Legal
Privacy Policy
Effective date: October 15, 2026 · Version 1.1
Categoric, Inc. (“Categoric”, “we”, “our”) operates the Categoric financial operations platform. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over your information.
Questions? Email privacy@categoric.ai.
1What data we collect
We collect only what is necessary to provide the service. We do not sell your data, and we do not use it to train AI models.
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email address, business name | Create and manage your account |
| Financial transaction data | Bank transactions, invoices, payroll records, journal entries | Core product functionality — bookkeeping, reconciliation, reporting |
| Bank connection metadata | Account name, last 4 digits, institution name | Display connected accounts; reconciliation |
| Uploaded documents | Bank statement PDFs, receipts, CSV exports | Parse transactions and prepare categories |
| Usage data | Pages visited, features used, session duration | Improve the product; diagnose errors |
| Authentication data | Hashed passwords, MFA factors, passkey credentials | Secure your account |
| Communications | Support emails, feedback submissions | Respond to your requests |
| Early-access applications | Name, work email, business or firm, entity count, volume, accounting system, workflow | Review your request and follow up about access |
We do not collect Social Security numbers, full payment card numbers, or government-issued ID numbers. Payment card data is handled entirely by Stripe (PCI DSS Level 1) and never touches our systems.
2How we use your data
- Provide, maintain, and improve the Categoric platform
- Prepare transaction categories using AI and prior accounting history (anonymized — no PII sent to AI providers)
- Send transactional emails: account security alerts, invoice notifications, reconciliation summaries
- Respond to support requests
- Review early-access requests and contact applicants about next steps
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
We do not use your financial data for advertising, profiling, or any purpose beyond operating the service you signed up for.
3AI and your data
Categoric uses AI and accounting history to prepare transaction categories and power the Ask Categoric financial assistant. We take the following steps to protect your data:
- No PII transmitted. Transaction descriptions sent for AI-assisted category preparation are stripped of account identifiers before leaving our systems.
- Zero data retention. Our AI inference provider (OpenRouter) is configured with Zero Data Retention — your data is not stored beyond the immediate API response.
- No training on your data. Our contract with OpenRouter explicitly prohibits use of your data to train or fine-tune AI models.
- AI responses not retained. AI-generated responses are not stored beyond your active conversation session unless you explicitly save them.
4Data retention
We retain your data only as long as necessary. The table below summarizes our retention schedule.
| Data type | Retention period |
|---|---|
| Financial records (transactions, invoices, payroll) | Retained while your workspace is active. Soft-deleted with a 30-day grace period, then permanently purged. |
| Bank access tokens | Retained only while the connection is active. Immediately revoked and deleted when you disconnect. |
| User account data | Retained while your account is active. Permanently purged 30 days after account deletion. |
| Early-access applications | Retained in HubSpot for review and follow-up; contact privacy@categoric.ai to request deletion. |
| Session tokens | Purged on expiry (60-minute idle timeout by default). |
| Audit and access logs | 90 days hot storage; up to 1 year in cold archive. |
| Database backups | Rolling 30-day window. Automatically expired. |
| AI inference data | Not retained by our AI provider beyond the immediate request. |
Deletion uses a two-phase process: records are immediately hidden from all views, then permanently and irreversibly purged after the grace period. Deleted data cannot be recovered.
5Who we share your data with
We do not sell your data. We share it only with the following service providers to operate the service. Processing terms require legal review before public launch.
| Subprocessor | Role | Data shared |
|---|---|---|
| Supabase | Database & authentication infrastructure | All platform data at rest |
| Plaid | Bank data aggregation | Bank account metadata and transactions (read-only) |
| OpenRouter | AI inference (Zero Data Retention enabled) | Anonymized transaction descriptions — no PII |
| Resend | Transactional email | Email address and notification content |
| HubSpot | Early-access request management | Applicant contact details, business and requested workflow |
| Stripe | Payment processing | Billing information only — no financial transaction data |
We may disclose data if required by law, court order, or to protect the rights, property, or safety of Categoric, our users, or the public.
6Security
Categoric is built to financial services security standards. Key controls include:
- Encryption. AES-256 at rest for all stored data. TLS 1.2+ for all data in transit. Bank access tokens receive additional application-level encryption.
- Multi-factor authentication. TOTP authenticator apps and FIDO2 passkeys (phishing-resistant) available to all users.
- Multi-tenant isolation. Your data is isolated from other customers’ data through four enforcement layers: JWT validation, API middleware, query scoping, and database row-level security.
- Least privilege. Bank integrations are read-only. No integration can initiate payments or modify your bank account.
- Continuous security scanning. Every code change is scanned for vulnerabilities (SAST), dependency risks (SCA), and leaked secrets before deployment.
Our full Information Security Program is available to enterprise partners and auditors upon request under NDA. Contact security@categoric.ai.
7Your rights
Depending on where you are located, you may have the following rights over your data. To exercise any of these rights, email privacy@categoric.ai. We respond within 3 business days and fulfill requests within 30 days.
| Right | Description | How to exercise |
|---|---|---|
| Access | Request a copy of the data we hold about you | Email privacy@categoric.ai |
| Correction | Correct inaccurate personal data | Update directly in account settings, or email us |
| Erasure (GDPR Art. 17 / CCPA §1798.105) | Request permanent deletion of your account and data | Delete account in settings, or email privacy@categoric.ai |
| Portability | Receive your data in a machine-readable format | Email privacy@categoric.ai |
| Opt-out of sale | We do not sell your data — this right is automatically satisfied | No action required |
| Withdraw consent | Withdraw consent for optional processing at any time | Email privacy@categoric.ai |
8Cookies
Categoric uses only functional cookies necessary to operate the service (authentication sessions, CSRF protection, user preferences). We do not use advertising cookies or third-party tracking pixels.
9Children's privacy
Categoric is a business financial platform and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact privacy@categoric.ai and we will delete it promptly.
10Changes to this policy
We may update this policy as our practices evolve or regulations change. Material changes will be communicated by email at least 30 days before taking effect. The effective date at the top of this page reflects the most recent revision. Continued use of the service after a material change constitutes acceptance.
11Contact
For privacy-related questions, requests, or complaints:
This policy is reviewed after material changes to our data practices. Contact us for current details about privacy controls, security practices, or regulatory requests.