Privacy Policy

Last updated: July 19, 2026

This Privacy Policy explains what information Cipili collects, how we use it, and the choices you have. Cipili provides financial education and comparisons, not personalized investment, tax, or legal advice. Please also read our Terms of Use, which govern your use of the service.

Who we are & scope

Cipili is a United States only service intended for people who are 18 or older. We do not knowingly offer the service to anyone under 18 or to users outside the United States. This policy applies to the Cipili website, web app, and related email communications.

Information we collect

We practice data minimization: we ask for and keep only what a feature actually needs. We collect the following:

• Account information, such as your email address and password. Passwords are hashed and are never stored in plaintext.
• Profile inputs you provide for educational purposes, such as your age, income, and goals. Where practical these are collected as ranges rather than exact account numbers.
• Connected financial account data, only if you choose to link an account through Plaid (see Bank connections below).
• Usage and analytics data about how you interact with the service, used to operate, secure, and improve it.
• Support communications, such as messages you send us for help.

How we use information

• To provide and operate the service, including your account and saved inputs.
• To generate educational comparisons and modeled estimates. All dollar figures are estimates based on stated assumptions, not guarantees of any outcome.
• To send transactional email, such as password resets and security notices.
• To secure the service, prevent abuse, and troubleshoot problems.
• To comply with legal obligations.

Bank connections & Plaid

If you choose to connect a financial account, we use Plaid to establish that connection. Linking is consent first and revocable at any time. Cipili stores only tokenized references to your connection; access tokens are held server side and protected by row-level security. We never store your raw banking credentials. You can revoke Plaid consent and disconnect linked accounts at any time from your account settings.

AI processing

Cipili’s educational recommendations are generated using Google’s Gemini API. We send only the minimum necessary, de-identified or tokenized data required to produce a result. The AI vendor is contractually configured not to use Cipili data to train its models, and the design prevents cross-user data leakage. Recommendations are educational comparisons and modeled estimates, not personalized financial advice.

How we share information

We do not sell your personal data. We share data only with the service providers that help us run Cipili, and only as needed for them to perform their function:

• Plaid, to connect financial accounts you choose to link.
• Supabase, our database and storage provider.
• Google (Gemini API), to generate educational recommendations from de-identified or tokenized data.
• Resend, to send transactional email such as password resets.
• A third-party payment processor, if you subscribe to a paid plan (see Data security below).

We may also disclose information where required by law, or to protect the rights, safety, and security of Cipili and its users.

Cookies

Cipili uses essential session cookies for authentication and security, for example to keep you signed in and to protect your account. We do not use advertising or cross-site tracking cookies.

Data security

Your data is stored with Supabase (PostgreSQL) and is encrypted in transit (TLS/HTTPS) and at rest. Access is protected by row-level security, so you can access only your own data. Passwords are hashed. If you subscribe to a paid plan, payment is handled by a third-party payment processor and Cipili does not store your full card number. No method of storage or transmission is perfectly secure, but we work to protect your information using industry standard safeguards.

Data retention & deletion

We keep your information for as long as your account is active or as needed to provide the service, and we apply a configurable retention policy. You can request deletion of your data at any time, and we delete your data on account closure. To request deletion, use your account settings or contact us at support@cipili.com. Some information may be retained where required to meet legal obligations.

Your rights & choices

Depending on where you live, you may have rights to access, correct, or delete your personal data, and to revoke consent. In particular:

• You can access and correct your profile information in your account settings.
• You can request deletion of your data, or delete your account.
• You can revoke Plaid consent and disconnect any linked financial accounts at any time.
• Residents of certain states (for example, California and other states with comprehensive privacy laws) may have additional rights, such as the right to know what personal information we hold and the right to request its deletion. Because we do not sell personal data, there is no sale to opt out of.

To exercise any of these rights, contact us at support@cipili.com.

Children

Cipili is intended only for users who are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page, and where appropriate we will provide additional notice. Your continued use of the service after an update means you accept the revised policy.

Contact

If you have questions about this Privacy Policy or your data, contact us at support@cipili.com.