Privacy Policy

This Privacy Notice for Ancla Tech LLC ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you visit our website at https://www.anclado.app, download and use our mobile application (OnePenny), or use Anclado — a portal of personal productivity and finance apps whose first app, OnePenny, helps users track expenses, scan and organize receipts, manage credit cards and loans, and monitor their overall financial health.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at legal@anclado.app.

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register for the Services, express interest in our products, or otherwise contact us. Depending on how you interact with us, this may include: names, phone numbers, email addresses, mailing addresses, passwords, contact or authentication data, date of birth, country of residence, receipt photos and files you upload, financial information you enter (expenses, income, and credit card and loan details — never full card numbers), and messages and feedback you send us (the assistant chat and suggestions).

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information: financial data and credit worthiness data.

Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the associated security code. All payment data is handled and stored by Stripe. You may find their privacy notice at https://stripe.com/privacy. Purchases made in the iPhone and iPad app are processed by Apple under its own terms and privacy policy (https://www.apple.com/legal/privacy): we never receive your card details, only a record of the purchase, such as its transaction number, the product, the price and whether it renews. The Android app does not process payments.

Application data. If you use our application(s), we may also collect the following if you grant access or permission: mobile device access (camera, storage, Face ID, Touch ID (biometric authentication), and other features — you can change these permissions in your device's settings at any time), and mobile device data (device ID, model, manufacturer, operating system, browser type and version, hardware model, internet service provider, and IP address). This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for internal analytics and reporting purposes.

Calls and voicemails. If you call our company phone line, we process your phone number and call details through our telephony provider (Twilio). If you leave a voicemail, we tell you first that it will be recorded; the recording is transcribed with Google Gemini, emailed to our team, and then deleted from Twilio. We do not record live calls.

Requesting mobile app access. If you request access to our mobile beta from our public website, we collect your email address, before you have an account, to verify it with a one-time code and to invite you to try the app.

Information automatically collected. Some information — such as your IP address and browser/device characteristics — is collected automatically when you visit our Services. This includes log and usage data (service-related, diagnostic, usage, and performance information such as your IP address, device information, browser type, activity in the Services, and device event information). This is primarily needed to maintain the security and operation of our Services and for internal analytics and reporting purposes. You can find out more in our Cookie Notice at https://www.anclado.app/legal/cookies.

Visit counting on our public pages. On the public pages of the Anclado Website (sign-in, sign-up, the OnePenny and MyCard information pages, the waitlist) and on our Marketing Website (anclatech.net) we count visits and the steps people reach while signing up or choosing a plan, using our own server and no cookies. We record the page, the step, a short reason when a sign-up is stopped (such as which field was missing), the country, the kind of device and where the visit came from; we do not record your name, email address, password, IP address or browser details. Your IP address and browser details are only mixed with the date into an anonymous code that changes every day, so it cannot identify you or link your visits on different days. These counts are used only to improve the sign-up experience, are never shared or sold, and are deleted after 90 days. Nothing is counted inside the signed-in app or the iOS and Android apps. See our Cookie Policy.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you use MyCard, we store the information you enter for your business card (name, company, phone numbers, email, website, address), the design you chose and any image you upload, and a log of the steps you took to build, pay for and receive your business card. We use this to deliver the business card, to prevent misuse and to help you if you contact support. Support staff can see this record only after verifying your identity, and every view is logged.

If you give a MyCard gift card to someone, we also store the recipient’s email address and first name, the reason for the gift and the comment you wrote, and your first name, and we email the recipient a link to the gift. The recipient’s email is used only to deliver the gift and to tell you when it is claimed, and is not used for marketing. If the recipient builds their own card from the link, they confirm their email with a code and may choose to create an Anclado account.

If you give a MyCard gift in person (shown as a QR code to someone next to you) or by WhatsApp (you send the link from your own WhatsApp; we do not send anything to WhatsApp), we do not ask for or store the recipient’s email: holding the single-use gift link is what lets them finish their card. The details they type (which may include a phone number) are printed on their business card, which they keep in their Wallet or save as an image. They may create an Anclado account later from the «Modify my card» link on their card; until then the card stays linked to the gift you gave.

If you received a MyCard as a gift (a card or credits), we may ask how your experience was. If you answer, we store your rating, the comment you write and the first name you give, and we use them to improve MyCard. Your answer is private. We publish a quote on our website (anclatech.net) only if you tick the box that allows it, together with your first name and a note that you received MyCard as a gift. You can ask us to remove or delete your answer at any time at info@anclado.app. We keep answers until you ask us to delete them.

Google Wallet. If you or an employee choose «Add to Google Wallet», the content of the business card (name, job title, company, phone numbers, email address, website, address, social profiles, the contact QR code, and the logo or image on the card) is sent to Google LLC, which stores it as the pass in the person's wallet. The pass's QR code is a link to the card's contact page on anclado.app (anyone who scans it sees the card and can save the contact; it stops working when the card is removed). We keep the date the pass was created. To let Google download the logo, we serve it from a public web address that cannot be guessed and is not listed anywhere; anyone who has that address can see that image. Photos or logos you upload to a personal card are sent to Google too, as are company logos of MyCard Business. Google acts under its own terms and privacy policy.

Anclado accounts are shared by our family of apps: OnePenny, MyCard and AprendoCare (https://www.aprendocare.com), an app that connects people training for home-care work in Massachusetts with schools and agencies. AprendoCare has its own website, app and database, and you sign in to it with your Anclado account. Your Anclado data (for example your OnePenny expenses or your MyCard cards) is not shared with AprendoCare, and what you do in AprendoCare is not shared with the other apps, except the account details needed to sign you in: your account ID, phone number, email address if you have one, name, and whether you completed the second sign-in step.

Signing in with a phone number. In AprendoCare you can create an account with only your mobile phone number and a password. We send a one-time code by text message (SMS) to that number, to confirm it and later as a second sign-in step or to recover your password, through Twilio, which receives the phone number and the code to deliver it and to prevent fraud. We store the phone number on your account and use it only to sign you in and to secure your account; we do not use it for marketing and do not sell it. Message and data rates from your carrier may apply.

Organization staff. To act for a school or an agency in AprendoCare, you must also add and confirm an email address on your account and enter a code we email to it when you start this mode (again every 12 hours). We record that this second step was completed for your session, and AprendoCare checks it with us before each action taken for the organization.

Date of birth in AprendoCare. AprendoCare asks for your date of birth to confirm that you are 18 or older, and we keep it on your Anclado account to confirm who you are if you ever lose access (see below).

Adding an email. If your account has only a phone number and you open OnePenny, MyCard or the Anclado portal, we ask you to add and confirm an email address first, because those apps send receipts, cards and notices by email.

Passwords and account recovery (all our apps). We never store your password, only an encrypted fingerprint (hash) of it. To stop a password from being reused, we keep the fingerprints of your last five passwords. To warn you about a password that appeared in a public data breach, we check it with the Have I Been Pwned service by sending only the first five characters of a fingerprint of it, never the password. You can choose two recovery questions; we keep only an encrypted form of your answers. If you forget your password, we first send a code to one of your contact methods and then ask for a different check (another code, the authenticator app, a recovery question or, as a last step, your name, last name and date of birth with your typed signature, «I confirm who I am»). We keep a record of each «I confirm who I am» attempt (what you typed, your signature, whether it matched, a fingerprint of your IP address and your browser) to protect your account and investigate misuse.

Recovering an account after losing the phone number («I lost my number», all our apps). If you lost the number on your account and can't get a code by email, you can ask us to move your account to a new number. We ask you to confirm the new number with a code, your name, last name and date of birth, and, if you set them, your recovery answers (we keep only whether they matched, never the answers), a photo of an official ID, a selfie taken with your camera at that moment and, optionally, your course certificate, plus an optional email so we can tell you the result. A person on our team compares them with your account; we don't use automated face recognition. The photos are kept in private storage that only our reviewers can open, are used only to decide your request, are never shared or sold, and are deleted 30 days after the decision. If the request is approved, your account's email is told and can stop it within 48 hours.

Which app you signed up in. We record which of our apps your account was created in, to show you the right app when you sign in and to apply the right plan; an account created in AprendoCare does not start the OnePenny trial.

If you request access to our investor room, we store your name, email address and phone number, the confidentiality agreement you signed (your typed name, the date and time, the version and a fingerprint of the text you were shown, and the IP address and device used to sign), and when you enter the room. We use this information to verify your email, to keep a record of the agreement, and to follow up with you about a possible investment. We keep it for as long as the agreement and any relationship with you require.

If you scan a credit-card statement, you first cover your name, address and account number with black bars on your own device. Only the pages with those bars burned into the image are sent to a third-party AI scanning service (Anthropic) to read the numbers on them (balance, minimum payment, dates, credit limit, interest rate and similar). The original, uncovered pages are never sent to us or stored. If you choose a PDF, the PDF file itself is never uploaded or saved: its first pages are converted to images on your device, covered, and only those covered images are read.

We keep the numbers we read in your statement history for the number of days you choose in Settings (365 by default); older entries are deleted automatically. Saving the covered image itself is optional, off by default, and requires your separate confirmation; if you save it, it stays in a private storage area visible only to you until the same retention period ends or you delete it. We do not share your statements. According to the AI providers' current policies, they do not use the files sent through their business services to train their models; please review their own terms and privacy policies for details.

If you register a company on MyCard Business, we store the company's name, website, phone, contact email and logo, the business card design, the name, title, phone and email of each employee you add, your electronic signature of authorisation (typed name, date, IP address and browser information), and a log of the changes made to the company and of every credit purchase and use. The company decides which employees to add and is responsible for having the right to do so; we process the employees' data only on the company's behalf, to build and send their business cards, and we send an email with the business card to an employee only when the company asks us to. An employee who has questions about their business card can contact the company, or us at info@anclado.app.

Sending and delivery records. These records are only about EMAILS: MyCard Business sends the employee's digital business card by email, and we do not send anything by physical mail. For each email a company sends to an employee, we keep the employee's name and email address, the date and time it was sent, and its result: delivered (the recipient's mail server accepted it), bounced (the address does not exist or the mail server rejected it), marked as spam (the recipient reported it), or failed (it could not be sent). We also keep a list of the email addresses that bounced or reported spam, so that we do not send to them again. The company sees these results for its own sends; we use them to run the service, protect the sending reputation of our mail domain and prevent abuse.

Google Wallet. If you or an employee choose «Add to Google Wallet», the content of the business card (name, job title, company, phone numbers, email address, website, address, social profiles, the contact QR code, and the logo or image on the card) is sent to Google LLC, which stores it as the pass in the person's wallet. The pass's QR code is a link to the card's contact page on anclado.app (anyone who scans it sees the card and can save the contact; it stops working when the card is removed). We keep the date the pass was created. To let Google download the logo, we serve it from a public web address that cannot be guessed and is not listed anywhere; anyone who has that address can see that image. Photos or logos you upload to a personal card are sent to Google too, as are company logos of MyCard Business. Google acts under its own terms and privacy policy.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including to: facilitate account creation and authentication and otherwise manage user accounts; deliver and facilitate delivery of services to you; respond to your inquiries and offer support; send you administrative information about our products and services, and changes to our terms and policies; fulfill and manage your orders, payments, returns, and exchanges made through the Services; request feedback and contact you about your use of our Services; protect our Services, including fraud monitoring and prevention; evaluate and improve our Services, products, marketing, and your experience, including identifying usage trends and determining the effectiveness of our promotional campaigns; power our AI-assisted features (receipt reading, the help assistant, and the Financial Health Index); verify your identity and secure your account (two-factor verification, and confirming your identity when you contact our support team); and comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

Customer support access. When you contact our support team, we verify that you are the account owner before anyone looks at your account — for example, by sending a one-time code to the email address on the account. Only authorized staff can access account data to resolve your request, only after that verification, and every access is logged. We never ask for your password.

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with these third parties designed to safeguard your personal information — they cannot use it for anything other than what we've instructed, cannot share it with any other organization, and commit to protecting it and retaining it only for the period we instruct.

The third parties we may share personal information with, by category:

AI Service Providers — Google Gemini and Anthropic.

Cloud Computing Services — Supabase and Vercel.

Invoice and Billing — Stripe.

Purchases in the iPhone and iPad app — Apple.

Website Hosting — Vercel.

Website and App Testing — TestFlight and Google Play Console.

Transactional Email Delivery — Resend.

Company Email Hosting — MochaHost.

Telephony (calls and voicemail) and sign-in codes by text message — Twilio.

Checking new passwords against public data breaches — Have I Been Pwned (receives only the first five characters of a fingerprint of the password, never the password).

Digital business cards in Google Wallet — Google LLC (only when someone adds a card to Google Wallet).

Advertising measurement on our marketing website (anclatech.net) and on the public pages of anclado.app — Google Ads (Google LLC).

We may also need to share your personal information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. These help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice at https://www.anclado.app/legal/cookies.

Advertising on Google. We advertise our services on Google Ads. Our marketing website (https://www.anclatech.net, which shows our products and the plans and prices of OnePenny) uses Google's tag to measure whether a click on one of our ads led to a plan choice. When you visit that website, Google may receive your IP address, browser and device details, the page you viewed, and an identifier of the ad click that brought you there, and may set or read cookies. Google processes that data under its own terms and privacy policy (https://policies.google.com/privacy). The same tag also loads on the public pages of anclado.app that our ads can lead to (sign-in, sign-up, and the OnePenny and MyCard information pages). It is never used inside the signed-in Anclado app or inside the iOS and Android apps. Visitors in the European Economic Area, the United Kingdom, and Switzerland are measured without advertising or analytics storage by default. You can block these cookies in your browser or manage Google ads at https://adssettings.google.com.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies ("AI Products"). We provide the AI Products through third-party AI Service Providers, including Anthropic and Google Gemini. Your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products.

Our AI Products are designed for the following functions: image analysis (reading a scanned receipt to extract its details), natural language processing, AI insights (the Financial Health Index's written recommendations), and AI bots (the "Ancla" support chat).

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with these third parties.

How to opt out. You can contact us using the contact information provided, or choose manual data entry instead of AI-powered receipt scanning and avoid using the AI-powered support chat.

We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice requires us to keep your personal information for longer than one (1) month past the termination of your account.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if that isn't possible (for example, because it's stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from a minor, please contact us at legal@anclado.app.

You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us at legal@anclado.app. This will not affect the lawfulness of processing before its withdrawal.

Account information. If you would like to review or change the information in your account, or terminate your account, you can log in to your account settings (https://www.anclado.app/settings) and update your account, or contact us. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases; however, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements.

You can also delete your account at any time in Settings → Delete Account, or see https://www.anclado.app/legal/delete-account.

Cookies and similar technologies. Most web browsers accept cookies by default. You can usually set your browser to remove or reject cookies; doing so may affect certain features of our Services. See our Cookie Notice at https://www.anclado.app/legal/cookies for more.

If you have questions or comments about your privacy rights, you may email us at legal@anclado.app.

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your preference not to have your online browsing activity monitored. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT browser signals or any other automatic mechanism communicating your choice not to be tracked online. If a standard is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we've processed it, correct inaccuracies, get a copy of, or delete your personal information, and withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect, and whether we've collected each (based on the past twelve months): Identifiers (e.g. name, address, phone number, email, IP address) — collected. Personal information under the California Customer Records statute (e.g. name, contact information, financial information) — collected. Characteristics of protected classifications under state or federal law (e.g. age/date of birth, collected only for age verification and to confirm your identity if you lose access — we do not collect gender, race, or other demographic data in this category) — collected. Commercial information (transaction and financial details) — collected. Biometric information — not collected (Face ID/Touch ID never leaves your device). Internet or other network activity (log and usage data such as IP address and device information) — collected. Geolocation data — not collected. Audio, electronic, and visual information (receipt photos you upload, and voicemail recordings you leave on our phone line) — collected. Professional or employment information and education information — not collected. Inferences drawn from your information (the Financial Health Index) — collected. Sensitive personal information (financial information including account access details, and account login information) — collected.

We only collect sensitive personal information as permitted by law or with your consent, and do not process it for the purpose of inferring characteristics about you. We do not sell personal information. The Google tag on our marketing website (anclatech.net) and on the public pages of anclado.app makes limited identifiers (IP address, ad-click identifier, pages viewed) available to Google for advertising measurement; under some state laws this may be considered "sharing" for advertising purposes, and you can opt out by blocking cookies for that website, through Google's ad settings (https://adssettings.google.com), or by writing to legal@anclado.app. Apart from that, we have not sold or shared personal information with third parties for a business or commercial purpose in the preceding twelve months. We have disclosed identifiers, California Customer Records information, protected-classification characteristics, commercial information, internet or network activity information, audio and visual information, inferences, and sensitive personal information to our service providers (see "When and with whom do we share your personal information?") for a business purpose in the preceding twelve months.

We retain each of these categories for as long as you have an account with us.

Your rights may include: the right to know whether we're processing your personal data; the right to access it; the right to correct inaccuracies; the right to request deletion; the right to obtain a copy of what you've shared with us; the right to non-discrimination for exercising your rights; and the right to opt out of processing used for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. Depending on your state, you may also have the right to access the categories of personal data being processed, obtain a list of third-party categories (or specific third parties) we've disclosed data to, obtain a list of third parties we've sold data to, review and correct how your data has been profiled, limit the use of sensitive personal data, and opt out of biometric or facial/voice recognition data collection.

To exercise these rights, contact us by visiting https://www.anclado.app/settings or by emailing legal@anclado.app. Under certain state laws, you can designate an authorized agent to make a request on your behalf — we may ask for proof they're validly authorized. Upon receiving a request, we'll verify your identity, using only the information provided in the request itself unless we need more to confirm it or prevent fraud.

Appeals. If we decline to act on your request, you may appeal by emailing legal@anclado.app. We'll inform you in writing of any action taken, including our reasoning; if your appeal is denied, you may complain to your state attorney general.

California "Shine the Light" law. California residents may request, once a year and free of charge, information about any personal information we disclosed to third parties for direct marketing purposes in the preceding calendar year, by writing to legal@anclado.app.

Yes, we will update this notice as necessary to stay compliant with relevant laws. An updated version will be indicated by a revised date at the top. If we make material changes, we'll notify you by prominently posting a notice or sending you a direct notification.

If you have questions or comments about this notice, email us at legal@anclado.app, or contact us by post at:

Ancla Tech LLC, 867 Boylston Street, 5th Floor, Boston, MA 02116, United States.

You can also call us at (617) 917-9629, Monday to Friday, 9AM - 5PM Eastern Time (outside those hours you can leave a voicemail).

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correct inaccuracies, or delete it. To do so, please visit https://www.anclado.app/settings.