Privacy Policy

Last updated: October 25, 2026

At WellAhead, protecting your financial data is the point, not an afterthought. This Privacy Policy explains what we collect, how we use it, who we share it with (spoiler: we do not sell or share it), how we secure it, how long we keep it, and the choices and rights you have.

This Privacy Policy is part of, and incorporated into, our Terms of Service. Words we use here without defining them have the meaning given in the Terms of Service. By using the Services, you agree to this Privacy Policy. WellAhead is provided by CleverMind AI LLC ("WellAhead," "we," "us," or "our").

The short version

• We never sell or share your data, and we do not show you ads or use your financial data for advertising.
• We de-identify your data before AI processing. Before sending anything to an AI provider, we strip your name, account numbers, and contact details, and our AI providers are barred from training on it. The coach does work with your real financial figures (such as balances and amounts) to give you useful guidance, and anything you type into the chat is sent as you wrote it (see Section 5).
• We do not train our own models on your financial data.
• We never receive your bank login. Your bank connection is handled by Plaid.
• We collect only what the service needs, keep it for as long as you have an account, and delete it when you ask.
• You can access, export, correct, or delete your data at any time.

The full detail is below. The short version is a summary, not a replacement for it.

1. What this policy covers

This policy covers "Personal Data" we handle when you use the Services. "Personal Data" means information that identifies or relates to a particular individual, including what some laws call "personal information" or "personally identifiable information." It does not cover the practices of companies we do not own or control (for example, your bank or Plaid), which have their own policies.

2. Personal Data we collect

Account and identity data. To create an account you sign in with your phone number, which we verify with a one-time passcode, or with Sign in with Apple. If you use Sign in with Apple, Apple gives us your name and email address (you can choose to hide your email). We do not use passwords or usernames. Your phone number is used only to send one-time login passcodes (delivered by Supabase Auth, which uses Twilio Verify for the SMS) and to secure your account; it is never shared with third parties or affiliates for marketing or promotional purposes.

Financial account data (through Plaid). When you connect a financial account, we receive information about that account from Plaid, such as account names and types, balances, and transaction history (dates, amounts, and descriptions). For credit-card accounts we may also receive liability details such as interest rates, balances, utilization, and payment due dates, so the coach can help with debt. We never receive your online banking username or password. Plaid handles the login to your bank; see Section 7.

Profile and coaching inputs. The information you give us to power the coach: your savings plan and goals, budgets, your answers to onboarding questions, and the coarse "posture" signals the app uses to personalize your experience.

Device and notification data. To send you proactive notifications we store your device's push token and when it was registered. We do not store your device model, app version, or operating-system version.

Support communications. If you contact us, we keep your messages and contact details so we can help you.

Essential technical logs. Our servers record limited operational data such as IP address and timestamps, used for security, fraud prevention, and debugging. We do not use third-party analytics, advertising, or cross-site tracking technologies (see Section 9).

Waitlist email (before you have an account). On our marketing site you can enter your email address to join the waitlist. We store that email and the date you signed up, and use it only to let you know when WellAhead launches.

3. How we collect Personal Data

• From you, when you register, set up your plan and goals, answer onboarding questions, or contact us.
• Automatically and minimally, when you use the Services (essential technical logs only).
• From Plaid, when you choose to link a financial account, and only for the accounts you link.

4. How we use Personal Data

We use your Personal Data to:

• Provide the Services: run your savings and budgeting coach, categorize and analyze your spending, track your plan and goals, and generate the proactive notifications and insights that are the point of WellAhead.
• Support you: respond to your questions and requests.
• Keep the Services safe: fraud prevention, security, and debugging.
• Meet legal obligations: comply with law and enforce our Terms.

We do not use your Personal Data for advertising, and we do not sell or share it. See Section 6.

5. AI and de-identification

WellAhead uses artificial intelligence to categorize transactions, analyze spending, generate insights and notifications, and answer your questions in the chat. Protecting your data at this boundary is central to how we are built, and it works differently depending on the feature.

• We minimize what is sent. When we use AI to categorize a transaction, we send only a transaction's description and amount to our AI provider. We never send your name, account numbers, balances, or contact details as identifying fields, and we are moving toward sending a cleaned merchant name in place of the raw description.
• We scrub names on a best-effort basis. Because transaction descriptions come from your bank and can occasionally contain names (for example, a peer-to-peer transfer such as a Zelle or Venmo payment), we remove common name patterns from those descriptions before any third-party AI processing. This is best-effort, not a guarantee: bank-provided text is unpredictable, so we cannot promise every name is removed.
• Insights, notifications, and chat work differently from categorization. To generate insights and proactive notifications, and to answer your questions in the chat, we send de-identified summaries of your finances to our AI provider. These summaries include your actual financial figures, such as balances, transaction amounts, and interest rates, because the coach needs real numbers to give you useful, specific guidance. They are stripped of your name, account numbers, and contact details. In the chat, we also send your question exactly as you type it. If you choose to include identifying details in a question, for example a bank name or a specific balance, those words are sent to the AI provider as you wrote them, because we cannot answer the question without them. Please share only what you are comfortable sending.
• Our AI providers cannot train on your data. We work only with providers that are contractually prohibited from using the data we send to train their models. (Today this is OpenAI.)
• Retention is not training. An AI provider may retain data we send for a short period to monitor for abuse, as described in its own terms, separate from any training use.
• We do not train our own models on your financial data.

6. How we disclose Personal Data

We do not sell or share your Personal Data, and we do not have advertising partners. We disclose data only in these limited ways:

Service providers. Companies that help us run the Services, under contracts that limit them to that purpose. Currently:

• Plaid - connects your financial accounts (see Section 7). plaid.com/legal
• OpenAI - powers AI categorization and reasoning, on de-identified data (see Section 5). openai.com/policies
• Supabase - database, authentication, and hosting of your account data. supabase.com/privacy
• Twilio - delivers the SMS one-time login passcodes, through Supabase Auth's phone provider. twilio.com/legal/privacy
• Render - hosts our application servers. render.com
• Apple - delivers push notifications (APNs). If we introduce paid subscriptions in the future, Apple will also process those payments through the App Store. apple.com/legal/privacy
• Clearbit - provides merchant logos. When your bank doesn't supply a logo for a merchant, the app loads one from Clearbit using the merchant's web domain; Clearbit receives that domain and your device's IP address, and no name, account, or financial data. clearbit.com/privacy-policy

Parties you authorize. Services you connect yourself, such as your financial institution through Plaid.

Legal and safety. We may disclose data if required by law, legal process, or a government request, or to protect the rights, property, or safety of you, WellAhead, or others.

Business transfers. If we are involved in a merger, acquisition, or sale of assets, your data may transfer to the successor, which will remain bound by this policy or provide notice of any change.

7. Connecting your bank (Plaid)

We use Plaid Inc. to connect your financial accounts. When you link an account, Plaid collects and transmits your financial data at your direction, and you agree to Plaid's End User Privacy Policy (plaid.com/legal). We never receive your bank login credentials. You can disconnect a linked account at any time; see Section 12.

8. De-identified and aggregated data

We may create aggregated or de-identified data (data that does not identify you or any individual) and use it for our lawful business purposes, such as analyzing, securing, and improving the Services. We will not attempt to re-identify it, and we will not disclose it in a form that identifies you.

9. Cookies and tracking

The Services use only essential and functional technologies needed to operate (for example, to keep you signed in and remember your settings). We do not use third-party advertising cookies, interest-based advertising, or cross-site tracking, so there is nothing to opt out of for advertising. If we add analytics in the future, we will update this policy to describe it and provide any choices required by law before doing so.

10. Data security

We protect your Personal Data with reasonable, industry-standard measures, including encryption of sensitive data at rest, strict separation between users' data, encryption in transit (TLS), and least-privilege access controls. You also play a part: keep your phone and the one-time passcodes we send you secure. No method of transmitting or storing data is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

11. Data retention

We keep your Personal Data only as long as we need it to provide the Services, generally for as long as you have an account. When you close your account, we delete or de-identify the Personal Data we hold about you, except where we must keep certain records to comply with law, resolve disputes, or enforce our agreements. Deletion from routine backups happens on our normal backup cycle.

About Plaid's retention: when you delete your account or disconnect an account, we delete the data we hold and revoke WellAhead's access to your bank through Plaid. Plaid's own retention of your data is governed by Plaid's policy, not ours.

12. Your choices and rights

• Delete your account at any time in the app, which closes it and removes your access.
• Disconnect a financial account at any time to stop future data retrieval.
• Request access, a copy (export), correction, or deletion of your Personal Data by emailing support@wellahead.io.
• Control notifications in the app.

13. U.S. state privacy rights

Depending on your state of residence, you may have rights to access your Personal Data, request a portable copy, request correction, and request deletion. To exercise them, email support@wellahead.io with enough detail for us to verify your identity and understand your request. We will respond within the time required by law. These rights are subject to legal exceptions that may let us decline part of a request; if so, we will tell you which part and why. If we deny a request, where your state provides it, you may appeal by replying to our decision.

We do not sell or share your Personal Data, and we do not use it for targeted advertising, so there is no sale or sharing to opt out of. We will honor a Global Privacy Control signal consistent with this position. We will not discriminate against you for exercising your privacy rights. You may use an authorized agent to submit a request where the law allows, and we may verify the agent's authority.

14. Sensitive data

Some data you connect, such as financial account and transaction data, may be considered "sensitive" under certain state privacy laws. We use it only to provide the Services you asked for and to keep them secure. We do not use sensitive data to infer characteristics about you, and we do not use it for advertising.

15. Children

The Services are for adults. You must be at least 18 to use them. We do not knowingly collect Personal Data from anyone under 18. If you are under 18, please do not use the Services or send us any information. If we learn we have collected data from someone under 18, we will delete it as quickly as reasonably possible. If you believe a minor has provided us data, contact support@wellahead.io.

16. Where we operate

The Services are intended for users in the United States and are not designed for, or directed to, individuals in the European Union, the United Kingdom, or other regions with their own data-protection regimes. If you use the Services from outside the United States, you understand your data will be processed in the United States.

17. Changes to this policy

We may update this policy as the Services evolve. If we make a material change, we will notify you by posting a notice on our website, by email, or through the app before it takes effect. If you use the Services after a change is effective, you agree to the updated policy.

18. Contact us

Questions about this Privacy Policy or your data? Contact us at:

CleverMind AI LLC
13802 N Scottsdale Rd, Suite 151-52, Scottsdale, AZ 85254
support@wellahead.io