Privacy Policy

CakeClub, Inc.

CakeClub, Inc. ("CakeClub," "we," "us," or "our") is a Delaware corporation. This Privacy Policy explains how we handle your information when you use the CakeClub® website at www.cakeclubapp.com or the CakeClub® mobile application (together, the "Service").

The Service is offered only to individuals who are at least 18 years old and who reside in the United States. By using the Service, you agree to this Policy and to our Terms of Use.

1. Information We Collect

1.1 Information You Provide

Your name, email address, password, and, where you provide them, your date of birth and phone number. Your answers to the questions we ask when you set up your spending plan. Your spending plan, manual transactions, and any other figures you enter. Files you upload. Your questions to our AI Assistant. Your subscription status. Any message, feedback, or support request you send us.

As we release new features, we may collect additional information of the same kinds described in this Policy, for the purposes described in Section 2.

1.2 Financial Account Information

When you choose to link a financial account, we use Plaid Inc. to establish the connection. You enter your credentials directly with Plaid or your financial institution. CakeClub does not see, receive, or store your bank username, password, PIN, security questions, or authentication codes.

Once you authorize a connection, we may receive from your financial institution: institution and account names, account type, a masked account identifier, balances and credit limits, and transaction history including date, amount, merchant, description, and category. We also identify recurring payments from that transaction history.

Access is read only. The connection permits us to read information. It does not permit us to initiate payments, transfers, withdrawals, or trades, and the Service contains no functionality to do so. Plaid processes your information under Plaid’s own End User Privacy Policy at plaid.com/legal, and you can manage your Plaid connections at my.plaid.com.

1.3 Information We Collect Automatically

Device model and operating system, app version, device and installation identifiers, language, IP address and the approximate location derived from it, screens viewed and features used, session activity, notification interactions, crash reports and performance data, and, on our website, cookies and similar technologies.

1.4 Information From Other Sources

If you sign in with Apple, we receive your name, email or private relay address, and a unique identifier, but never your password. If you subscribe, we receive your subscription and renewal status from the Apple App Store. We do not receive your payment card details from Apple or from anyone else.

1.5 What We Do Not Collect

We do not collect your Social Security number, your government identification documents, or your bank credentials. If you use Face ID® or Touch ID® to unlock the app, that happens on your device and we never receive your biometric information.

2. How We Use Your Information

We use the information we collect to:

• Operate and deliver the Service, including connecting and syncing accounts, categorizing transactions, detecting recurring expenses, and building and tracking your spending plan
• Personalize your experience, including your dashboard, insights, nudges, and educational content
• Power our AI Assistant and other AI features, as described in Section 3
• Send you account, security, sync, billing, trial, and plan notifications, which are part of the Service and are not marketing
• Send you marketing and product communications, which you can opt out of at any time
• Manage your subscription status and the features available to you
• Analyze usage, diagnose problems, run tests, and develop, improve, and train our own products, features, and models
• Detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms of Use
• Comply with our legal, tax, audit, and regulatory obligations, and establish, exercise, or defend legal claims

3. Our AI Assistant

The Service includes an in-app artificial intelligence assistant built on the CakeClub methodology (the "AI Assistant"), which we may rename or replace from time to time. To give you guidance that reflects your actual situation, the AI Assistant may access and analyze the information in your CakeClub account, including your linked account balances, your full transaction history, your spending plan, your goals and persona, and your prior conversations with it.

We keep your conversation history. We retain your questions and the AI Assistant’s responses so that your guidance stays personalized over time, so the assistant understands the context of what you have already discussed, and so we can improve the quality and safety of our AI features. You can ask us to delete your conversation history at any time by contacting us, and it is removed when you delete your account.

We use technology providers to process AI requests on our behalf under contracts that restrict them to providing the service to us and prohibit them from using your information to train their own general-purpose models.

The AI Assistant can be wrong. Its responses are informational and educational only. They are not financial, investment, tax, or legal advice, and using it does not create an advisory or fiduciary relationship. Verify anything important before you act on it. Please do not enter Social Security numbers, full account numbers, or passwords into the AI Assistant.

We do not use automated decision-making that produces legal or similarly significant effects concerning you. Insights and suggestions are personalization features that you can override or ignore, and they do not determine your access to credit, employment, housing, or insurance.

4. How We Share Your Information

We do not sell your personal information. We share it only as described below.

• Service providers. We use vendors to run the Service, including financial account connectivity, cloud hosting and storage, authentication, AI processing, analytics and monitoring, customer messaging, and customer support. They act on our instructions under written contracts that require confidentiality and appropriate security and that prohibit them from selling your information or using it for their own purposes.
• Plaid. As described in Section 1.2, because you initiate that connection directly.
• At your direction. If you ask us to share information, export your data, or connect an integration.
• Legal and safety. When we reasonably believe disclosure is necessary to comply with law or legal process, enforce our Terms of Use, investigate fraud or security incidents, or protect the rights, property, or safety of CakeClub, our users, or the public.
• Corporate transactions. In connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, in which case we will require the receiving party to honor this Policy.
• Professional advisors and affiliates. Our auditors, lawyers, accountants, and insurers, subject to confidentiality, and entities under common control with us.
• Aggregated and de-identified information. We may create and use information that cannot reasonably identify you, and we do not attempt to re-identify it.

5. Cookies and Tracking

Our website uses cookies that are strictly necessary to keep you signed in and secure, as well as cookies for preferences, analytics, and marketing measurement. You can manage non-essential cookies through the banner on our site or your browser settings, and disabling them may affect functionality. We treat a Global Privacy Control or other recognized universal opt-out signal as a valid opt-out request for that browser.

Our mobile app does not use advertising cookies or third-party advertising trackers.

6. Your Choices

• Disconnect an account. Unlink any connected account in the app at any time, and we will remove its transactions from the Service. You can also revoke access through Plaid at my.plaid.com.
• Delete your data. Delete your account and its data from within the app, or contact us to have your AI Assistant conversation history removed.
• Communications. Unsubscribe from marketing email using the link in any message, or adjust your preferences in the app. You will still receive account and transactional messages.
• Device permissions. Turn off notifications, camera, photo, or location access in your device settings at any time.
• Correct your information. Edit your profile and financial inputs directly in the app, or contact us for anything you cannot change yourself.

7. Your Privacy Rights

Depending on where you live, applicable state privacy law may give you the right to confirm whether we process your personal information and obtain a copy of it, to correct inaccurate information, to delete your information, to receive it in a portable format, to opt out of sale, of sharing for targeted advertising, and of certain profiling, and to limit the use of sensitive personal information. We will not deny you service or charge you a different price because you exercised a privacy right.

We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of, but you may still submit a request. We use sensitive personal information, including your financial account information, only to provide and secure the Service and for other purposes permitted without a right to limit.

How to exercise your rights. Email hello@cakeclubapp.com to make any privacy request, including a request for a copy of your information in a portable format. We will verify your identity before acting on a request, generally by confirming control of the email address on your account, and we will respond within the time required by applicable law. You may use an authorized agent, and we may ask the agent for written permission signed by you. If we decline a request, you may appeal by replying with "Appeal" in the subject line, and if we deny your appeal you may contact your state Attorney General.

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for those parties’ own direct marketing purposes. We do not make such disclosures.

7.1 Categories of Personal Information

In the preceding twelve months we have collected the following categories of personal information as defined by California law, from the sources described in Section 1, for the purposes described in Section 2, and disclosed them for a business purpose to the categories of recipients described in Section 4: identifiers; customer records including financial account information; age; commercial information; internet and network activity; approximate geolocation; electronic and visual information; inferences; and sensitive personal information in the form of financial account information and account access. We have not sold or shared any category of personal information, and we do not knowingly sell or share the personal information of anyone under 16.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information, appropriate to our size and to the sensitivity of the data we hold. Sensitive data is encrypted in transit and at rest, account connection tokens are stored encrypted on our servers rather than on your device, and we use role-based access controls and monitoring of our production systems.

No system is completely secure and we cannot guarantee absolute security. Use a strong, unique password, protect your device, and contact us immediately at hello@cakeclubapp.com if you believe your account has been compromised.

9. Data Retention

We keep personal information for as long as your account is active, and afterwards for as long as we need it to provide and improve the Service, resolve disputes, enforce our agreements, and meet our legal, tax, accounting, and audit obligations. In determining how long to keep information, we consider the amount and sensitivity of the data, the purpose for which we hold it, the risk of harm from unauthorized use, and whether we can achieve that purpose by other means.

When you disconnect a financial account, we remove its transactions from the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period, except for information we are required or permitted to retain. Copies may remain in routine backups for a limited period before being overwritten. We may retain aggregated or de-identified information indefinitely.

10. Age Requirement

CakeClub is intended only for individuals 18 years of age and older. You must confirm that you are at least 18 to use the Service. We do not knowingly permit anyone under 18 to create an account or knowingly collect personal information from anyone under 18. If we determine that an account holder is under 18, we will close the account, disconnect any linked financial accounts, and delete the associated information. If you are a parent or guardian and believe your child has provided us with information, contact us at hello@cakeclubapp.com.

11. Financial Privacy Notice

CakeClub may be treated as a financial institution under the Gramm-Leach-Bliley Act. We collect nonpublic personal information about you as described in Section 1. We disclose it only to service providers that perform services on our behalf, as permitted under that Act, and as otherwise described in Section 4. We do not disclose nonpublic personal information about you or our former customers to nonaffiliated third parties for their own marketing purposes, so there is no opt out for you to exercise. We protect it using the safeguards described in Section 8.

12. Location of Processing and Third-Party Sites

CakeClub is operated from the United States and intended for United States residents. Your information is stored and processed in the United States. If you access the Service from outside the United States, you consent to that transfer and processing.

The Service may link to third-party sites, tools, offers, or content. We do not control those parties and are not responsible for their privacy practices. Review their policies before providing information to them.

13. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last Updated" date and post the new version at www.cakeclubapp.com/privacy-policy. If the changes are material, we will give you notice in the app, by email, or both before they take effect, and where the law requires it we will obtain your consent. Your continued use of the Service after the effective date means you accept the updated Policy.

14. Contact Us

If you have questions or concerns about this Policy or how we handle your information, please contact us.

CakeClub® and Wealth Building Formula® are registered trademarks of CakeClub, Inc. Plaid® is a registered trademark of Plaid Inc. Apple®, Face ID®, and Touch ID® are registered trademarks of Apple Inc. All other marks are the property of their respective owners.