Privacy Policy

CardIQ ("we," "us," or "our") is operated by CardIQ LLC. This Privacy Policy explains how we collect, use, and protect your information when you use CardIQ at cardiq.net (the "Service").

By using CardIQ, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following types of information:

• Payment information: When you pay for CardIQ ($9.99 one-time fee), your payment is processed by Stripe. We do not store your credit card number, expiration date, or CVV. Stripe handles all payment data in accordance with PCI-DSS standards.
• Bank transaction data (Plaid): If you choose to connect your bank account, we use Plaid to retrieve your transaction history. Your bank login credentials go directly to Plaid — CardIQ never sees or stores them. Transaction data is processed in your browser session and is not stored on our servers.
• PDF statement data: If you upload a bank or credit card statement, the PDF is sent to Anthropic's Claude API for transaction extraction and categorization. The data is processed in real time and is not stored by CardIQ or Anthropic after processing. Anthropic's API has zero data retention by default.
• Email address: Collected at account creation for the purpose of account management and service communications.
• Usage data: We may collect basic analytics such as pages visited and features used, without linking this to your personal identity.

2. How We Use Your Information

We use your information solely to provide the CardIQ service, which includes:

• Analyzing your spending patterns to generate personalized credit card recommendations
• Processing your payment for the Service
• Communicating with you about your account or the Service
• Improving the accuracy of our recommendation engine

We do not sell, rent, or share your personal information or financial data with third parties for marketing purposes.

3. Third-Party Services

CardIQ relies on the following third-party services to operate. Each has its own privacy policy:

• Plaid Inc. — bank account connectivity. Plaid's privacy policy is available at plaid.com/privacy.
• Stripe Inc. — payment processing. Stripe's privacy policy is available at stripe.com/privacy.
• Anthropic PBC — AI-powered statement analysis. Anthropic's privacy policy is available at anthropic.com/privacy. Anthropic does not use API data to train its models and applies zero data retention to API requests.
• Vercel Inc. — hosting and infrastructure. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

4. Data Retention

CardIQ does not maintain a database of your financial transactions. Transaction data analyzed through Plaid or uploaded PDF statements is processed in memory during your session and discarded when your session ends. We do not retain your bank transaction history.

Your email address is retained for as long as your account is active. You may request deletion at any time by contacting us.

5. Data Security

CardIQ is hosted on Vercel, which maintains SOC 2 Type II certification and enforces TLS encryption on all connections. API credentials are stored as encrypted environment variables and are never exposed in client-side code. We do not operate our own database, which significantly limits the attack surface for data breaches.

6. Your Rights

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent for data processing at any time
• Lodge a complaint with a data protection authority if you believe your rights have been violated

To exercise any of these rights, contact us at ryan.c.holman12@gmail.com.

7. Children's Privacy

CardIQ is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes your acceptance of the updated policy.

9. Fair Credit Reporting Act (FCRA)

CardIQ does not use Plaid's output as a "consumer report" as defined by the FCRA. CardIQ's recommendations are for informational purposes only and are not used to determine your eligibility for credit, insurance, employment, or any other purpose regulated by the FCRA.