Privacy Policy

SDA-IQ is a financial planning application operated by SDA Networx ("we", "us"). This policy explains what data we collect, why, and what we do — and don't do — with it.

What we collect

• Account information — your name, email address, and a hashed password (we never store the password itself).
• Financial information you provide — balances, transactions, bills, income, goals, businesses, and properties you enter or import.
• Bank data via Plaid — if you choose to connect a bank account, we receive transaction and balance data through Plaid, Inc. We never see or store your bank username or password; that credential exchange happens entirely with Plaid. Plaid's own privacy policy is at plaid.com/legal.
• Usage and security records — sign-in events, device sessions, and an audit log of security-relevant actions on your account.

How we use it

• To run the product: computing your safe-to-spend, forecasts, predictions, and recommendations. All analysis runs against our own database.
• To secure your account: session management, multi-factor authentication, and audit logging.
• To operate the service: aggregate, non-public operational statistics (for example, how many accounts exist and how far users get in the product).
• To read documents you upload. When you upload a settlement statement, a lender packet or a similar document, we send it to an AI provider (Anthropic) to propose the figures it contains. Nothing it proposes is saved until you confirm it, and every figure it proposes shows you the page it came from. You can enter the figures yourself instead; the document is still kept as your evidence.

What we never do

• We do not sell your data, to anyone, for any purpose.
• We do not share your financial data with advertisers or data brokers.
• We do not use your data to train AI models, and neither does our provider: our agreement with Anthropic states that Anthropic may not train models on what we send. Two things go to that provider, and nothing else does: a coach question, with the minimum context needed to answer it, and a document you upload for reading. Your financial records as a whole are never sent, and your bank credentials never exist on our side at all.

How it's protected

• All traffic is encrypted in transit (TLS).
• Sensitive stored secrets (bank access tokens, authentication secrets) are encrypted at rest with keys held outside the database.
• Documents you upload are encrypted at rest with keys held outside the database. When a document is deleted under our retention policy, its bytes are destroyed and only its identity and a fingerprint remain, so we can still tell you what was once there.
• Access to production systems is limited to named operators with multi-factor authentication, and access to operational data is audited.

Retention and deletion

We keep your data while your account is active so the product can learn from your history — that memory is the product. If you ask us to delete your account, we delete your personal and financial data from the live database and it ages out of our rotating backups within 30 days. To request deletion, email privacy@sdanetworxhq.com.

Your choices

• You can disconnect a linked bank at any time, which stops all further data flow from it.
• You can correct or delete individual records (transactions, patterns, entities) inside the product.
• You can request a copy or deletion of your data by emailing privacy@sdanetworxhq.com.

Changes

If this policy changes materially, we'll notify you in the product before the change takes effect, and the version number above will change.

Contact

Questions: privacy@sdanetworxhq.com