IlliAI Privacy Policy

This Privacy Policy describes how ILLIAI LLC (EIN: 42-3721587), 17575 Black Rail Street, Windermere, Florida 34786, United States, collects, uses, and protects your personal information when you use the IlliAI application.

Information you provide:

• Name, email address, and password when you register
• Phone number (if you enable SMS notifications or two-factor authentication by SMS)
• Financial statements you upload (CSV/PDF files)
• Bank and card account data when you connect an account through Plaid, Pluggy, or Belvo — account balances and transaction history only; we never receive or store your bank login credentials
• Event and schedule data you create
• Messages sent through the contact form
• Collected automatically: device type, operating system and browser; IP address and general location; app usage data and feature interactions; session duration and navigation patterns

• To provide and improve the IlliAI service
• To analyze your financial statements and generate insights
• To send service-related notifications and updates
• To process subscription payments via Stripe
• To respond to your support requests
• To comply with legal obligations

• Uploaded statements are processed to generate financial insights
• We do not sell, share, or use your financial data for advertising
• Statement data is encrypted at rest and in transit
• You may delete your uploaded statements at any time

We do not sell your personal information. We share data only with:

• Stripe — for payment processing
• RevenueCat — if you buy a subscription inside our iOS app. It processes the purchase with Apple and tells us which plan you are on
• Resend — for transactional emails
• Twilio — for SMS notifications and verification codes, if you enable them
• OneSignal — for push notifications
• Google — if you connect Google Calendar
• Plaid — if you connect a US or Canadian bank. Plaid's End User Privacy Policy: https://plaid.com/legal/
• Pluggy — if you connect a Brazilian bank
• Belvo — if you connect a Latin American bank
• ExchangeRate-API / Open Exchange Rates — for live currency conversion (no personal data is sent)
• Base44 — the platform that hosts the App, its database and its server functions, and that delivers push notifications to the mobile app
• Natively — the platform that builds and delivers our iOS app. If you use the App Store version, the App runs inside a container it provides, and device and diagnostic information may pass through it
• Sentry — error monitoring and diagnostics. In session recordings all text is masked and media is blocked, so balances, transactions and institution names are not captured
• AI model providers, reached through Base44 — to generate financial insights and to power the in-app assistants. These requests include financial data: transaction descriptions, amounts and dates, and the statements you upload for analysis. Claude (Anthropic) is used for the financial assistant and the combined analysis; other features use the model our platform provides. We do not use this data for advertising and we do not train AI models on it

If you choose to enable SMS, IlliAI sends text messages through Twilio for two purposes: (1) one-time verification codes for two-factor authentication and account security, and (2) account reminders you enable, such as upcoming bill due dates and calendar events. All such messages are transactional.

• Consent (opt-in): You opt in by adding your mobile number under Settings → Notifications and confirming the one-time code we text you. You are never enrolled without this explicit action, and no numbers are purchased or uploaded.
• Message frequency: Frequency varies based on your activity and the reminders you enable.
• Rates: Message and data rates may apply, depending on your mobile carrier and plan.
• Opt-out & help: Reply STOP to any message to unsubscribe, or disable SMS anytime in Settings. Reply HELP for assistance, or contact info@illi-ai.com.

We do not share your mobile information (your phone number or SMS opt-in) with third parties or affiliates for their own marketing or promotional purposes. Twilio processes your number solely to deliver the messages described above on IlliAI's behalf. Text-messaging opt-in data is never sold.

• Account data is retained while your account is active
• You may request deletion of your account and data at any time
• Deleting your account deletes your data immediately, including the statements you uploaded, and revokes your bank connections at Plaid, Pluggy or Belvo

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Opt out of non-essential communications
• Export your data in a portable format

We use industry-standard encryption (TLS/SSL) and security practices to protect your data. However, no system is 100% secure.

IlliAI is not intended for users under 18. We do not knowingly collect data from minors.

See our Cookie Policy at /cookies for details on how we use cookies.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to Know — You may request a report of the personal information we have collected about you in the past 12 months, including the categories, sources, and purposes.
• Right to Delete — You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out — IlliAI does not sell your personal information. If that changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism before doing so.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, email us at info@illi-ai.com with the subject line "CCPA Request". We will respond within 45 days.

IlliAI does not sell, rent, or share your personal information with third parties for their own marketing or advertising purposes. The third parties listed in Section 5 receive your data solely to provide services to IlliAI on your behalf, under contractual data processing obligations.

IlliAI is operated from the United States. The App, its database and its server functions are hosted by Base44, and your personal data — including financial information imported from connected institutions — is stored and processed on servers located in the United States.

If you use IlliAI from Brazil, the European Union or any other country, your data is transferred to the United States, whose data protection rules may differ from those of your country. We carry out this transfer on the basis of your consent and of the contractual obligations we impose on every processor listed in section 5, each of which is required to protect your data on terms compatible with this Policy.

You may withdraw that consent at any time by deleting your account in Settings → Privacy, which erases your data from our systems.

If you are in Brazil, the Brazilian General Data Protection Law (Lei nº 13.709/2018, the "LGPD") applies to the processing of your personal data.

Under the LGPD you may request, at any time and free of charge: confirmation that processing exists; access to your data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data that is unnecessary or excessive; portability to another provider; deletion of data processed on the basis of consent; information about the entities with which we have shared your data; information about the consequences of refusing consent; and withdrawal of consent.

Data protection officer (encarregado): requests and communications about personal data may be sent to info@illi-ai.com.

You also have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), at gov.br/anpd.

We will notify users of material changes via email or in-app notification at least 14 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Privacy questions or data requests:

ILLIAI LLC · 17575 Black Rail Street, Windermere, Florida 34786, United States · info@illi-ai.com