Privacy Policy

This Privacy Policy describes the practices of Stoxava, Inc. (“Stoxava,” “we,” “us,” or “our”) for personal information we control. It applies when you visit our website, create or use a STOXAVA account, use planning features, connect financial accounts, contact us, or participate in professional services made available through an eligible plan.

A participating tax professional, registered investment adviser firm, financial-data provider, payment provider, or other third party may provide a separate privacy notice for information it controls. That separate notice applies to the third party’s independent services. Where a more specific notice is presented for a particular STOXAVA feature, the more specific notice controls for that feature.

Additional financial privacy notices. Depending on the services offered and the regulatory status of STOXAVA or a participating firm, a user may receive a separate federal financial privacy notice under the Gramm-Leach-Bliley Act or another financial-services law. That notice will identify the institution providing it and will govern nonpublic personal information within its scope. This Privacy Policy continues to apply to other personal information and platform activities.

Account and identity information

• Name, email address, date of birth, state of residence, account identifiers, login and authentication records, and communication preferences.
• Information used to confirm account ownership or prevent fraud. If a third-party identity-verification service is used, the provider and its notice will be shown when the information is collected.

Financial and planning information

• Income, employment, compensation, bonuses, payroll deductions, filing status, estimated taxes, expenses, debts, credit status, cash balances, retirement accounts, investment accounts, insurance-related planning inputs, goals, and planned financial commitments.
• Immigration or work-status categories and related dates that you choose to provide for tax, payroll, or financial-planning purposes. STOXAVA does not provide immigration advice.
• Planning assumptions, projections, confidence ranges, alerts, recommendations, and other outputs generated from your information.

Connected financial-account information

• Institution name, account type, masked account identifiers, balances, transaction history, holdings, liabilities, loan details, income and employment information, and account-status information made available through Plaid or another approved financial-data provider.
• Information about connection attempts, refreshes, errors, account selections, and disconnections.

Professional-services information

• Plan eligibility, appointment and scheduling information, questions submitted for review, documents you choose to provide, meeting notes, professional recommendations, engagement status, and service history.
• Information required by the participating professional or firm to meet legal, regulatory, professional, recordkeeping, identity-verification, or client-onboarding obligations.

Device, usage, and communications information

• Internet Protocol address, browser, device type, operating system, approximate location derived from an IP address, pages viewed, features used, referral information, timestamps, diagnostic logs, and security events.
• Emails, support requests, survey responses, feedback, and other communications with STOXAVA.
• Cookies, local storage, pixels, software-development kits, and similar technologies as described in the Cookie Policy.

• Directly from you when you create an account, enter planning information, upload documents, contact support, or engage a professional.
• From financial institutions and financial-data providers when you authorize a connection.
• From participating professionals and partner firms involved in a service you request.
• Automatically from your device and use of the website or platform.
• From service providers that help with authentication, hosting, analytics, communications, fraud prevention, payment processing, or customer support.
• From public or lawful sources when reasonably necessary to verify a professional credential, comply with law, or protect the Services.

• Provide the Services. Create and maintain accounts; organize financial information; generate estimates, insights, and planning views; refresh connected data; and deliver requested features.
• Coordinate professional services. Determine plan eligibility, schedule sessions, securely share relevant information with the selected professional or firm, support the engagement, and maintain service records.
• Personalize and improve. Improve calculations, workflows, categorization, explanations, accessibility, reliability, and user experience.
• Protect users and STOXAVA. Authenticate users, prevent fraud, detect misuse, monitor security, investigate incidents, enforce agreements, and protect legal rights.
• Communicate. Send account, support, security, privacy, legal, billing, service, and optional marketing communications.
• Comply with law. Meet legal, tax, regulatory, professional, audit, reporting, and recordkeeping obligations that apply to STOXAVA or a participating professional or firm.
• Create deidentified or aggregated information. Produce statistics and operational insights that are not reasonably capable of identifying you, subject to applicable law.

STOXAVA may use rules, models, and artificial intelligence to classify information, explain financial patterns, generate planning insights, prioritize actions, detect anomalies, and support customer service. Automated outputs are estimates and may be incomplete or incorrect. They do not replace a qualified professional when professional judgment is required.

STOXAVA does not use its planning outputs to make lending, employment, housing, insurance, immigration, or other eligibility decisions about you. When professional advice is included in an eligible plan, the responsible professional or registered firm determines the advice provided under the applicable engagement terms.

• Service providers. Vendors that provide hosting, authentication, security, data storage, analytics, communications, scheduling, customer support, document handling, payment processing, and related services.
• Financial-data providers and institutions. Plaid or another provider and the institutions you select, as needed to establish, maintain, troubleshoot, or end a connection.
• Participating professionals and firms. Qualified tax professionals, financial planners, registered investment adviser firms, and related service providers when you request or use a professional service.
• At your direction. People or services you authorize, including a spouse, household member, professional, or adviser when the feature supports that access.
• Legal and safety purposes. Government authorities, regulators, courts, law enforcement, auditors, insurers, or other parties when reasonably necessary to comply with law, protect rights, investigate fraud or security events, or respond to lawful process.
• Business transactions. A buyer, investor, lender, affiliate, or adviser involved in a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.

We may disclose deidentified or aggregated information that does not reasonably identify you. We require service providers to use personal information only for authorized purposes, subject to contractual and legal obligations.

STOXAVA does not sell personal information for money. As of the effective date, STOXAVA does not share personal information for cross-context behavioral advertising. If these practices change, we will update this Policy and provide any notice and opt-out control required by applicable law.

Financial-account information, login information, tax-related information, immigration or work-status information, and certain identity data may be considered sensitive personal information under some laws. STOXAVA uses sensitive information to provide requested services, secure accounts, prevent fraud, comply with law, and support professional engagements. We do not use sensitive information to infer characteristics about you for unrelated advertising.

We retain personal information for as long as reasonably necessary to provide the Services, maintain account and professional-service records, comply with legal or regulatory requirements, resolve disputes, prevent fraud, enforce agreements, and protect users. Retention periods depend on the type of information, the feature involved, the sensitivity of the information, whether an account or professional engagement remains active, and applicable legal obligations.

Deleting an account or disconnecting a financial institution stops future use as described in the applicable controls, but it may not immediately remove information from backups or records that must be retained for security, legal, regulatory, payment, dispute, or professional-recordkeeping purposes. When retention is no longer necessary, information is deleted, deidentified, or otherwise handled in accordance with our retention practices.

We use administrative, technical, and organizational safeguards designed to protect personal information. These safeguards may include encrypted transmission, access controls, logging, monitoring, secure development practices, vendor review, and incident-response procedures. Where the Gramm-Leach-Bliley Act Safeguards Rule or another financial-security rule applies to STOXAVA, we will maintain the additional program elements required for the applicable activities. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur. Review the Security and Data Protection page for more information.

If we confirm a breach that requires notice, we will notify affected individuals and applicable authorities without unreasonable delay and within the time required by applicable law, subject to the time reasonably necessary to determine the scope, restore system integrity, and comply with a lawful law-enforcement delay. Because notification rules differ by jurisdiction and incident, this Policy does not promise a single universal number of days for every event.

Depending on where you live and subject to legal exceptions, you may have the right to request access to personal information, correction, deletion, portability, information about disclosures, restriction or limitation of certain uses, and an appeal of a denied request. You may also have the right to opt out of sale, sharing, targeted advertising, or certain profiling and to exercise rights without unlawful discrimination.

• Submit a request by emailing support@stoxava.com with “Privacy Request” in the subject line.
• Use account settings, when available, to correct planning information, disconnect accounts, manage communications, or request account deletion.
• Use Cookie Preferences in the website footer to manage optional cookies and similar technologies.
• Use the unsubscribe link in optional marketing emails. You will continue to receive necessary account, service, legal, privacy, billing, and security messages.

We may verify your identity before completing a request. Where permitted, an authorized agent may submit a request for you, but we may require proof of authorization and direct verification with you. If applicable law provides an appeal right, reply to our decision or email support@stoxava.com with “Privacy Appeal” in the subject line.

Residents of certain U.S. states may have additional rights. During the preceding 12 months, STOXAVA may have collected and disclosed the categories described in this Policy, including identifiers, customer records, financial information, commercial information, internet or device activity, professional or employment information, sensitive personal information, and inferences. These categories may be disclosed to the recipients described in Section 6 for the purposes described in Section 4.

STOXAVA does not use or disclose sensitive personal information for purposes that require a right to limit under California law. Where legally required, STOXAVA will treat a recognized Global Privacy Control signal as an opt-out request for the browser or device sending the signal. Because STOXAVA does not currently sell or share personal information for cross-context behavioral advertising, an opt-out may confirm the existing setting rather than change current practices.

California “Shine the Light.” STOXAVA does not disclose personal information to third parties for their own direct-marketing purposes as described by California Civil Code Section 1798.83. A California customer may submit a request about this practice by emailing support@stoxava.com with “California Direct Marketing Request” in the subject line.

You may disconnect a financial account through available settings or by contacting support@stoxava.com. Disconnection is intended to stop future retrieval after processing, but it does not automatically delete information already imported into STOXAVA. You may request deletion subject to the retention exceptions described above. You may also have connection and deletion controls through the financial-data provider.

The Services are intended for adults and are not directed to individuals under 18. We do not knowingly create accounts for or collect personal information directly from children under 18. If you believe a minor has provided personal information, contact support@stoxava.com.

The Services are currently intended for users in the United States. Personal information may be processed in the United States and in other locations where our service providers operate, subject to applicable safeguards and law.

We may update this Policy to reflect changes in the Services, professional-service structure, technology, law, or privacy practices. We will post the revised version and update the effective date. We will provide additional notice when required by law or when a material change warrants it.

Questions about this document: support@stoxava.com. Do not send passwords, full account numbers, Social Security numbers, or other highly sensitive information by email or social media.