Privacy Policy

1. Scope and responsibility

This Privacy Policy explains how PerqXium ("PerqXium," "we," "us," or "our") handles personal information in connection with perqxium.com, our customer and merchant portals, and related application features that link to this policy (collectively, the "Services"). Personal information means information that identifies, relates to, or can reasonably be linked to an individual or household.

PerqXium is responsible for the information it collects and uses for its own Services. When we process information on a merchant’s behalf, that merchant’s instructions, agreements, and privacy notice may also apply. This policy does not replace the privacy policies of Plaid, your financial institution, an identity provider, a payment processor, or websites you choose to visit.

The information involved depends on which features you use and which connections you authorize. Describing a feature here does not mean it is available to every user or that every category is collected from every visitor.

2. Information we collect

Information you provide

• Account and profile details: name, email address, login and authentication information, preferences, and profile updates. If you use a third-party sign-in service, we receive the identity and profile information that service shares with your authorization.
• Cards, subscriptions, and financial entries: card nicknames, issuer and product selections, masked card details, subscription names, amounts, renewal dates, categories, transaction imports, budgets, alerts, and actions you record.
• Merchant and business information: business name, authorized users, website and integration settings, billing and subscription records, payment references, and dashboard activity.
• Communications: messages, feedback, support requests, and information needed to verify and respond to privacy requests. Please do not send passwords, full payment-card numbers, security codes, or bank credentials by email.

Information from connected accounts and other sources

With your authorization, Plaid and your financial institution provide account information as explained in Section 3. Payment, authentication, and infrastructure providers may supply service status, identifiers, and security information. Merchants may provide integration events and transaction-related records. Public issuer information helps us identify card products and their published benefits.

Information collected automatically

Our Services and infrastructure may record IP addresses, browser and device characteristics, request timestamps, pages or features accessed, referring URLs, session and account identifiers, error reports, authentication events, and interactions with recommendations or widgets. These records support operation, security, troubleshooting, and analytics. An identifier or masked record can still be personal information when it is linked to you.

We also generate information from your activity, such as recurring-charge detections, reward estimates, card matches, renewal reminders, and summaries of recorded outcomes. These are estimates or inferences and may require your review.

3. Connecting accounts with Plaid

PerqXium uses Plaid Inc. ("Plaid") to enable you to connect supported financial accounts through Plaid Link. Choosing to connect allows Plaid to obtain information from your selected financial institution and share information with PerqXium for the features you authorize. Review the permissions presented in Link and by your institution before completing the connection.

Plaid’s collection and use of your information are governed by the Plaid End User Privacy Policy. Your institution may present its own authorization terms. Plaid’s policy describes its own practices; this policy describes PerqXium’s practices.

What the connection can provide

The current PerqXium Link configuration requests the Transactions product for supported U.S. credit-card accounts. We receive account and institution identifiers, institution names, account names and types, and masked account-number details for connected accounts. Depending on the permissions, institution, and enabled feature, the authorized data can also include transaction records, such as merchant or transaction descriptions, dates, amounts, categories, and status, and account information available with that product.

Our account-linking flow currently uses account metadata to identify and display credit cards. Authorizing Transactions access does not mean continuous transaction synchronization is active in every environment; some transaction features use records you import. The app’s feature status determines which connected data is actually retrieved and displayed.

Credentials and connection tokens

You authenticate within Plaid Link or your institution’s authorization flow. PerqXium does not receive or store your financial institution username or password through this integration. PerqXium exchanges a temporary Link token result on its server and stores an encrypted access token to maintain the authorized connection. Tokens and account identifiers are treated as sensitive service information.

A Link connection is not, by itself, authorization for PerqXium to initiate a payment, transfer funds, or open a credit account. Manual card entry and other available unconnected features can be used without completing Link.

Ending access

You can review and manage supported connections through Plaid Portal or your institution’s connected-app settings, where available. Contact us if you need help ending PerqXium’s access. Removing a displayed card, disconnecting access, and deleting previously collected data are separate actions. Removing a card from the wallet should not be treated as confirmation that the Plaid connection has been revoked.

Revoking access may stop future retrieval and limit connected features, but does not automatically erase records already held by PerqXium, Plaid, or your institution. To request deletion of PerqXium’s records, use Section 10 or contact us. Requests concerning Plaid’s own records must be directed to Plaid.

4. How we use information

• Create accounts, authenticate users, and maintain preferences and sessions.
• Connect authorized accounts, identify card products, display your wallet, and provide the financial organization features you request.
• Process imported or available connected transactions, identify recurring charges, and support subscription tracking and renewal alerts.
• Estimate benefits and rewards, compare card options, and record decisions and outcomes.
• Operate merchant integrations, measure recommendation interactions, provide dashboard analytics, and administer billing.
• Respond to support and privacy requests and communicate about account security or service changes.
• Detect misuse, investigate errors, secure the Services, and improve reliability and functionality.
• Meet applicable legal obligations, resolve disputes, and enforce our agreements.

We use connected financial information to support the authorized Services. If a new use requires a new notice or consent under applicable law, we will provide that notice or obtain that consent before proceeding.

5. When we disclose information

We disclose information as needed in the following circumstances:

• Service providers: providers of hosting, databases, authentication, payments, communications, diagnostics, and other operational services receive information needed for their functions. These may include Vercel, Supabase, Stripe, and Google, depending on the enabled feature.
• Financial connections: Plaid and financial institutions receive the information necessary to establish, maintain, or troubleshoot a connection you authorize.
• Merchant services: merchants receive activity, conversion, and transaction-related reports for their own integrations. Connecting your personal wallet does not itself authorize disclosure of your full connected-account history to every merchant.
• Your directions: we disclose information when you request an export, use an integration, or otherwise direct us to share it.
• Legal and security needs: we may disclose information to comply with applicable law or valid legal process, investigate fraud or misuse, protect rights and safety, or resolve disputes.
• Business changes: information may be disclosed in connection with a merger, financing, acquisition, reorganization, or transfer of business assets, subject to appropriate safeguards and applicable notice requirements.

We may use and disclose aggregate or deidentified statistics that do not reasonably identify you. We do not treat merely masked account information as anonymous. Third-party sites, card issuers, and referral destinations you visit may collect information directly under their own policies.

6. Recommendations and AI features

PerqXium uses calculations and automated analysis to suggest card matches, estimate rewards, detect recurring subscriptions, and prioritize alerts. Where AI-assisted features are enabled, information submitted for those features may be sent to Google’s Gemini service. The current AI workflows use subscription type and monthly spending amounts for card guidance, or merchant names and widget statistics for business insights.

Do not include unnecessary sensitive information in feature inputs or support messages. The Plaid account-linking flow does not send your institution password or Plaid access token to these AI workflows. Recommendations can be incomplete or inaccurate; review the relevant records and issuer terms before acting. These features provide guidance and do not themselves make a lender’s credit approval decision.

7. Cookies and browser storage

We use cookies, local storage, and similar technologies to maintain authentication, protect sessions, remember preferences, and support application functionality. Our infrastructure and third-party components may also process technical data to detect abuse and troubleshoot service problems.

You can manage cookies and website storage through your browser. Blocking or clearing them may sign you out or prevent some features from working. Third-party sign-in and Plaid Link may require their own cookies or similar technologies, governed by their respective notices. Where consent is legally required for nonessential technologies, those technologies must be subject to the applicable consent choice.

Legacy browser Do Not Track signals do not have a uniform technical standard, and the Services do not currently implement a separate response to them. This is distinct from legally recognized opt-out preference signals, including Global Privacy Control, which apply where required by law.

8. How long we retain information

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including providing an active account, maintaining records you choose to track, security, resolving disputes, and applicable legal or accounting requirements. Retention depends on the record’s purpose and sensitivity, account and connection status, and whether a deletion request or legal preservation obligation applies.

• Account, wallet, subscription, and transaction records: generally maintained while needed for your account and requested features, subject to deletion controls and applicable exceptions.
• Connection credentials: encrypted tokens are retained to support the authorized connection while needed. Revocation and account deletion may affect these records differently; contact us to request both when appropriate.
• Security, support, billing, and audit records: may need to remain after account closure for fraud prevention, request handling, accounting, legal obligations, or disputes.
• Backups: deletion from active systems may precede removal from backup copies. Residual copies remain subject to protection and applicable retention requirements.
• Aggregate or deidentified data: may be retained where it no longer reasonably identifies you.

We do not promise that every category is erased instantly when an account or card is removed. You may ask us for information about retention applicable to your records.

9. Security

We use technical and organizational measures designed to protect information, including authenticated access, access restrictions, encrypted web connections, and server-side encryption of stored Plaid access tokens. Our Plaid integration is designed to keep institution login credentials outside PerqXium and to avoid exposing access tokens to the browser.

No system or transmission method can be guaranteed secure. Keep your login credentials private, secure the email account you use for sign-in, and promptly report suspected unauthorized access to info@perqxium.com. Where required, we will provide notices concerning a security incident in accordance with applicable law.

10. Your choices and account controls

• Choose what to provide: you may decline an optional connection or omit optional information, although related features may be unavailable.
• Update records: use available profile, wallet, subscription, and notification settings to review and correct your information.
• Export customer data: open the customer portal’s privacy controls and select "Export account data" for the available machine-readable export.
• Delete your customer account: select "Delete account" in the privacy controls and complete the confirmation. Deletion affects customer-owned records in the Services, subject to the retention exceptions described above.
• Revoke a connection: use Plaid Portal or your institution’s settings where supported, and contact us if assistance is needed. Account deletion in PerqXium is not a request to delete Plaid’s independent records.
• Communications: manage available notification preferences and use any unsubscribe option provided for promotional messages. Necessary account, security, and transaction-related communications may still be sent.

If you cannot access the portal, need a correction unavailable in the app, or have a merchant-account request, email info@perqxium.com. We may need to verify your identity before releasing or deleting information.

11. Privacy rights and requests

Depending on your location and the law applicable to PerqXium and your information, you may have rights to access information, receive a portable copy, correct inaccuracies, request deletion, withdraw consent, object to or restrict certain processing, or opt out of specified uses. These rights can be subject to exceptions and identity verification.

Send requests to info@perqxium.com with the subject "PerqXium privacy request." Describe the request, identify the email associated with your account, and provide your state or country so we can assess applicable rights. Do not send bank passwords, full card numbers, or identity documents unless we arrange an appropriate verification method.

We will respond within the period required by applicable law and explain any permitted extension or reason a request cannot be fully fulfilled. If an authorized agent submits a request, we may ask for proof of authorization and verify the account holder. Where an appeal right applies, reply with "Privacy appeal" and the original request details; we will review the decision and explain any further complaint options. You may also contact the relevant privacy regulator or state attorney general. We will not unlawfully discriminate against you for exercising privacy rights.

12. California and other U.S. states

Where applicable state privacy laws cover our processing, residents may have rights to know, access, correct, delete, and obtain copies of information, and to opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling. California residents may also have a right to limit certain uses of sensitive personal information. Applicability depends on the law, the business, and the data involved.

The categories described in Section 2 include identifiers, account and customer records, commercial and financial information, internet activity, and inferences. Financial account and authentication information may be sensitive personal information. Sections 2–5 describe sources, purposes, and recipient categories; Section 8 explains retention criteria.

The Services described in this policy do not provide a feature that sells connected financial-account data or supplies it for cross-context behavioral advertising. Sensitive connection information is used for the requested account features and their security. Any legally applicable opt-out request, including a recognized preference signal, will be handled as required. Contact us using Section 11 to exercise rights or ask about a particular disclosure.

13. International users

The current Plaid connection feature is configured for supported U.S. accounts. Our Services and providers may process information in the United States and other countries where they operate. Privacy laws in those countries may differ from those in your location.

Where European, UK, or other applicable data protection law governs processing, we rely on an appropriate legal basis, such as performing the service you request, consent where required, legal obligations, or legitimate interests in operating and securing the Services balanced against your rights. Where required, international transfers must use legally recognized safeguards. Contact us to ask about the basis or safeguards applicable to your information, withdraw consent, or exercise applicable rights. You may lodge a complaint with your competent supervisory authority.

14. Children’s privacy

The Services are intended for adults and are not directed to children under 18. Do not create an account or connect financial information if you are under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.

15. Changes to this policy

We may update this policy as our Services or legal requirements change. We will publish the revised policy here and update the date above. For material changes, we will provide additional notice or request consent where required by law. A policy update does not by itself expand the financial-account permissions you granted in Link.