Our Privacy Core Values
Throughout the development and operation of the App, we seek to protect user privacy and security through the application of the following core values:- All user financial data belongs to the user, not Commander.
- All user data shall be protected and secure at all times.
- Any usage data we collect should be anonymized as much as possible, and that usage data should be geared exclusively towards improving the app.
- User data should not be stored alongside Personally Identifiable Information (such as usernames, email addresses, or payment information).
How We Protect Your Data
We use technical measures to protect your data at rest and in transit, and we use organizational and administrative safeguards to protect your data against internal misuse and abuse.Our Lawful Bases for Processing Your Data
We process your personal information under the following lawful bases:- Contractual Necessity. We process data necessary to provide the App and its features to you, as described in our Terms of Service. This includes your contact information, payment information, and the financial data you provide to use the App.
- Legitimate Interest. We process data to maintain the security, stability, and performance of the App, including error reports, server logs, anonymized usage data, and performance metrics. We balance these interests against your privacy rights and do not use this basis where those rights override our interests.
- Legal Obligation. We process data where required to comply with applicable laws, regulations, or enforceable governmental requests.
- Consent. Where required by applicable law, we obtain your consent before processing your data for specific purposes, such as sending non-essential communications. You may withdraw your consent at any time by contacting us at [email protected].
Types of Information We Collect
In order to provide the App to you we collect information directly from you, indirectly through the App, and from third-party platforms and services. In this Policy, Personal Information (also “user data” and “information”) refers to data that can be used by itself or in combination with other data we possess to identify you or gain knowledge about your finances.Information Collected Directly from You to Administer the App
We collect information you give us to provide the App to you. This includes:- Contact Information
- Information provided when you create or update an account
- Information provided to receive written updates from us about the App
- Payment Information
- Information provided when signing up for a subscription
Information Collected Directly from You for Your Use in the App
We collect information you give us to make the app work for you. This includes:- Financial Transactions and associated data you provide, such as merchant name, payment method, physical transaction location, etc.
- Financial Accounts and associated data you provide, such as account name, institution, etc.
- Links to financial accounts through third-parties (such as Plaid) to provide you with automatic account update and synchronization functionality, as well as the Financial Transactions and Accounts imported through those links.
- Budgeting and financial planning data you provide, such as budgets, goals, and other financial plans.
Information Collected Indirectly from You
Through your usage of the App, we collect various data in an effort to find and correct issues in the App, as well as metrics to inform us when developing and tweaking new and updated features within the app. This data includes:- App error reports
- Server log data generated while handling requests your App usage generates
- App performance data
- Masked and anonymized public IP addresses
- Anonymized usage data for features in the App
- Other anonymized data used for troubleshooting, performance, and app-wide usage tracking
Cookies and Tracking Technologies
The App uses the following categories of cookies and similar technologies:- Strictly Necessary Cookies. These are required for the App to function, such as authentication tokens and session identifiers. These cannot be disabled.
- Performance and Analytics. We use analytics tools to collect anonymized usage and performance data. This data is used solely to improve the App and is not shared with third parties for advertising purposes.
- Local Storage. The App may use browser local storage or similar device-level storage to maintain your preferences and improve App performance.
Information Collected from Third Parties about You
We collect information from third parties in order to provide the App to you as well as instrument the app for performance and usage data. In most if not all cases, these services are directly integrated within the app. The data we gather, such as updates to financial accounts, authentication provider records, and error/performance data, is then combined with information you directly provide us to better provide the App to you.How We Use De-Identified and Aggregated Data
What De-Identified and Aggregated Data Means
“De-Identified Data” is data that has been processed so that it cannot reasonably be used to identify, relate to, describe, or be linked to any individual user. “Aggregated Data” is data that has been combined across multiple users and summarized so that no individual user’s information is distinguishable. We maintain the following safeguards when creating and using De-Identified and Aggregated Data:- Technical Safeguards. We use industry-standard de-identification techniques and apply minimum aggregation thresholds to ensure that insights cannot be used to identify individuals. We do not produce or publish aggregated insights derived from cohorts of fewer than 50 users.
- Administrative Safeguards. We maintain internal policies and processes designed to prevent the re-identification of De-Identified Data.
- No Re-Identification. We do not attempt to, and we contractually prohibit any recipients of De-Identified Data from attempting to, re-identify individuals from De-Identified or Aggregated Data.
How We Use This Data
We may create and use De-Identified and Aggregated Data derived from information collected through the App for the following purposes:- Product Improvement. Analyzing usage patterns and trends to improve existing features and develop new ones.
- Research and Publications. Publishing blog posts, reports, white papers, and other content that includes aggregated statistics, trends, and insights about personal finance behavior and patterns (for example, “Commander users who set monthly budgets saved an average of 12% more than those who did not”).
- Marketing. Using aggregated statistics and insights in Commander’s own marketing materials to describe the value and impact of the App.
- Industry Benchmarking. Creating anonymized benchmarks and financial trend data for informational purposes.
What We Do Not Do
De-Identified and Aggregated Data is not Personal Information as defined by this Policy or by applicable law. However, we want to be clear about the boundaries of how we use this data:- We do not sell De-Identified or Aggregated Data to third parties.
- We do not use De-Identified or Aggregated Data to advertise third-party products or services to you.
- We do not provide De-Identified or Aggregated Data to third parties for the purpose of targeting, profiling, or making decisions about individual consumers.
- We do not share De-Identified or Aggregated Data with third parties except as described in the “Who We Share Personal Information With” section of this Policy.
Email Communications
We may send you emails for the following purposes:- Administrative messages about your account
- Updates about the App and new features
- Surveys and feedback requests to improve our services
- Legal notices and policy updates
Managing Your Email Preferences
You may opt out of non-essential communications (surveys, feature updates) while still receiving important administrative and legal notices. Contact [email protected] to manage your email preferences.Third-Party Advertising
We do not sell, share, or otherwise make available your Personal Information to third parties for advertising purposes. We do not use user data to advertise to you or to prospective customers. Advertisements are not shown on the App or on any Commander site.Who We Share Personal Information With
In order to operate the App, we share access to your data in the following ways:- With current and future members of our family of companies for the purposes described in this Policy
- With service providers who provide services to us (as outlined in our List of Subprocessors)
- To legal, governmental, or judicial authorities as instructed or required by those authorities and applicable laws, or in relation to a legal activity, such as in response to a subpoena or investigation of suspected illicit or illegal activities, or where we believe in good faith that users may be engaged in illegal activities, or where we are bound by contract or law to enable a customer or business partner to comply with applicable laws
- We have not received any requests for data to date.
- In connection with, or during negotiations for, an acquisition, merger, asset sale, or other similar business transfer that involves all or substantially all of our assets or functions where Personal Data is transferred or shared as part of the business assets (provided that such party agrees to use or disclose such Personal Data in a manner consistent with this Policy or gains your consent for other uses or disclosures)
- With your consent or at your direction, such as when you choose to share information or publicly post content and reviews (for example, social media posts)
- With persons of your choosing and at your discretion, should the product you are subscribed to allow that functionality
- With business partners, third parties, or the general public we may also share De-Identified and Aggregated Data (as defined in the “How We Use De-Identified and Aggregated Data” section above) that does not and cannot identify you, subject to the limitations described in that section
Sale and Sharing of Personal Information
We do not sell your Personal Information to any third party, as “sell” is defined under applicable state privacy laws including the California Consumer Privacy Act (CCPA). We do not share your Personal Information for cross-context behavioral advertising purposes.Choices You Can Make Regarding Your Data
In accordance with applicable law, you may have the right to:- Request confirmation of whether we are processing your data
- Obtain access to or a copy of your Personal Data
- Receive a portable copy of your Personal Data, or ask us to send that information to another organization (the “right of data portability”)
- Seek correction or amendment of inaccurate, untrue, incomplete, or improperly processed Personal Data
- Restrict our processing of your Personal Data
- Object to our processing of your Personal Data
- Request erasure of Personal Data held about you by us, subject to certain exceptions prescribed by law
- Opt out of the sale or sharing of your Personal Data (though we do not sell or share Personal Data as defined by applicable law)
- Opt out of certain non-essential communications from us while continuing to receive administrative and legal notices
- Not be discriminated against for exercising any of these rights
Your State Privacy Rights
California Residents (CCPA/CPRA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). The following disclosures supplement the information above. Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of Personal Information, as defined by the CCPA:| Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email address, account name, IP address | Yes |
| Financial Information | Bank account details, transaction history, budget data | Yes |
| Commercial Information | Subscription and purchase history | Yes |
| Internet or Network Activity | App usage data, server logs, performance data | Yes |
| Geolocation Data | Masked and anonymized IP-based location | Yes |
| Inferences | Spending categories and trends derived from your financial data | Yes |
Other State Privacy Rights
Residents of Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy legislation may have additional rights similar to those described above, including the right to access, correct, delete, and obtain a copy of their Personal Information, as well as the right to opt out of targeted advertising, profiling, and sale of Personal Information. To exercise these rights, contact us at [email protected]. We will process requests in accordance with the applicable state law. If your request is denied, you may appeal the decision by contacting us at [email protected] with the subject line “Privacy Rights Appeal.”Children’s Privacy
The App is not intended for use by children. As described in our Terms of Service, no one under 13 years of age may create an account or use the App. Users between 13 and 18 years of age may only use the App with verified parental or guardian consent. We do not knowingly collect Personal Information from children under 13. If we become aware that we have collected Personal Information from a child under 13, we will take steps to delete such information as quickly as possible in compliance with the Children’s Online Privacy Protection Act (COPPA) and other applicable laws. If you are a parent or guardian and believe your child under 18 has provided us with Personal Information without your consent, please contact us immediately at [email protected].Our Retention Policies
We retain your Personal Data for the following periods:- Account and Financial Data. For as long as you maintain an active account, and for 90 days following account deletion or termination, after which it is permanently deleted or de-identified. During this 90-day period, you may request reactivation of your account and restoration of your data.
- Payment and Billing Records. For the duration of your subscription plus 3 years following termination, as required for tax, accounting, and legal compliance purposes.
- Server Logs and Error Reports. For up to 12 months from the date of collection, after which they are permanently deleted.
- Anonymized, De-Identified, and Aggregated Data. This data, because it cannot identify you, may be retained indefinitely for product improvement, research, marketing, and other purposes described in the “How We Use De-Identified and Aggregated Data” section of this Policy.
- Communications Records. Records of communications between you and Commander (such as support requests) are retained for 3 years following your last interaction.
- Legal Hold. Notwithstanding the above, we may retain data for longer periods where required by law, regulation, or legal proceedings, or where retention is necessary in connection with lawful purposes such as active legal claims.
Data Protection Officer
Our designated privacy contact for all matters related to this Policy and your Personal Data is:Privacy Officer Commander Finance, LLC 1606 Headway Circle, Suite 9239 Austin, TX 78754 [email protected]