Legal

Privacy Policy

Vision Finance • Last updated: May 28, 2026

1. Introduction

Vision Financial, Inc., a Delaware corporation ("Vision Finance," "we," "our," or "us"), operates the Vision platform at visionfinance.app. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

2. Information We Collect

2.1 Financial Account Data

When you connect your financial accounts through Plaid, we access:

  • Account balances and types
  • Transaction history (amounts, dates, merchants, categories)
  • Investment holdings (securities, quantities, values)
  • Liability information (credit cards, loans, balances)

We do not collect or store your bank login credentials. All credential exchange is handled securely by Plaid.

2.2 Authentication Data

We use Firebase Authentication as our authentication provider. When you create an account, Firebase collects your email address and password hash. We do not store passwords directly — all authentication data is managed by Google's Firebase infrastructure.

2.3 Usage Data

We may collect anonymous usage analytics to improve the platform, including pages visited and feature usage patterns.

3. How We Use Your Information

Your data is used exclusively to:

  • Display your portfolio holdings, net worth, and asset allocation
  • Provide budget tracking and spending analysis
  • Generate tax-aware insights and recommendations
  • Maintain and improve the platform's functionality

We do not sell, rent, or share your personal financial data with third parties for marketing purposes.

4. Third-Party Services

4.1 Plaid

We use Plaid Inc. ("Plaid") to securely connect to your financial institutions and retrieve your financial data on your behalf. When you link an account through Vision Finance, you authorize Plaid to connect to your selected institution and transmit your account balances, transaction history, investment holdings, and liability information to Vision Finance.

By using Vision Finance, you grant Vision Finance and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

Vision Finance does not receive or store your bank login credentials — Plaid handles all credential exchange. You can revoke Plaid's access to any linked institution at any time by disconnecting it in Settings. Plaid is SOC 2 Type II certified and PCI DSS compliant.

4.2 Firebase Authentication

We use Google Firebase for user authentication, including email/password sign-in. Firebase processes your email address and password hash. Firebase's use of your data is governed by Google's Privacy Policy. Firebase is SOC 2 and ISO 27001 certified.

4.3 Hosting & Infrastructure

Our application is hosted on Vercel (SOC 2 Type II certified) with DNS and security managed by Cloudflare (SOC 2 Type II, ISO 27001 certified). Cached portfolio snapshots, Plaid access tokens (encrypted), and rate-limit counters live in Upstash Redis (SOC 2 Type II certified).

4.4 Market data (MarketStack)

We use MarketStack to fetch end-of-day stock prices for the holdings drill-down chart. We send only the ticker symbol you're viewing — never your account balance, holdings list, or any personally identifiable information. Governed by MarketStack's Privacy Policy.

4.5 Billing (Stripe)

We use Stripe to process subscription payments. Stripe collects and stores your payment card information directly — Vision never sees your full card number. Stripe is PCI DSS Level 1 certified. Stripe's use of your data is governed by their Privacy Policy.

4.6 Error monitoring (Sentry)

We use Sentry to capture application errors and crashes so we can diagnose bugs quickly. Sentry events may include the URL you were on, the browser you used, and a stack trace. We configure Sentry to drop common network errors and do not intentionally capture PII in error reports. Governed by Sentry's Privacy Policy.

4.7 Product analytics (PostHog)

We use PostHog to understand how our product is used — which features are adopted, where users get stuck, and what to improve. PostHog records page views, button clicks, and custom events tied to your anonymized user ID. We do not send PostHog your bank account data, balances, or transaction details. Autocaptured events strip elements tagged with data-ph-no-capture or class="ph-no-capture". Governed by PostHog's Privacy Policy. You can opt out by contacting support@visionfinance.app.

4.8 Email delivery (Resend, Loops)

We use Resend to send monthly report emails and Loops for onboarding / waitlist emails. These providers see the email address we send to and the contents of the email. We use no third-party tracking pixels in marketing emails.

5. Data Security

We implement industry-standard security measures to protect your data:

  • All data in transit is encrypted using TLS 1.2 or higher
  • Plaid access tokens are encrypted at rest using AES-256 encryption
  • API keys and secrets are stored in secure environment variables, never in source code
  • Infrastructure is protected by Cloudflare's DDoS mitigation and WAF
  • Regular security audits and dependency vulnerability scanning

6. Data Retention & Disposal Policy

We retain your data only as long as necessary to provide our services. The following retention schedule applies:

6.1 Financial Account Data

  • Plaid access tokens: Retained while the account connection is active. Immediately revoked and permanently deleted when you disconnect an institution or delete your account.
  • Transaction and balance data: Cached only for the duration of your active session. No transaction data is persisted to long-term storage.
  • Investment holdings and liability data: Same as transaction data — session-only, not stored at rest.

6.2 Authentication Data

  • Account credentials: Managed by Firebase. Deleted when you delete your account. Firebase retains authentication logs for up to 30 days for security purposes.
  • Session tokens: Automatically expire and are cleared on logout or browser close.

6.3 Disposal Procedures

When data reaches the end of its retention period or you request deletion:

  • Plaid access tokens are revoked via Plaid's API and deleted from our systems
  • Authentication records are deleted from Firebase's infrastructure
  • Any cached data in browser storage is cleared
  • Anonymized, aggregated analytics data may be retained indefinitely as it cannot be linked back to individual users

6.4 Account Deletion

You may request full account deletion at any time by contacting support@visionfinance.app. Upon receiving your request, we will:

  • Revoke all Plaid access tokens within 24 hours
  • Delete your Firebase authentication account within 24 hours
  • Confirm deletion via email within 5 business days

7. Your Rights

You have the right to:

  • Access your data stored in our systems
  • Disconnect any linked financial institution at any time
  • Delete your account and all associated data
  • Request a copy of your data in a portable format

To exercise any of these rights, contact us at support@visionfinance.app.

8. Cookies & Local Storage

We use cookies and local storage for the following purposes:

  • Authentication cookies: Set by Firebase to maintain your signed-in session. These are essential for the service to function.
  • Theme preference: Stored in local storage to remember your light/dark mode selection.
  • Budget settings: Stored in local storage to persist your account mode and tax configuration.

We do not use third-party tracking cookies or advertising cookies.

9. Children's Privacy

Vision Finance is not intended for users under the age of 18. We do not knowingly collect data from minors.

10. Your Rights Under GDPR (EU / UK residents)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation:

  • Right of access — download everything we hold about you from Settings → Your Data → Export JSON, or email support@visionfinance.app.
  • Right to rectification — correct inaccurate personal data yourself in Settings, or request we correct it.
  • Right to erasure ("right to be forgotten") — delete your account from Settings → Your Data → Delete Account. We purge your Firestore documents, Redis connections, and revoke all Plaid access tokens within 30 days.
  • Right to data portability — the JSON export above is machine-readable for transfer to another service.
  • Right to restrict processing — email us to pause processing while a dispute is resolved.
  • Right to object — opt out of specific processing activities.
  • Right to lodge a complaint — contact your local supervisory authority (in the UK, the ICO).

Our legal basis for processing is (a) contract performance — we need your data to deliver the service you signed up for, (b) legitimate interest for fraud prevention and service security, and (c) consent for any optional analytics or marketing communications.

We do not transfer data outside the US/EU without standard contractual clauses where required.

11. Your Rights Under CCPA/CPRA (California residents)

California residents have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

  • Right to know what personal information we collect, how we use it, and whether we share it.
  • Right to delete personal information we have collected from you (with limited exceptions, like transactions we need to retain for legal record-keeping).
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing — Vision Finance does not sell or share your personal information with third parties for cross-context behavioral advertising. There is nothing to opt out of.
  • Right to limit use of sensitive personal information — we process sensitive financial data only to provide the service you requested.
  • Right to non-discrimination — we will not deny service or charge different prices for exercising these rights.

To exercise these rights, use the in-app controls in Settings or email support@visionfinance.app. We will verify your request by confirming ownership of the email address on file and respond within 45 days.

12. Data Retention

We retain your data as long as your account is active, plus the following periods after account deletion:

  • Plaid access tokens: revoked immediately at deletion.
  • Transaction and holdings data: deleted within 30 days.
  • Billing records (Stripe): retained for 7 years to comply with tax and accounting regulations.
  • Security logs: retained up to 90 days for fraud and abuse investigation.
  • Backups: residual data may persist in encrypted backups for up to 60 days before rotation.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app and by email at least 7 days before taking effect. Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact

For questions, data requests, or to exercise any rights under this policy, contact us at:

Vision Financial, Inc. (a Delaware corporation)
support@visionfinance.app