Last reviewed September 2026. This policy has not yet been reviewed by counsel.
The short version
We collect what we need to run the service and nothing we do not. We do not sell your data. You can ask for a copy of it or ask us to delete it.
What we collect
About you: your name, email address, phone number if you give one, and what you do inside the product.
About your business: legal name, trading name, entity type, formation state and date, address, phone, website, industry, employee count, revenue band, and the last four digits of your EIN. We store four digits rather than the whole number deliberately — it is enough to match a file and not enough to be worth stealing.
Your credit files: what commercial credit sources report about your business, either from documents you upload or retrieved with your authorisation.
Your banking activity, if you connect an account: balances, and transaction descriptions, amounts and dates. Read-only, for the accounts you chose.
Technical: IP address, browser, and a record of significant actions on your account, kept so we can answer "who changed this" and investigate abuse.
What we do not collect
We never receive your bank login. That is entered inside Plaid's interface and is never sent to us.
We do not collect your full EIN, and we do not collect your Social Security Number. BoostFi is a business credit product and does not pull personal credit.
We do not store card numbers. Payments go to Stripe, which holds them.
Why we hold it
To run the service you asked for; to show you your own files and what we read from them; to bill you if you are on a paid plan; to keep the platform secure and to investigate abuse; and to meet obligations we have in law.
Where you have given consent — connecting a bank, authorising a retrieval — that consent is the basis, and you can withdraw it.
Who else sees it
Service providers who process it for us, and only for that purpose:
- Plaid — bank connections
- Stripe — payments and subscriptions
- Supabase — database and file storage
- Amazon Web Services — hosting
- Email delivery, and AI providers where you use an assistant feature
Credit sources, where you ask us to retrieve a file.
Your workspace administrators, where your account belongs to a workspace run by somebody else — a mentorship programme, for example. They see your account and your progress in it.
We do not sell your data, and we do not share it for anybody else's advertising.
AI features
Where you use an assistant feature, the question and the relevant part of your file are sent to an AI provider to produce an answer. We do not permit those providers to train models on your data.
An assistant answer is a reading, not advice, and not a decision anybody has made about your business.
How long we keep it
While your account is open, and afterwards where we have a reason: an unresolved dispute, a legal obligation, or a record of consent we may need to show.
Archived rather than destroyed is our default for account data, so a closed account can be reopened and a dispute can still be answered. Say if you want it gone rather than archived and we will do that.
Your rights
Ask us and we will: give you a copy of what we hold; correct anything wrong; delete what we are not obliged to keep; stop a processing you consented to; or export your data.
Depending on where you live you may have further rights, including the right to complain to a regulator.
To ask, use the support page inside your account.
Security
Credentials and access tokens are encrypted before they are stored. Access to your workspace's data is enforced in the database itself rather than only in the application, so a mistake in one screen cannot expose another workspace's records.
No system is perfectly secure. If something happens that affects you, we will tell you.
Children
BoostFi is for businesses. It is not for anybody under 18 and we do not knowingly collect their data.
Changes
We will publish a new version here with the date it takes effect, and tell you where a change is significant.