Privacy Policy

Account information. Your name, email address, business name, password (stored only as a salted hash), and authentication records such as sign-in timestamps and one-time login codes used for multi-factor authentication.

Financial account information via Plaid. When you choose to connect a bank or card account, we use Plaid Inc. to establish that connection. Plaid collects your credentials directly and does not share them with us. With your authorization, we receive account details (such as account name, type, last four digits, and institution), balances, and transaction history.

Information you enter. Budgets, goals, categories, notes, and any accounts or transactions you add manually.

Technical information. Basic log data such as IP address, browser type, and timestamps, generated automatically when you use the service and used for security and reliability.

We do not use advertising trackers or sell-through ad pixels on the application.

• To provide the service: displaying balances, transactions, budgets, cash flow, and goals.
• To authenticate you and protect your account, including emailed multi-factor login codes.
• To refresh connected account data through Plaid on your behalf.
• To send service and account emails, such as verification and security notices.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We use Plaid to connect your financial accounts. By using NextMove to link an account, you agree that your information may be transmitted to and processed by Plaid in accordance with the Plaid End User Privacy Policy.

You can review and revoke Plaid’s access to your accounts at any time at my.plaid.com, or by disconnecting the account inside NextMove.

We share information only with vendors who process it on our behalf and under contract: Plaid (bank account connectivity), our cloud hosting and database provider, and our transactional email provider. They may use your information only to provide services to us.

We may also disclose information when required by law, or to protect the rights, property, or safety of our users or the public.

We retain your information for as long as your account is active. You may disconnect any linked financial account at any time, and you may request deletion of your account and associated data by emailing us at the address below.

We will delete or de-identify your data within 30 days of a verified request, except where we are required to retain records by law.

Data is encrypted in transit using TLS and encrypted at rest by our hosting provider. Passwords are stored as salted hashes, login codes are stored hashed, expire after 10 minutes, and are single-use. Access to production data is restricted to authorized personnel.

No system can be guaranteed to be perfectly secure, but we work to protect your information using industry-standard practices.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or a copy of that information, to request correction of inaccurate information, to request deletion, and to not be discriminated against for exercising these rights.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information (such as financial account information) for purposes other than providing the service you requested.

To exercise any of these rights, email us at the address below. We will verify your request using the email address associated with your account and respond within 45 days. You may designate an authorized agent to submit a request on your behalf.

NextMove is a business product and is not directed to anyone under 18. We do not knowingly collect information from children.

We may update this policy from time to time. If we make material changes, we will update the effective date above and notify account holders by email.