Privacy Policy

Last updated: October 28, 2026

Lirandel reads where you spend and shows which credit card pays you the most, and it warns you before you lose money to fees and interest. To do that we handle sensitive financial information, so this policy explains plainly what we collect, why, who sees it and what control you have.

The short version

We don't sell your information, and we don't share it for advertising.
We never share your financial information with a partner unless you sign a separate permission.
Bank access is read-only. We can't move your money.
You can download or delete your data at any time from Settings.

What we collect

Account details: name, email address, state, and a scrambled (hashed) version of your password.
Statements you upload: when you upload a PDF or CSV statement, we read the file and throw it away; the file itself is never stored. We keep the transactions we found (date, description, amount) for up to one hour so you can check them. If you import them, they're saved under an account you name; if you don't, they're deleted.
Financial information from banks you connect: account names, last four digits, balances, interest rates and transactions, received through Plaid.
Information you type in: such as an account's interest rate, a mortgage's balance and renewal date, savings assumptions, and corrections to categories.
What you do in Lirandel: recommendations you approve or dismiss, the drafts our agents prepare for you, which offers you open from an Apply button (to match a partner's referral reports later), and whether you joined the Lirandel Plus waitlist. Opening an offer sends nothing about you to the provider.
Security records: sign-ins, devices, IP addresses and security changes, used to protect your account.
Consents: what you agreed to, which version, and when.

We don't collect your bank username or password. Plaid handles bank sign-in and gives us a revocable access token, which we store encrypted. Plaid's own handling of your information is described in Plaid's End User Privacy Policy.

How we use it

To analyze your transactions and suggest ways to save.
To prepare the steps, messages and comparisons you approve.
To keep your account secure and to meet legal obligations.

Who we share it with

Service providers that run Lirandel for us (for example Plaid for bank connections, and our hosting and email providers), under contracts that limit their use of your data.
Partners you choose, such as a card issuer checking whether you pre-qualify, only after you sign the separate permission in Settings → Privacy & data. You can withdraw it at any time.
When required by law, such as a valid court order.

How long we keep it

Transactions: up to 24 months, then deleted automatically.
If you don't sign in for 24 months, we delete your financial data (connected banks, transactions, suggestions and alerts) and end our access to your banks. We email you 30 days before. Your login stays, so you can come back.
Disconnecting a bank deletes that bank's accounts and transactions from Lirandel and revokes our access.
Deleting your account deletes everything, except records we must keep by law.

How we protect it

Encryption of bank access tokens, hashed passwords, optional two-step verification, automatic sign-out, a strict browser security policy and an activity log you can review. We maintain a written information security program and will notify you and regulators of a breach as the law requires.

Your choices

Download a copy of your data: Settings → Privacy & data.
Delete your financial data or your whole account: Settings → Privacy & data.
Disconnect a bank: Settings → General.
Withdraw partner-sharing permission: Settings → Privacy & data.
Leave the Lirandel Plus waitlist: the same button you joined with.

Notice for California residents

California law gives you extra rights. Under the California Financial Information Privacy Act, we won't share your nonpublic personal financial information with companies outside Lirandel without your signed, dated consent. Under the California Consumer Privacy Act (as amended by the CPRA), you can ask to know what personal information we collect, get a copy, correct it, delete it, and limit the use of sensitive personal information. We don't sell or share personal information for cross-context behavioral advertising. We won't treat you differently for using these rights.

Categories collected in the last 12 months: identifiers (name, email, IP address), financial information, commercial information (transactions), internet activity in Lirandel (security logs), and approximate location (state). Sources: you (including statements you upload), your banks through Plaid, and your device. Use these rights from Settings or by emailing us.

Contact

Questions or requests: privacy@[company domain] (to be set before launch).