Privacy Policy

A. Information You Provide Directly

We may collect information that you provide directly to Booster, including:

• Your name
• Your email address
• Account registration and authentication information
• Profile details and account preferences
• Payday schedules, pay frequency, anchor-payday selections, and time-zone settings
• Financial goals and budgeting preferences
• Transaction-category and subcategory corrections
• Communications with Booster
• Customer-support requests
• Survey responses
• Beta-testing feedback
• Bug reports
• Any other information you voluntarily submit through the Service

When you register or sign in through Apple or Google, we may receive information that you authorize those services to provide, such as your name, email address, and a unique authentication identifier.

B. Information From Connected Financial Accounts

When you choose to connect a financial account through Plaid, Booster may receive read-only financial information made available by your financial institution and authorized by you.

This information may include:

• Financial-institution name
• Account name
• Account type and subtype
• Masked account identifiers
• Current and available balances
• Transaction dates
• Transaction amounts
• Transaction descriptions
• Merchant names
• Transaction locations
• Transaction categories and subcategories
• Pending and posted transaction status
• Income and direct-deposit information
• Recurring-transaction indicators
• Account-ownership information, when supported and authorized
• Other financial information supported by the account connection you approve

The exact information available may vary depending on your financial institution, the accounts you connect, and the permissions you grant.

Plaid provides technology that allows users to connect financial accounts and share authorized data with applications such as Booster. Plaid maintains its own privacy notices and account-management tools.

Depending on the connection method used by your financial institution, you sign in with your financial institution directly or inside Plaid’s connection flow. Booster never receives or stores your online-banking username or password.

The connection is read-only. Booster can view the information you authorize, but it cannot move money, make payments, or change anything in your bank account. You can disconnect an account at any time (see Section 10).

C. Information Collected Automatically

When you use Booster, we may automatically collect technical and usage information, including:

• Device type
• Mobile operating system
• Browser type
• App version
• Internet Protocol address
• Device or application identifiers
• Login dates and times
• Features accessed
• Screens viewed
• Interaction and navigation data
• Crash reports
• Error logs
• Diagnostic information
• Performance information
• General location inferred from an IP address, such as city, state, or country

We may use cookies, local storage, software development kits, or similar technologies on our website or application to:

• Maintain user sessions
• Authenticate users
• Remember preferences
• Measure performance
• Diagnose technical issues
• Protect the Service
• Understand how users interact with Booster

D. Product Analytics and Crash Diagnostics in the App

To find problems and improve Booster, the mobile app uses Google Firebase Analytics for product usage analytics and Firebase Crashlytics for crash and error diagnostics. These services are provided by Google, which processes this information to provide them to us. They are turned on by default in the app.

This may include:

• Which screens and features you use, and app events such as completing a step or seeing an error
• Crash reports and error codes
• App version, build, platform, and device or operating-system information
• A pseudonymous app-instance identifier and, after you sign in, a pseudonymous Booster account identifier that is not your name or email address

These events are limited to an approved list and exclude bank login credentials, account and card numbers, balances, transaction amounts and descriptions, merchant names, and your email address. Booster does not use screen recording or session replay.

Booster uses this information only for its own product quality and reliability. It is not used for advertising, the app does not collect advertising identifiers through these services, and Booster does not use it to track you across apps or websites owned by other companies.

You can turn product analytics and crash diagnostics off at any time in the app under Profile › Privacy & data, also available from the subscription screen. Turning them off applies on that device, stops new usage events and crash reports, and does not limit any feature. It does not delete information already sent. Deleting your account keeps a device-level opt-out in place.

We may use the information we collect to:

• Create and maintain your Booster account
• Authenticate your identity
• Connect financial accounts that you authorize
• Retrieve and display authorized financial information
• Organize transactions through Booster’s Debt, Essentials, Savings, and Living framework
• Provide transaction-category and subcategory breakdowns
• Calculate and display current pay periods based on the schedule you configure
• Generate personalized financial insights
• Identify significant spending changes
• Identify major spending categories and subcategory drivers
• Analyze income distribution
• Identify meaningful changes in transaction frequency
• Display supporting transactions and evidence behind an insight
• Allow users to review and correct classifications
• Preserve original classifications and correction history
• Improve future personalization
• Provide budgeting and financial-planning functionality
• Develop adaptive budgeting based on user-selected goals, preferences, and habits
• Maintain the functionality and security of the Service
• Diagnose bugs and technical problems
• Monitor performance
• Detect fraud, abuse, unauthorized access, or security incidents
• Respond to customer-support requests
• Communicate about Booster, beta access, product updates, security matters, and administrative issues
• Conduct research and analytics
• Develop and improve Booster’s features
• Enforce our agreements
• Comply with applicable laws and lawful requests

We may use aggregated or deidentified information for analytics, research, product improvement, security, and business planning when the information cannot reasonably be linked to a particular person.

Booster does not use connected financial information to make decisions concerning your eligibility for:

• Credit
• Employment
• Housing
• Insurance
• Government benefits

Booster may classify transactions using its Debt, Essentials, Savings, and Living framework, referred to as the DESL system.

Transactions may also be assigned categories and subcategories based on data received from financial-data providers, Booster’s classification systems, user input, or a combination of these sources.

When you correct a transaction category or subcategory:

• Booster may retain the original classification
• Booster may retain the corrected classification
• Booster may record the date and nature of the correction
• Booster may maintain an immutable correction history
• Booster may use the correction to improve future personalization and classification accuracy

Preserving both the original and corrected information helps Booster explain how classifications changed and maintain consistency over time.

To forecast your cash flow, Booster needs to know what kind of money movement each transaction is: a purchase, a refund, a paycheck, a transfer between your own accounts, a payment to a person, and so on. Booster’s own rules decide this for most transactions. For transactions the rules cannot settle, Booster sends a short, redacted description of the transaction to a third-party classification service and asks it a fixed set of questions.

Booster uses TypeSafe (TypeSafe System One, api.typesafe.ai) as its classification provider, and may use the OpenAI application programming interface for the same purpose as a backup provider. Both act as processors on Booster’s behalf: they receive the description, return an answer, and are bound by their own terms.

What Is Sent

• The transaction description as your bank or Plaid provides it, for example “ACH DEPOSIT PAYROLL” or a store name
• The merchant name, when Plaid identifies one
• The names and types of counterparties Plaid identifies, for example a store, a payment app, or a person
• The amount and whether the money came in or went out
• The kind of account the transaction belongs to, for example checking or credit card, but not the account name, institution, or number
• Plaid’s suggested category and the payment channel, for example online or in store
• Whether Booster already matched the transaction to one of your own accounts, and the kinds of accounts you have connected

What Is Removed First

Before anything is sent, Booster removes email addresses, phone numbers, account masks, card endings, reference and confirmation numbers (any number of two or more digits), and the words of the account holder’s name from the text.

What Is Not Sent

• Your name, email address, or Booster account identifier
• Bank login credentials
• Full or partial account or card numbers
• Account balances
• The name of your financial institution
• Transaction dates
• Your location

A counterparty name may still be the name of a person you paid or who paid you, as it appears in the bank record. Booster uses the provider’s answer only to classify that transaction. The providers are not authorized to invent transactions or amounts, change Booster’s financial conclusions, access your accounts, or move money.

OpenAI states that data submitted through its API platform is not used to train or improve its models by default. TypeSafe processes requests under its own terms and privacy notice.

Booster may generate personalized financial insights based on validated financial information and predetermined eligibility rules.

Booster’s backend systems are responsible for:

• Determining financial facts
• Calculating values and percentages
• Evaluating whether an insight qualifies
• Ranking eligible insights
• Identifying supporting transactions
• Maintaining insight history
• Determining when an insight has materially changed
• Removing outdated insights from the active feed while preserving appropriate history

Booster may use the OpenAI application programming interface to improve the clarity, readability, tone, or presentation of wording associated with validated insights. Transaction classification is described separately in Section 4.

Information submitted for this limited purpose may include:

• Transaction categories
• Transaction subcategories
• Transaction amounts
• Relevant time periods
• Spending changes
• Income-distribution observations
• Transaction-frequency observations
• Validated financial conclusions
• Supporting contextual information needed to word the insight

OpenAI is not authorized by Booster to:

• Invent transactions
• Invent financial amounts
• Select which financial signals qualify
• Alter validated financial calculations
• Change Booster’s financial conclusions
• Access bank login credentials
• Move money
• Initiate payments
• Make purchases
• Control a user’s financial account

OpenAI states that data submitted through its API platform is not used to train or improve its models by default.

Booster is free while it is in beta. If Booster offers a paid subscription, it is sold as an auto-renewing monthly or yearly subscription through the Apple App Store or Google Play. Apple or Google handles the payment. Booster never receives your payment card number.

Booster uses RevenueCat, a subscription-management service, to confirm which subscription is active on your account and to restore purchases across devices. For this purpose RevenueCat may receive:

• A pseudonymous Booster account identifier, which is not your name or email address
• Purchase receipts and transaction identifiers issued by Apple or Google
• The app platform, app version, and device or operating-system information
• The dates on which a subscription starts, renews, or ends

RevenueCat does not receive your financial-account information, transactions, or forecasts. You manage, cancel, or change a subscription in your Apple or Google account settings. Deleting your Booster account does not cancel a subscription (see Section 11).

We may disclose information to vendors, contractors, and service providers that assist us in operating Booster.

These providers may include companies that provide:

• Financial-account connectivity, including Plaid
• Cloud hosting
• Database infrastructure
• Authentication services
• Application development infrastructure
• Transaction classification, including TypeSafe and OpenAI, as described in Section 4
• Artificial-intelligence processing, including OpenAI
• Subscription management, including RevenueCat
• Error reporting
• Application monitoring
• Security services
• Fraud prevention
• Email delivery
• Customer communications
• Analytics
• Customer support
• App-store purchases and subscription billing, handled by Apple and Google
• Legal, compliance, or professional services

These providers may process information only as necessary to perform services for Booster, subject to applicable contractual obligations and law.

We may also disclose information:

• When required by law
• In response to a subpoena, court order, warrant, or lawful government request
• To investigate suspected fraud or misuse
• To prevent or respond to security incidents
• To protect the rights, safety, security, or property of Booster, our users, or others
• To enforce our agreements or policies
• In connection with a merger, acquisition, financing, restructuring, bankruptcy, sale, or transfer of some or all company assets
• At your direction
• With your consent

Booster does not sell your personal information.

Booster does not sell connected financial-account information.

Booster does not share connected financial information for cross-context behavioral advertising.

Booster does not permit third-party advertisers to use your bank-account or transaction information to target advertising to you.

Product analytics and crash diagnostics described in Section 1.D are used only to operate and improve Booster, not for advertising or cross-company tracking.

If Booster’s practices materially change in the future, we will update this Privacy Policy and provide any notice, consent mechanism, or opt-out right required by applicable law before implementing the change.

We retain information for as long as reasonably necessary to:

• Provide the Service
• Maintain your account
• Display transaction history
• Generate and preserve financial insights
• Preserve classification and correction history
• Maintain security records
• Detect fraud or misuse
• Resolve disputes
• Enforce agreements
• Comply with legal, regulatory, accounting, or reporting requirements
• Support legitimate business operations

While your account remains active, Booster may retain:

• Imported transaction information
• Account metadata
• DESL classifications
• Original classifications
• User corrections
• Correction history
• Insight records
• Insight revisions
• Supporting evidence
• Payday settings
• Preferences
• Financial goals
• Account activity and security logs

When information is no longer reasonably necessary, we may delete, aggregate, or deidentify it.

When you delete your account, Booster deletes your profile, your bank connections, and the financial data Booster imported or calculated for you, except for the limited records described in Section 11.

Some information may remain temporarily in encrypted backups, system logs, fraud-prevention records, or disaster-recovery systems until removed through normal retention processes.

If you join the waitlist on our website, we keep your email address until we have sent the launch updates you asked for or you ask us to remove it.

You may disconnect a connected financial account through Booster’s available account controls or through account-management tools provided by Plaid.

Plaid Portal allows users to review and manage certain connections made through Plaid.

Disconnecting an account generally stops Booster from receiving new information through that connection.

Disconnecting an account does not necessarily delete information that was previously imported into Booster.

To request deletion of previously imported information, contact us using the information in the Contact Us section below.

Delete Your Account in the App

Open Profile in the Booster app and tap Delete account. Deletion permanently removes your Booster profile, your bank connections, and the financial data Booster imported or calculated for you. It cannot be undone. If you sign up again later, you start with a new, empty account.

Request Deletion Without the App

If you cannot use the app, submit a request on our website at https://www.boosterfinancialapp.com/account-deletion, or request deletion of your Booster account and associated personal information by contacting:

admin@boosterfinancialapp.com

Use the subject line:

Booster Privacy Request

Include:

• Your name
• The email associated with your Booster account
• The type of request
• A description of the information you want deleted

Do not include:

• Bank login credentials
• Passwords
• Complete bank-account numbers
• Complete card numbers
• Social Security numbers
• Other highly sensitive authentication information

We may need to verify your identity before completing a deletion request.

Deletion may not be immediate. We may retain limited information when reasonably necessary to:

• Comply with law
• Prevent fraud
• Maintain security
• Resolve disputes
• Enforce agreements
• Complete an active transaction or request
• Maintain legally required business records

Deletion requests submitted directly to Booster do not automatically delete information maintained independently by Plaid or another third-party service provider. Users may need to submit a separate request to the relevant provider. Plaid provides separate tools for managing connections and certain data requests.

Deleting your Booster account does not automatically cancel an active Apple App Store or Google Play subscription. Cancel the subscription in your Apple or Google account settings to prevent future renewal charges. You may still submit an account deletion request before or after canceling the subscription.

Depending on where you live and whether applicable legal thresholds are met, you may have the right to:

• Request access to personal information we maintain about you
• Request information about the categories of personal information we collect
• Request information about the purposes for which information is used
• Request information about categories of third parties to which information is disclosed
• Request correction of inaccurate information
• Request deletion of information
• Request a portable copy of certain information
• Withdraw consent where processing is based on consent
• Object to or restrict certain processing
• Opt out of the sale or sharing of personal information
• Appeal the denial of a privacy request
• Receive service without unlawful discrimination for exercising a privacy right

To submit a privacy request, email:

admin@boosterfinancialapp.com

Use the subject:

Booster Privacy Request

We may request information reasonably necessary to verify your identity and protect your account.

We will respond within the time required by applicable law.

California law provides qualifying consumers with rights concerning access, correction, deletion, and certain uses of personal information. The specific requirements depend partly on whether a business meets applicable statutory thresholds.

Booster does not currently sell personal information or share it for cross-context behavioral advertising.

We use reasonable administrative, technical, and organizational safeguards designed to protect information from:

• Unauthorized access
• Unauthorized disclosure
• Loss
• Misuse
• Alteration
• Destruction
• Fraud
• Security incidents

Our safeguards may include:

• Encryption in transit
• Encryption at rest where appropriate
• Authentication controls
• Role-based access restrictions
• Restricted production access
• Logging
• Monitoring
• Secure cloud infrastructure
• Secret-management systems
• Database-access controls
• Separation of application functions
• Incident-response procedures
• Secure software-development practices
• Vendor-security review
• Data minimization
• Backup and recovery procedures

The FTC recommends that businesses understand what sensitive information they possess, retain only what is needed, protect retained information, dispose of it securely, and plan for security incidents.

No method of electronic transmission or storage is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed by an unauthorized party.

Booster is intended for adults and is not directed to individuals under 18 years of age.

We do not knowingly collect personal information from anyone under 18.

If we learn that we collected information from a person under 18, we will take reasonable steps to delete it.

A parent or legal guardian who believes a minor has submitted information to Booster may contact:

admin@boosterfinancialapp.com

Booster may integrate with or provide access to services operated by other companies, including:

• Plaid
• Apple
• Google
• TypeSafe
• OpenAI
• RevenueCat
• Financial institutions
• Cloud-service providers
• Authentication providers
• Analytics and crash-reporting providers, including Google Firebase
• Customer-support platforms

These third parties maintain their own privacy notices, terms, data-retention practices, and security procedures.

This Privacy Policy applies to Booster’s handling of information. It does not govern information independently collected or processed by a third party under that party’s own terms or privacy policy.

Booster is currently intended primarily for users located in the United States.

Information may be stored or processed in the United States or in other countries where Booster or its service providers operate.

Privacy and data-protection laws in those countries may differ from the laws in your location.

The current Booster beta is read-only.

Booster is being developed to provide increasingly personalized and adaptive budgeting based on:

• User-selected goals
• Spending habits
• Income patterns
• Debt-repayment priorities
• Savings priorities
• Budgeting preferences
• User-created rules
• Financial-account activity

Future goals may include helping users:

• Pay down significant debt
• Pay down debt while continuing to save
• Build emergency savings
• Save for large expenses
• Establish spending boundaries
• Adapt a budget as circumstances change

If Booster later introduces functionality involving:

• Money movement
• Payment initiation
• Account transfers
• Automated financial actions
• Recurring-obligation management
• Automated budgeting changes
• Other materially different financial services

we will revise this Privacy Policy and provide any legally required notice, disclosure, authorization, or consent before those practices begin.

We may update this Privacy Policy as:

• Booster develops
• Our technology changes
• Our data practices change
• New functionality is introduced
• Legal or regulatory requirements change
• Service providers change
• Security practices evolve

When we make material changes, we may provide notice through:

• The Booster application
• Our website
• Email
• An account notification
• Another reasonable method

The Effective Date at the top of this Privacy Policy indicates when the current version became effective.

Your continued use of Booster after an updated Privacy Policy becomes effective means that the updated policy will apply to your continued use, subject to applicable law.

For questions, concerns, account-deletion requests, data-access requests, or other privacy matters, contact:

Booster Financial Incorporated Doing business as Booster

Email:admin@boosterfinancialapp.com

Website:https://www.boosterfinancialapp.com

We respond to privacy questions and requests within the time required by applicable law.