Privacy Policy

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Connected Financial Data

When you link your bank accounts or credit cards, we use Plaid Inc., an established third-party account connectivity provider.

Plaid's Privacy Policy →

2.4 Information from Third Parties

We may receive information from:

• • Identity verification services (to comply with financial regulations)
• • Fraud prevention services (to protect your account)
• • Analytics providers (aggregated, non-identifiable usage statistics)
• • App stores (Apple, Google) regarding app downloads and updates

2.5 Information We Do NOT Collect

• ✗ Social Security Numbers
• ✗Driver's license numbers (unless required by law for identity verification)
• ✗ Passport information
• ✗ Credit scores or credit reports (unless you explicitly provide them)
• ✗ Biometric data (unless you enable device biometric authentication, which is stored locally on your device, not our servers)

3.1 Provide Core Services

• Account management: Create and maintain your account
• Financial insights: Calculate debt payoff projections, optimize payment strategies
• Subscription management: Process subscription billing through Apple App Store or Google Play Store
• Data synchronization: Update balances and transactions from linked accounts (via Plaid)
• Personalization: Customize recommendations based on your financial profile

3.2 Improve and Secure Services

• Performance optimization: Identify bugs, crashes, and areas for improvement
• Security monitoring: Detect and prevent fraud, unauthorized access, and security threats
• Product development: Analyze usage patterns to develop new features
• Quality assurance: Test new features and ensure reliability

3.3 Communicate With You

3.4 Legal and Compliance

• Comply with laws: Respond to legal requests, court orders, or regulatory requirements
• Enforce Terms: Investigate violations of our Terms of Use
• Protect rights:Defend against legal claims or protect our users' safety
• Financial compliance: Meet Anti-Money Laundering (AML) and Know Your Customer (KYC) obligations where required

3.5 Aggregated Analytics

• • Create anonymized, non-identifiable statistics about app usage trends, feature popularity, and general demographic insights
• • Aggregated data cannot be traced back to individual users

4.1 Contractual Necessity

To provide Services you've requested (account creation, payment processing, financial insights)

4.2 Legitimate Interests

To improve, secure, and personalize our platform (fraud prevention, product development, customer support)

4.3 Consent

For optional features where you've given explicit consent:

• • Linking bank accounts via Plaid
• • Receiving marketing emails or SMS
• • Enabling biometric authentication
• • Allowing push notifications

You may withdraw consent at any time through account settings or by contacting us.

4.4 Legal Compliance

Where required by law, regulation, or legal process (tax reporting, AML compliance, court orders, data protection laws)

5.1 Security Measures

5.2 Your Security Responsibilities

• • Use strong passwords: At least 12 characters with letters, numbers, and symbols
• • Enable two-factor authentication (2FA) when available
• • Keep devices secure: Use device passcodes, biometric locks
• • Don't share credentials: Never share your password or authentication codes
• • Monitor account activity: Report suspicious activity immediately
• • Beware of phishing: We will never ask for your password via email or text

6.1 Retention Periods

6.2 Deletion Process

When you delete your account:

1. Personal data is flagged for deletion within 24 hours
2. Data is permanently erased from production systems within 30 days
3. Encrypted backups are purged within 90 days
4. You will receive confirmation of deletion via email

To delete your account:

• • In-app: Settings → Account → Delete Account
• • Email: support@ovrfinance.io with subject "Account Deletion Request"

7.1 Service Providers

The providers below support this website today. Rows marked "(app)" are planned for the Ovr app and are not receiving any data yet, because the app has not launched. We describe the data each one receives rather than listing certifications we do not hold ourselves; for a provider's own compliance posture, see its documentation.

Providers may change as the product develops. We will update this section when they do.

7.2 Legal Disclosures

We may disclose personal data when required by law or to protect rights:

• • Court orders and subpoenas
• • Government requests (law enforcement, regulatory inquiries)
• • Tax authorities as required by law
• • Fraud prevention and safety protection
• • Enforce Terms of Use

7.4 International Data Transfers

Ovr Finance™ operates primarily in the United States. If you access our Services from outside the U.S., your data may be transferred to, stored, and processed in the United States.

Safeguards: data is encrypted in transit and access to it is restricted. Ovr is a U.S. company building for a U.S. launch and does not currently rely on Standard Contractual Clauses or certify under the EU-U.S. Data Privacy Framework. If we begin offering the Services in the EU, EEA, or UK, we will put an appropriate transfer mechanism in place and update this Policy before doing so.

9.1 No Knowing Collection

We do not knowingly collect, use, or share personal information from children under 18. If we discover a minor has provided data:

• • We will delete it immediately
• • We will notify parents/guardians (if contact information is available)
• • We will terminate the account

9.3 COPPA Compliance (U.S.)

We comply with the Children's Online Privacy Protection Act (COPPA). We do not collect personal information from children under 13, allow children under 13 to create accounts, or target advertising to children.

10.2 Types of Cookies We Use

10.4 Mobile App Tracking

• • iOS:We comply with Apple's App Tracking Transparency (ATT) framework
• • Android:We comply with Google's advertising policies. We do NOT use advertising IDs for tracking.

12.1 Subscription Payments

All subscriptions are processed securely through the Apple App Store or Google Play Store, depending on your device.

Important: We do NOT collect or store your payment information. All billing is handled directly by Apple or Google.

12.2 Managing Your Subscription

You can manage or cancel your subscription at any time through your device settings:

• iOS: Settings > Apple ID > Subscriptions
• Android: Google Play > Menu > Subscriptions

13.3 App Permissions

16.1 California Residents (CCPA/CPRA)

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out of Sale/Sharing: We do NOT sell or share personal information
• Right to Non-Discrimination: We will not discriminate for exercising CCPA rights

How to Exercise:Email privacy@ovrfinance.io with subject "CCPA Request - [Right Being Exercised]"

Other U.S. States

We honor access, correction, and deletion requests from residents of any U.S. state, including those with comprehensive privacy laws:

• • Virginia (VCDPA)
• • Colorado (CPA)
• • Connecticut (CTDPA)
• • Utah (UCPA)
• • Montana, Oregon, Texas, and other emerging state laws

Email privacy@ovrfinance.io with your state in the subject line.

18.1 Use of AI and Algorithms

Ovr Finance™ uses AI and algorithms to:

• • Calculate optimal debt payoff strategies
• • Recommend payment amounts and timing
• • Predict debt-free dates
• • Personalize financial insights

18.3 Where Processing Happens

Payoff schedules, interest projections, and debt-free dates are produced by our own deterministic calculations on our own systems. These do not involve a third-party language model.

AI Recalibration will work differently. It will not be performed on your device. When you run a recalibration, the account details needed for that request — such as balances, APRs, minimum payments and the budget figure you entered — will be sent to a third-party AI service provider that processes them on our behalf and returns a result. We will not send your name, email address, or bank login credentials as part of that request.

We will identify that provider by name, list the exact data sent, and ask for your explicit permission on a consent screen in the app before your first recalibration ever runs. You will be able to withdraw that permission at any time in Settings, and recalibration will simply stop being available. Before AI Recalibration becomes available we will name that provider here and require by contract that your inputs are not used to train its models; we are not describing an agreement that is already in place today. If we change providers, we will update this Policy and ask again — we will not make that change quietly.

18.4 No Profiling for Adverse Decisions

We do NOT use AI or profiling to deny services, charge different prices based on protected characteristics, or discriminate based on race, ethnicity, religion, gender, etc.

19.1 Types of Communications

19.2 How to Opt-Out of Marketing

• • Email:Click "Unsubscribe" at the bottom of any marketing email
• • SMS: Reply STOP to any marketing text
• • Push Notifications: Device settings or in-app Settings → Notifications

While we implement robust security measures, we cannot guarantee absolute security. We are NOT liable for unauthorized access due to circumstances beyond our control, cyberattacks that bypass security measures, your own security lapses, or third-party breaches.

Liability Cap: Where liability cannot be excluded by law, our total aggregate liability is limited to the lesser of $100 USD or the total amount you paid to Ovr Finance in the 12 months prior to the claim.