Privacy Policy

1. Who We Are

FinBoost is operated by Zuwiro LLC, a Wyoming limited liability company. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our credit repair and financial management platform ("Service").

2. Information We Collect

2.1 Information You Provide

• Account registration data: name, email address, password
• Profile information: date of birth, last 4 digits of SSN
• Financial data you enter: income, debts, tax information
• Credit report data pulled with your explicit consent via Array
• Bank account data linked via Plaid with your explicit consent

2.2 Information Collected Automatically

• Log data: IP address, browser type, pages visited
• Device information: operating system, screen resolution
• Cookies and similar tracking technologies for session management

3. How We Use Your Information

• To provide credit analysis, dispute letter generation, and financial recommendations
• To pull your credit report from credit bureaus via our authorized provider (Array)
• To connect your bank accounts for transaction analysis via Plaid
• To calculate tax estimates and provide optimization suggestions
• To authenticate your identity and maintain account security
• To communicate with you about your account and service updates
• To comply with legal obligations under FCRA, FDCPA, CROA, and other applicable laws

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption at rest: Sensitive data (Plaid tokens, financial identifiers) is encrypted using AES-256-GCM
• Encryption in transit: All connections use TLS 1.2+ with HTTP/2
• Password security: Passwords are hashed using bcrypt with salt rounds
• SSN protection: We only store the last 4 digits of your Social Security Number, never the full SSN
• Access controls: Data is isolated per user with session-based authentication
• Rate limiting: API endpoints are rate-limited to prevent abuse
• CSRF protection: All state-changing requests are protected against cross-site request forgery

5. Third-Party Services

We integrate with the following third-party services:

• Array (array.io): Consumer-permissioned credit report data from Equifax, Experian, and TransUnion
• Plaid: Secure bank account linking and transaction data
• OpenAI: AI-powered analysis for dispute letters and financial recommendations. Your personal data is not used to train AI models.
• Google OAuth: Optional sign-in method. We receive only your name and email.

Each third-party provider has its own privacy policy. We encourage you to review them.

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we permanently remove your personal data within 30 days, except where retention is required by law (e.g., tax records, dispute correspondence under FCRA).

7. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and associated data
• Export your data in a portable format
• Withdraw consent for credit report pulls or bank linking at any time
• Opt out of marketing communications

California residents may have additional rights under the CCPA/CPRA.

8. Children's Privacy

Our Service is not directed to anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at: