Privacy Policy

1. Who we are

SoloSteady is a product of Culmination Digital LLC, an Arizona limited liability company. Our registered business address is 8390 E Via De Ventura, Scottsdale, AZ 85258, USA. You can contact us at support@solosteady.com.

2. What this policy covers

This policy explains how we collect, use, retain, share, and protect information when you use https://solosteady.com or any related SoloSteady services. It applies to everyone who visits our website, joins our waitlist, or uses our income summary product.

3. Information we collect

We collect only what we need to operate the service:

• Waitlist email addresses. If you join our pre-launch waitlist, or ask to be told when bank connection is available because it could not start when you tried, we collect your email address and nothing else, to send you that one notice.
• No accounts. SoloSteady has no sign-up and no password. Your purchase is tied to a random session id stored in a cookie in your browser, plus the email address you give us so we can send you the summary.
• Bank transaction data. When you use our income documentation product, we ask Plaid to prepare a report of the transaction history of the checking or savings account you connect (Plaid’s Assets product), and we process the transaction data in it. This includes deposits, withdrawals, transaction descriptions, dates, amounts, and the category Plaid assigns to each transaction. The report also contains account balances, which we do not use or store. Because Plaid prepares the report for your whole login at that bank, it may also include other accounts you hold there; SoloSteady uses only the accounts you chose to connect and does not store anything from the others. We do not accept uploaded bank statement files.
• Account holder name(s). We retrieve the account holder name(s) from Plaid’s Identity product. If the account is jointly held, we retrieve every listed holder’s name. These names are compared token-by-token to the verified legal name returned by Stripe Identity so a connected account can be tied to the ID you verified with, so we can check that a connected account belongs to the person who verified the ID. Plaid’s responses to us also contain the phone numbers, email addresses, and physical addresses your bank lists for the account. We do not use them and we do not store them.
• Payment information. When you purchase an income summary or the do-it-yourself kit, Stripe processes your payment on our behalf. We do not store your full card number or payment credentials.
• Messages you send us. If you use the contact form, we collect your name, email address, message and any reference number you include, and email them to our support inbox through Resend. We do not store them in our database.
• Survey answers. Seven days after a purchase we email one question about whether the summary did what you needed. If you answer, we keep your answers, including anything you type, with your purchase record.
• Feedback. When you answer a feedback question (on the results page, the review page, or from a follow-up email link), we store your answer, any note you typed, which page you were on, and when you submitted it. We keep this for 13 months after you submitted it, then delete it. If you tick the box asking us to follow up, we also store the email address you give us (or the one on your purchase if available) alongside the date you consented. We use it to send one email when the specific issue you reported is fixed. After we send that email, or after 90 days if we have not sent one, we delete the email address. We never use it for marketing.
• Usage data. We use PostHog and Google Analytics to understand how visitors use our site. This includes pages viewed, approximate location, device and browser information, and referring URLs.
• Cookies and local storage. We use one essential cookie to keep your session active for 24 hours; a second essential cookie (ss_kit) only if you buy the do-it-yourself kit, so you can download it again for 30 days; and one measurement cookie (ss_attr) that records how you first arrived — the campaign name on the link you clicked, the website that linked to you, the page you landed on, your language, and whether you are on a phone or a computer. It does not record your IP address, your email address, the full address of the page that linked to you, or the identifier an ad platform attaches to a click. It is set once, on your first visit, and expires after 90 days. We also load PostHog and Google Analytics on every page, which set their own cookies and local storage to measure usage. We do not currently show a consent banner, so if you do not want analytics, block them with your browser settings or an extension. Some of our forms also run Vercel BotID, a check in your browser that tells automated traffic apart from people.

4. How we use your information

• To provide the service. We use the transaction data from your bank connection to analyze your deposits, calculate your monthly averages, and generate your documents.
• To deliver your document. We use your email address to send you your income summary and any associated notices. We send it to you and to no one else.
• To process payments. We share transaction details with Stripe to process your purchase.
• To improve the service. We use aggregated, pseudonymous usage data (tied to a random session identifier, not to your name) to improve our product.
• To communicate. We use your email address to notify you of product launches, important account notices, and (if you join our waitlist or ask to be told when bank connection is available) that one notice. If you confirm your email address and then leave without completing your purchase, we may send one reminder about the unfinished purchase, with an unsubscribe link in it. Seven days after a purchase we send one email asking whether the summary did what you needed, with a one-click opt-out. We also email one-time codes when you confirm your address and when you re-open your results in another browser. You can unsubscribe from marketing messages at any time.

5. How we share your information

We do not sell your personal information. We share it only with service providers who help us operate the product, and only to the minimum extent necessary:

• Plaid Inc. — for connecting your bank account and retrieving transaction data. This is the only way income data enters SoloSteady.
• Anthropic PBC (Claude AI) — for writing the plain-language summary that accompanies your figures. Your income is calculated and your deposits are categorized by fixed rules on our own servers, not by AI. What we send to Anthropic is limited to the derived totals (your monthly average, month-by-month totals, deposit counts, date range) and the income-source labels those deposits were grouped under, each truncated to 128 characters, and, for each flagged deposit (up to twelve), its date, its amount and how many times your monthly average it is. We do not send the payer name of a flagged deposit, your account numbers, routing numbers, balances, withdrawals, or any other individual transaction. Anthropic has a SOC 2 Type II audit report and does not use API data for model training. On the standard API tier that we use, Anthropic retains API request data for up to 30 days for abuse monitoring; zero-retention mode requires a separate agreement with Anthropic, which we have not signed.
• Supabase Inc. — for database and file storage.
• Stripe, Inc. — for payment processing and for identity verification via Stripe Identity. Stripe Identity captures a government-issued ID and a selfie, performs liveness and match checks, and returns a verified legal name. SoloSteady stores the returned legal name (for comparison with the account holder your bank reports) and the verification date. When that comparison matches, the name is printed on your income summary as the account holder it was prepared for; when it does not match, the summary names the account holder generically instead. We do not store the ID image or selfie — those are held by Stripe per their retention policy. Verified results are cached for 12 months so returning users can skip re-verification.
• Resend — for delivering email, including the messages you send through our contact form, which it delivers to our support inbox. Resend keeps a copy of each email it sends, including any attachment, for 30 days and then deletes it.
• Cloudflare, Inc. — routes email sent to our support address to the mailbox we read.
• Vercel Inc. — for hosting our website, and for Vercel BotID, which checks in your browser that a form is being submitted by a person.
• PostHog and Google Analytics — for usage analytics.
• Sentry — for error monitoring. Error reports may include technical details about a failed request.
• Upstash — for rate limiting. Stores a key derived from your IP address to limit request volume.

We may also share information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets.

6. How long we keep your information

We hold your data only as long as we need it. We draw a clear line between source data (things we need briefly to do the analysis) and your deliverable (the income summary you paid for and may want to revisit):

• Plaid access tokens and raw transaction line items: Plaid access is revoked and the raw line items are deleted about 24 hours after you connect, by a job that runs every hour. Apart from the counted deposits described below, we do not retain individual transaction descriptions, amounts, or dates after analysis is complete. We keep no record of any individual withdrawal — see “Money out, by category” below for the only thing we do keep about money leaving your account. The transaction history report Plaid prepares for us is deleted at Plaid on the same schedule: we instruct Plaid to remove it within 24 hours, and promptly when you disconnect the account or ask us to delete your data.
• Aggregated income analysis results: kept for 13 months after purchase, then deleted automatically. These are calculated totals, average monthly income, number of deposits, date range analyzed, income source categories, and the account type your bank reported (business or personal), when it reported one. 13 months covers the card-network dispute window and a mortgage process that asks for an updated summary inside a year.
• Counted deposits: your document package includes a deposit history that lists each deposit counted toward your income, so you can check it against your own statements. For each one we keep the date, the amount, and a short label taken from the deposit’s own description, for the same 13 months as the analysis. Nothing else from the transaction is kept: no account number, no balance, no category, and no individual withdrawal. For the same 13 months we also keep how many counted deposits have a payroll word (such as PAYROLL) in their description, their total, and the months they fall in, but not the descriptions themselves. None of it is sent to Anthropic, except the date and amount of each flagged deposit (section 5), and SoloSteady does not send the deposit history to anyone — you download it, exactly as you do the summary.
• Money out, by category: your document package includes an income and expense summary, because a bank statement lender asks for one and it cannot be built from deposits alone. To produce it we keep one total per category per month — for example, the total of everything your bank categorised as rent and utilities in March — for the same 13 months as the analysis. We keep no record of any individual payment. No date, no amount, no merchant, no description, nothing that would let anyone tell that a particular payment happened. The categories are your bank’s own; SoloSteady does not assign or change them, and they are not a judgement about whether a payment was for business or personal purposes. For payments left out of that table (transfers between your own accounts, loan payments and credit card payments) we keep one count and one total each for the whole period, and your summary states the loan and credit card figures. None of it is sent to Anthropic.
• Flagged deposits: your summary names up to 12 individual deposits from a payer not seen in another month — the ones larger than half your average monthly deposits — and lists the months in which your bank records show an overdraft or insufficient-funds fee. For each named deposit we keep the date, the amount, and a short label taken from the deposit’s own description, and for each month the total of every flagged deposit in it (so a month with more than 12 still has all of them removed from the second average), for the same 13 months as the analysis. These are the exceptions, not a copy of your account history, and you see every one of them on your results page and in your summary. From a withdrawal we keep only the month: no fee amount, no fee count, no description. The date and amount of each named deposit, and how many times your monthly average it is, are sent to Anthropic so the plain-language summary can mention them; the label is not.
• Your documents: the income summary, deposit history, income and expense summary and document checklist we generate, each in English and Spanish (eight PDFs), are kept for 13 months after purchase, then deleted automatically. The copy emailed to you is yours and is not affected. That email, including the attached income summary and the monthly figure in its text, is sent through our email provider, Resend, which keeps a copy of every email it sends for 30 days and then deletes it. There are no accounts; the results page is reachable from the browser you bought in for 24 hours, and after that from any browser by entering a one-time code we email to the address you paid with, until your documents are deleted at 13 months. For that we keep a one-way hash of that address and of the latest code with the purchase, for the same 13 months.
• An analysis you did not pay for: deleted 24 hours after you connected your bank or, if you opened checkout, once our payment provider confirms the payment did not complete (usually within about 8 days). There are exceptions, and they have no automatic deletion date: if the payment provider recorded a payment attempt, a refund or a dispute on it, or we could not confirm its payment status with the provider, the analysis is kept until you ask us to delete it, so a charge that did go through can still be matched to it.
• Survey answers: kept with your purchase record and deleted 13 months after purchase.
• Feedback. Your feedback answer, note, and submission metadata are kept for 13 months after submission, then deleted. If you gave us an email address and consented to follow-up, we delete that email address after we send the one notification, or after 90 days if we have not sent it.
• Identity check result: the legal name Stripe returned is deleted when the 12-month reuse window ends. The outcome, its date, the Stripe session id and a one-way hash of your email address are deleted 13 months after the check, or 13 months after the purchase that used it if that is later. A check that did not verify is deleted 13 months after it was made.
• Purchase record: the payment identifiers, the date paid and whether a payment was refunded or disputed are kept after the 13-month deletion, as our financial record.
• Waitlist email addresses: retained until you unsubscribe.
• Deleting it sooner: email support@solosteady.com with your reference number and we remove the summary, the figures, the identity check result and all associated data before the 13 months are up. SoloSteady then holds nothing about the purchase; Stripe, the payment processor, keeps its own record of the payment (date, amount) under its own policy, which is what a refund or a card dispute runs on.
• Backups: our database provider, Supabase, takes a daily backup of our database and keeps each one for 7 days. When we delete something from the live database, on the schedules above or at your request, it can remain in those backups until they expire, about 7 days later. Backups are encrypted and exist only to restore the service after a failure.

6a. Data retention and disposal schedule

The following table summarizes our specific retention periods and disposal methods for each category of data:

All stored data is encrypted at rest using AES-256. Every database table denies access by default, and our servers reach the database through a server-only key that is never exposed to your browser. This policy is reviewed annually or upon material changes to data handling practices. Last reviewed: October 6, 2026.

7. Your rights and choices

Depending on where you live, you may have the following rights:

• The right to access the personal information we hold about you
• The right to request correction of inaccurate information
• The right to request deletion of your personal information
• The right to opt out of marketing communications (every marketing email we send includes an unsubscribe link)
• The right to opt out of the “sale” or “sharing” of personal information (we do not sell your data)
• The right to non-discrimination for exercising any of these rights

To exercise any of these rights, email us at support@solosteady.com. We will respond within 45 days.

8. How we protect your information

We use industry-standard safeguards including TLS encryption in transit, encryption at rest, server-side-only access to sensitive credentials, and strict data retention limits. No system is perfectly secure, and we cannot guarantee absolute security.

9. Children’s privacy

SoloSteady is not intended for anyone under 18. We do not knowingly collect information from children.

10. California residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising. To exercise your rights, contact us at support@solosteady.com.

11. International users

SoloSteady is operated from the United States. If you access our service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. By using the service, you consent to this transfer.

12. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the “Last updated” date at the top of this page and note what changed on this page.

13. Contact us

Culmination Digital LLC
8390 E Via De Ventura, Scottsdale, AZ 85258, USA
Email: support@solosteady.com