We connect to your financial accounts to find money that already belongs to you. That takes data. This page sets out exactly what we take, why we take it, who else sees it, and how you get it back or delete it.
Privacy policies are not fun to read. Our goal at Amalgamic is to make managing money less complicated, and doing that means collecting certain information about you. We aim to collect only what we need in order to serve you.
We will never sell your financial data.
You will see the words “selling” and “sharing” below. Certain privacy laws define those terms very broadly, and we use them only as they relate to advertising cookies on our website. No money changes hands, and your financial data is never part of it.
By using or accessing our services in any way, you accept the practices described here and consent to us collecting, using and sharing your information as set out below. Terms used here without definition carry the meaning given in our Terms of Use.
If you have a disability and need this policy in an alternative format, email lizann@amalgamic.io.
This policy covers how we treat personal data gathered when you access or use our services. Personal data means any information that identifies or relates to a particular individual, including what data privacy laws call personally identifiable information or personal information.
It does not cover the practices of companies we do not own or control, or people we do not manage.
Every category of personal data we have collected in the past 12 months, what it is for, and which categories of third party receive it.
| Rec | Category | Purpose | Shared with |
|---|---|---|---|
| REC-01 | Profile and contact dataFirst and last name, email address, login information. | Provide serviceImprove serviceMarketingCorrespond | Service providersParties you authorize |
| REC-02 | Payment dataCard type, last 4 digits, expiration date, billing address, phone number, email. | Provide serviceImprove serviceCorrespond | PlaidSpinwheel |
| REC-03 | Commercial and debt-related dataFinancial transactions, account balances, credit reports, credit score, outstanding debt. | Provide serviceImprove serviceCorrespond | PlaidSpinwheelParties you authorize |
| REC-04 | Device and IP dataIP address, device ID, domain server, device, operating system, browser. | Provide serviceImprove serviceMarketingCorrespond | Service providersAdvertising partners |
| REC-05 | Web analyticsPage interactions, referring page or source, non-identifiable request IDs, browser interaction statistics. | Provide serviceImprove serviceMarketingCorrespond | Service providersAdvertising partners |
| REC-06 | Consumer demographic dataAge or date of birth, and ZIP code. | Provide serviceImprove serviceCorrespond | Service providersAdvertising partners |
| REC-07 | Sensory dataPhotos, videos or recordings — a profile photo or a recorded interview. Collected with your consent. | Provide serviceImprove serviceMarketing | Service providersParties you authorize |
| REC-08 | Data treated as sensitive under the CCPAHealth data to the extent it relates to an outstanding debt. Personal identification numbers including Social Security, driver’s licence, passport or state ID numbers. | Provide serviceImprove serviceCorrespond | Service providersParties you authorize |
| REC-09 | Inferences drawn from other dataInferences relating specifically to your use of our services. | Provide serviceImprove service | Service providersParties you authorize |
| REC-10 | Anything else you choose to send usEmails, letters, texts or other communications you send to us. | Provide serviceImprove serviceCorrespond | Service providersParties you authorize |
We do not collect data considered sensitive under the CCPA in order to infer characteristics about you. Our use of it is limited to the purposes set out in section 7027(m) of the CCPA regulations, listed in §13.
When you create an account, use our tools, fill in a free-text field, answer a survey, or email us.
Through cookies, and — if you use our app or a location-enabled browser — device and location information.
Transaction and balance data through Plaid and Spinwheel. We never receive your bank login credentials.
Analytics and support vendors, advertising partners, and any third-party account you choose to link.
When you log in to a financial account to connect it to Amalgamic, we receive transaction and balance information through Plaid and Spinwheel. At no point do we receive the login credentials for any of your financial accounts.
We may also collect how you use the site — pages visited, links clicked, non-sensitive text entered, mouse movement, referring URL, browser, operating system and IP address.
Any category above may also be used or disclosed to government, law enforcement or other parties to meet legal requirements: complying with law, regulation, court order or legal process; preventing, detecting and investigating security incidents and potentially illegal activity; protecting the rights, property or safety of you, Amalgamic or another party; enforcing our agreements with you; responding to claims that content violates third-party rights; and resolving disputes.
We will not collect additional categories of personal data, or use what we have collected for materially different or incompatible purposes, without telling you first.
These parties help us run the service or perform business functions for us: hosting, technology and communication providers; analytics providers that do not assist with interest-based advertising; security and fraud prevention consultants; and support and customer service vendors.
Plaid and Spinwheel connect your financial accounts to Amalgamic and pass us transaction and balance data. Their own privacy practices govern that connection, and you can revoke Amalgamic's access directly with them at any time.
Ad networks, marketing providers and analytics partners that assist with our interest-based advertising, plus companies that track how people found the service and how they use it.
If we go through a merger, acquisition, bankruptcy or other transaction where a third party assumes control of our business in whole or in part, your personal data may transfer with it. We will make reasonable efforts to notify you before your information becomes subject to different privacy practices.
We may create aggregated, de-identified or anonymised data from what we collect and share it with third parties for lawful business purposes, but never in a way that could identify you.
Parts of Amalgamic use artificial intelligence to read merchant cancellation flows, draft correspondence and interpret instructions you give in plain language.
We do not train AI on your data.
Your personal or financial data is never used to train artificial intelligence models, ours or anyone else's. AI is used to carry out the task you asked for, and for nothing beyond it.
AI output can be wrong. You should not treat AI-generated correspondence or summaries as verified fact, and you remain responsible for instructions you confirm.
We use cookies and similar technologies — pixel tags, web beacons, clear GIFs and JavaScript — so our servers recognise your browser and so we can see how and when you use the service. Because of how we use cookies, the service does not currently support browser Do Not Track requests.
Required for features you asked for — logging into secure areas, for example. Disabling these makes parts of the service unavailable.
Records your choices and settings, keeps your preferences over time, and recognises you when you come back.
Tells us how many people visit, which pages they view and how long they stay, and measures how our advertising performs.
Collects data about your online activity to advertise Amalgamic on third-party sites. We do not show you third-party ads on ours.
You control cookies through your browser settings, and you can delete cookies already on your device — though you may then need to reset preferences on every visit, and some features may stop working.
We may work with third-party ad networks, ad servers, agencies, ad technology vendors and research firms to serve advertisements aimed at people who fit general profile categories or show certain preferences and behaviours.
The information behind those ads may come from you, or be derived from usage patterns on our service and on third-party services, including activity tracked over time and across unaffiliated sites. To do this we or our providers may deliver cookies and web beacons through the service, which let ad networks report in aggregate and serve you targeted ads on other websites.
We protect your personal data from unauthorised access, use and disclosure using physical, technical, organisational and administrative measures appropriate to the type of data and how we process it. Help us by choosing a strong password, limiting access to your devices and browser, and signing out when you finish. No method of transmitting or storing data is completely secure.
We keep personal data for as long as we need it to provide the service or fulfil the business purpose we collected it for. In setting a retention period we consider who we collected the data from, why, our need for it, and how sensitive it is. We keep data longer where we must in order to comply with legal obligations, resolve disputes or collect fees owed. Your profile information and credentials are kept for as long as you have an account.
We do not knowingly collect or solicit personal data from anyone under 18. If you are under 18, please do not register for the service or send us personal data. If we learn we have collected data from someone under 18, we will delete it as quickly as possible. If you believe a child under 18 has given us personal data, contact lizann@amalgamic.io.
If you are a California resident you have the rights below. They are subject to conditions and exceptions under applicable law, which may permit or require us to deny a request. Where this section conflicts with anything else in this policy, the more protective provision wins.
Ask what we collected about you over the past 12 months — the categories, the sources, the purposes, who we shared it with, and the specific pieces. You can ask beyond 12 months, back to 1 January 2022.
Ask us to delete the personal data we hold. Some exceptions apply — we may need to keep data to deliver a service or complete a transaction you asked for.
Ask us to fix inaccurate personal data. We may decline if, considering everything we hold, we determine the data is already correct.
If we disclosed your personal data to third parties for a business purpose in the past 12 months, we will identify the categories shared with each category of recipient. Where we process personal data as a service provider on behalf of a customer, contact that customer first to exercise your rights over that data.
Consumers have a right to ask a business to limit the use and disclosure of sensitive personal information. Our use of it is already confined to the purposes listed in section 7027(m) of the CCPA regulations, so we do not offer a separate request route. Those purposes are:
We will not discriminate against you for exercising your rights under the CCPA. We will not deny you goods or services, charge you a different price, or give you a lower quality of service. We may offer different tiers of service at different prices as permitted by law, related to the value of the personal data we receive from you.
We run a referral program and may from time to time run contests or similar promotions. Signing up may ask for personal data such as your name and email, and for referrals the name and contact details of the person you refer.
Because these programs collect personal data and offer benefits, California law may treat them as financial incentive programs. The value of your personal data to us relates to the value of the rewards or benefits provided, less the expense of offering them. You can withdraw from any program at any time by emailing lizann@amalgamic.io.
Send us a request that gives us enough information to verify you are the person we collected data about, and describes what you want in enough detail for us to evaluate it. A request meeting both criteria is a valid request. We may not respond to requests that do not.
Delete your account yourself from account settings.
Email support@amalgamic.io with your request and the email address on your account.
Under California Civil Code sections 1798.83–1798.84, California residents may contact us to prevent disclosure of personal data to third parties for those third parties’ own direct marketing purposes. Email lizann@amalgamic.io.
Nevada residents may opt out of the sale of certain personal data to third parties who intend to license or sell it. Email lizann@amalgamic.io with the subject line Nevada Do Not Sell Request, your name, and the email address on your account.
We are constantly improving the service, so this policy may change. We will tell you about material changes by posting a notice on the Amalgamic website, emailing you, or by other means. If you opted out of legal notice emails, or never gave us an email address, those notices still govern your use of the service and you remain responsible for reading them.
Continuing to use the service after a change means you agree to it. Information we have already collected stays subject to the policy in effect when we collected it.
Questions about this policy, about how we collect and use your personal data, or about your rights over it — we would rather hear from you than not.
See also the contact page for where to send other requests.