.
6. AI Features & Data Flow
The Service includes an in-app WJP Assistant that answers questions about your finances and provides educational guidance. To generate responses, we send a snapshot of your financial data to third-party large language model providers, together with the text of your question. That snapshot can include: your first name; your debts, balances, APRs, minimum payments and due dates; your creditor and account names; your credit limits and utilization; your monthly income, cash on hand and emergency fund; your debt-to-income ratio; your recurring bills and the merchants behind them; your savings goals; your recent spending totals and top spending categories; your credit score and which bureau it came from; and, if you use household sharing, how many people are in your household. We never send your banking credentials, full account numbers, Social Security Number, or raw bank-login information to these providers.
- Anthropic (primary): WJP Assistant responses are generated by Anthropic's Claude Haiku model. Anthropic does not train its models on data submitted through its API. Anthropic's handling of this data is governed by its Privacy Policy and Commercial Terms.
- Groq (fallback): If the Anthropic service is unavailable, requests fall back to Groq, which hosts the Llama 3.3 70B model. Groq does not train models on inference data sent through its API.
- Standard Mode: You may switch the WJP Assistant to a fully rule-based Standard Mode in Settings. In Standard Mode, no data is sent to any third-party AI provider — all processing happens in your browser.
- Transmission: All AI requests are made server-side over encrypted (TLS) connections. Provider API keys are never exposed to your browser.
AI transaction categorising
When you ask the app to suggest categories for transactions it cannot recognise, we send a deliberately narrow description of each merchant — not each transaction — to Anthropic's Claude Haiku model. For each merchant we send only: the merchant wording with identifying details removed, a typical amount, how many times it occurs, and how often it repeats (for example “monthly, same amount every time”).
Before anything is sent, we remove: any person's name carried in the transaction text (including names in Zelle, ACH and wire descriptions), your own and your household members' names, account numbers and masked account digits, card numbers, confirmation and reference numbers, and all remaining digits and dates. This removal happens in your browser and is then performed again on our server, so an out-of-date copy of the app cannot bypass it. We do not send transaction dates, account identifiers, your balances, or anything that identifies you or the people you pay.
This runs only when you press the button, at most once per calendar month, and each merchant is sent at most once ever: the answer is cached in your own data so the same merchant is never sent again. Anthropic does not train its models on data submitted through its API. AI categorising is available on paid plans; the rest of the categoriser — the rules you teach it and the patterns built into the app — runs entirely in your browser and sends nothing anywhere. A category the AI applies is labelled as such, and you can change or undo any of it at any time.
Voice input
The WJP Assistant includes an optional voice input that lets you ask a question by speaking instead of typing. It is entirely optional, it is never on by default, and it only runs while you are actively holding a voice session open. Because the transcription is performed by your web browser rather than by us, it is important that you understand where the audio goes.
- How it works: Voice input uses the speech recognition built into your own web browser. It is not our own recording system, and it only runs while you are actively holding a voice session open.
- Who processes the audio: Your browser vendor. In Google Chrome and Microsoft Edge the audio is sent to Google for transcription; in Safari it is sent to Apple. That processing is governed by their privacy policies, not ours, and it happens between your browser and them.
- What we receive: Only the resulting text, which is then treated exactly like a question you typed. The audio itself never reaches our servers and we never store it.
- Your control: Voice input is always optional and requires you to grant microphone permission to your browser. Typing will always remain available, and declining the microphone never limits any other part of the Service.
You can use the WJP Assistant fully without ever enabling the microphone.
AI-generated output is for informational and educational purposes only and does not constitute professional financial, legal, or credit advice. See our Terms of Service for the full disclaimer.
7. Security
We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. However, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
8. Data Retention
We retain your personal information for as long as reasonably necessary to provide you with the Service, comply with our legal obligations, resolve disputes, enforce our agreements, and for other legitimate business purposes. When your information is no longer needed, we will securely delete or anonymize it.
9. Your Rights
Depending on your jurisdiction, you may have certain rights regarding your personal information, including the right to:
- Access: Request access to the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete personal information.
- Deletion: Request deletion of your personal information.
- Portability: Request a copy of your personal information in a structured, machine-readable format.
- Restriction: Request restriction of the processing of your personal information.
- Object: Object to the processing of your personal information.
- Appeal: Appeal decisions regarding your privacy rights.
To exercise any of these rights, please contact us at privacy@wjpdebttracking.com.
10. Children's Privacy
The Service is not intended for persons under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information from our records.
11. International Users
The Service is operated in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers and databases are located. By using the Service, you consent to the transfer of your information to the United States.
12. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top of this policy. We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after any modifications to this Privacy Policy will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.
13. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
References
[1] Array Legal Center. (n.d.). MyCredit Manager Addendum. Retrieved from https://array.com/legal/#msa-addendum-mycm
[2] Plaid. (n.d.). Developer Policy. Retrieved from https://plaid.com/developer-policy/