Vysaro Privacy Policy

Effective date: November 2026

Who Vysaro is

Vysaro (vysaro.ai) is a private financial intelligence platform. Vysaro reads and analyzes the financial information you connect or provide and gives you intelligence about your own picture. Vysaro is not a bank, broker, investment adviser or fiduciary, does not hold your funds and cannot move your money.

This policy explains what data Vysaro collects, how it is used, how long it is kept and the controls you have. It is designed to comply with applicable privacy laws including the California Consumer Privacy Act and the Gramm-Leach-Bliley Act safeguards applicable to Vysaro's activities.

What Vysaro collects

Account information. Your name, email address and login credentials.

Financial account data. When you connect a financial institution through Plaid, Vysaro receives account, balance, holding and transaction data from that institution. Vysaro never sees or stores your bank login credentials; those are handled by Plaid.

Documents you upload. Statements, tax returns, policies, deeds, contracts and similar documents you choose to provide.

Conversations. Your exchanges with your Vysaro CFO.

Payment information. Handled by Stripe, Vysaro's payment processor. Vysaro does not store your card number.

Usage and log data. Standard technical logs used for security and reliability, kept on a rolling two year window.

How documents are handled

Vysaro's default is scrape and delete. When you upload a document, Vysaro extracts the financial details it needs, stores that extracted information as structured intelligence in your profile and discards the original file. Originals are not retained unless you explicitly choose to keep them.

If you choose to save a document to your Vault, the original is stored encrypted at rest with access locked to your account alone. You may delete any Vault document at any time and deletion is permanent.

Uploads you do not confirm are automatically purged within hours. For every document processed, Vysaro keeps a receipt record containing only metadata (document type, institution, date range, date scanned) so your Document History always shows what your CFO has read. Receipt records contain no document content.

How your data is used

Your data is used to provide the service: generating your CFO's analysis, briefs and answers, maintaining your financial picture, sending service communications and protecting the platform. AI processing is performed under a data processing agreement with Vysaro's AI provider and your data is used solely to provide the service to you.

Vysaro never sells, shares or licenses your personal or financial data. Vysaro shows no advertising and permits no third party to target you based on your financial information.

Service providers

Vysaro uses a small set of infrastructure providers to operate: Plaid (financial connectivity), Stripe (payments), Anthropic (AI processing), Supabase (database, authentication and encrypted document storage), Render (application hosting), Cloudflare (network security and delivery) and Resend (transactional email). Data is shared with these providers only as needed to provide the service. Vysaro may also disclose information where required by law.

Security

Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted with AES-256. Conversation content and financial connection credentials carry an additional layer of field level encryption. Every database record is protected by per user row level security enforced at the database layer. Production system access requires multi factor authentication.

Retention and deletion

Vysaro retains your data for as long as your account is open, because the value of the service is longitudinal. You may delete your account at any time from Settings, without contacting support. Deletion is immediate, permanent and irreversible: your subscription is canceled and payment details deleted at Stripe, every financial connection is revoked at Plaid, Vault documents are purged from encrypted storage, all financial data, conversations and profile information are deleted and your credentials are removed. Backups containing deleted data are purged within a maximum of 30 days. Vysaro keeps an internal record only that an account was deleted and when; it contains no financial data or document content.

Your rights

You may at any time review what Vysaro holds through Privacy and My Data in the portal, review everything your CFO has read through Document History, delete individual Vault documents and delete your entire account. California residents have the right to know, the right to delete and the right to non discrimination; because Vysaro does not sell or share personal information as defined by the CCPA, no sale opt out is required.

Children

Vysaro is not directed to and may not be used by anyone under 18.

Changes and contact

Material changes to this policy will be posted on this page with an updated effective date. Questions: support@vysaro.ai.