Privacy Policy

1. Information we collect

We collect information you provide, information created when you use BellPathOS, and information you authorize a connected provider to send to us.

Account and security information

• Your email address, account identifiers, sign-in records, preferences, and security events.
• Authentication information such as MFA or passkey status. BellPath does not ask you to enter a bank password or bank MFA code into BellPathOS.

Financial information

• Bank and card connection metadata, such as institution name, account type, masked account details, balances, and transactions that you authorize through a connection provider.
• Documents and records that you upload or import, such as bills, statements, paychecks, debts, goals, tax notes, and payment confirmations.
• Investment and brokerage information that you enter or authorize, including positions, orders, buying power, watchlists, strategies, and risk settings.

Trading, AI, and technical information

• Market, quote, news, and research data used by the features you enable.
• Prompts, questions, and selected financial or trading context submitted to an AI feature. We aim to exclude raw documents, passwords, MFA codes, and brokerage credentials from AI and trader context.
• Device, browser, log, performance, and security information needed to operate and protect the service.

2. How we use information

We use information to:

• Provide, authenticate, maintain, and secure BellPathOS.
• Display financial dashboards, budgets, cash flow, bills, debts, goals, and account information.
• Import, classify, reconcile, and verify financial records when you request those features.
• Provide market research, trading analysis, risk controls, recommendations, and execution workflows that you enable.
• Respond to support requests, detect abuse, troubleshoot reliability, and improve the service.
• Comply with law, enforce our agreements, and protect users, providers, and the service.

We do not sell or rent personal information, and we do not use connected financial-account data for unrelated advertising. We share information with service providers only as described below or when you direct us to do so.

3. Connected financial accounts

BellPathOS may use Stripe Financial Connections to let you connect eligible bank or card accounts. During that flow, you authenticate with the financial institution through Stripe's hosted connection experience and consent to the data permissions shown there. BellPath does not receive your bank login password or bank MFA code.

The current BellPath connection flow requests balance and transaction access for budgeting, bill forecasting, and payment verification. BellPath may receive account and institution identifiers, masked account information, balances, transaction data, and timestamps supplied by the institution. Availability and refresh timing depend on the institution and Stripe.

Connected financial accounts are read-only in BellPathOS. They do not move money, change your bank account, or become Alpaca buying power. You can disconnect an account from BellPathOS and may also manage permissions through the connection provider. Stripe and the financial institution may separately process information under their own privacy policies.

4. Trading and AI features

When you connect Alpaca or another supported trading service, BellPathOS may process account, position, order, quote, and market information needed to show your portfolio and operate enabled trading workflows. If you turn on live or autonomous execution, the service may submit orders subject to the settings, strategies, permissions, and risk controls you have saved. A connection to household financial accounts does not authorize BellPathOS to transfer money.

AI features may process the prompt you submit and the limited context needed for the selected feature. AI output can be incomplete, inaccurate, delayed, or unsuitable for your circumstances. It is not financial, legal, tax, or accounting advice, and you remain responsible for reviewing any recommendation or order.

5. When information is shared

We may share the minimum information needed with:

• Service providers: providers that host the site and functions, authenticate users, store protected application data, connect financial accounts, provide brokerage or market data, deliver AI features you choose, or help us secure and support the service.
• Providers you choose: a bank, card issuer, broker, email or document source, or other provider when you ask BellPathOS to connect or import it.
• Legal and safety recipients: courts, regulators, law enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, security, or the service.
• Business successors: a successor or advisor in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law.

We do not sell personal information or disclose it to data brokers for their own marketing.

6. Retention and security

We retain information for as long as reasonably needed to provide the service, maintain account and financial history you ask us to keep, resolve disputes, enforce agreements, meet legal obligations, and maintain secure backups. Disconnecting an account stops future access through BellPathOS, but it does not necessarily erase information already required for records, security, legal compliance, or backups.

We use administrative, technical, and organizational safeguards such as encrypted connections, access controls, protected server-side storage, and limited handling of sensitive data. No website, device, provider, or transmission method is completely secure, so we cannot promise absolute security.

7. Your choices and privacy rights

Depending on where you live and subject to legal limits, you may be able to:

• Access, correct, or request deletion of personal information held by BellPath.
• Disconnect a financial institution, revoke a provider permission, or stop using an optional import, AI, or trading feature.
• Request information about how your data is used or shared.
• Appeal a privacy request decision where applicable.

To protect your account, we may need to verify your identity before completing a request. Some information may be retained when required for security, fraud prevention, legal compliance, financial records, or dispute resolution. Requests can be made through the support or account-contact method provided in BellPathOS.

8. Children

BellPathOS is not directed to children under 18, and we do not knowingly collect personal information from children under 18.

9. Contact and policy changes

BellPath by DSB is responsible for this policy. Privacy questions and requests may be submitted through the support or account-contact method provided in BellPathOS or through the BellPathOS website. Please do not send passwords, MFA codes, full account numbers, or brokerage credentials in a support request.

We may update this policy as the service, providers, or legal requirements change. The effective date above shows when this version took effect. If a change is material, we will provide notice through the service or another appropriate channel.