Privacy Policy

Last updated: March 2026

Account Information

When you create a BURSIFY account, we collect your name, email address, and password. If you choose to complete your profile, we may also collect your date of birth, mailing address, phone number, and household size. This information is necessary to identify benefits and programs you may be eligible for.

Financial Transaction Data

Through our integration with Plaid, we access your financial transaction data on a read-only basis. This includes account balances, transaction history, account and routing numbers (masked), and institution details. We never have the ability to move money from your accounts or initiate any transactions on your behalf.

Uploaded Documents

If you use our insurance appeal features, you may upload denial letters, explanation of benefits (EOB) documents, and medical records. These documents are processed using optical character recognition (OCR) to extract relevant information for your appeal cases.

Usage Analytics

We collect anonymized usage data including pages visited, features used, session duration, and device information (browser type, operating system, screen resolution). This data is used to improve the platform experience and does not personally identify you.

We use the information we collect to:

• Identify unclaimed benefits, tax credits, and government programs you may qualify for
• Analyze insurance denial letters and generate appeal arguments on your behalf
• Match you with eligible class action settlements based on your transaction history
• Provide personalized financial recovery recommendations
• Process subscription payments and manage your account
• Send transactional emails (account confirmations, case updates, appeal status changes)
• Improve our AI models and platform features using aggregated, de-identified data

We do not sell your personal information to third parties. We do not use your financial data for advertising purposes. Your data is used solely to provide and improve the BURSIFY service.

BURSIFY uses Plaid Technologies, Inc. to securely connect to your financial institutions. When you link an account through Plaid, you are granting BURSIFY read-only access to your financial data. We do not store your banking credentials — Plaid handles authentication directly with your financial institution.

Our Plaid integration accesses the following data categories: account balances, transaction history (up to 24 months), account holder name, and institution details. Data is synced every 24 hours to keep your benefit eligibility and settlement matching up to date.

You can disconnect any linked account at any time from your Settings page. When you disconnect an account, we stop syncing new data and delete the associated transaction history within 30 days, in accordance with Plaid's data retention policies.

All data is stored on Amazon Web Services (AWS) infrastructure located in the United States. We implement industry-standard security measures to protect your information:

• Encryption at rest using AES-256 for all stored data, including databases and file storage
• Encryption in transit using TLS 1.3 for all data transmitted between your browser and our servers
• Row-level security (RLS) in our database ensuring users can only access their own data
• Role-based access controls limiting employee access to production data
• Regular security audits and penetration testing

Uploaded documents (denial letters, EOBs) are processed in memory and stored temporarily for the duration of your active case. Once a case is closed or resolved, associated documents are automatically deleted within 90 days. You can request immediate deletion at any time.

We work with the following third-party service providers:

• Plaid — Financial data aggregation and account linking
• Stripe — Subscription billing and payment processing. We do not store your credit card information; it is handled entirely by Stripe.
• Amazon Web Services — Cloud infrastructure, data storage, and AI/ML processing
• Amazon Cognito — User authentication and identity management

Each third-party provider is contractually obligated to protect your data in accordance with their respective privacy policies and applicable data protection regulations.

Depending on your location, you may have certain rights regarding your personal information under the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), or other applicable privacy laws:

• Right to Access — You can request a copy of all personal data we hold about you. Use Settings → Privacy → Download Data to export your data at any time.
• Right to Deletion — You can request that we delete your account and all associated data. Account deletion is permanent and cannot be undone. Go to Settings → Privacy → Delete Account.
• Right to Correction — You can update your personal information at any time through your account settings.
• Right to Opt Out — You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or updating your notification preferences.
• Right to Portability — You can export your data in a machine-readable format (JSON) for transfer to another service.

To exercise any of these rights, contact us at privacy@bursify.app or use the self-service options in your account settings. We will respond to all requests within 30 days.

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@bursify.app
• Support: Help Center

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.