Last Updated: July 14, 2026

INTRODUCTION

TCS Digital, LLC ("Skwad," "we," "us," or "our") is committed to protecting the privacy and security of the personal information we collect from our users. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website and use our mobile application (collectively referred to as the "Platform").

By accessing or using the Platform, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy.

1. INFORMATION WE COLLECT

1.1 Personal Information

When you sign up for Skwad, we may collect certain personal information from you, such as your name, email address, and payment details, in order to create and manage your account. We collect this information directly from you when you voluntarily provide it to us.

1.2 Usage Data

We may automatically collect information about your interactions with our Platform, including the features you use, the pages you visit, and your device information. This information may include your IP address, browser type, operating system, referring URLs, and other similar data.

1.3 Email Inbox Data

Skwad Scan is a feature that allows us to parse and categorize spending alerts and statements sent to a dedicated email inbox on your behalf or uploaded directly via the app or third-party integrations. We may share this information with our partners for processing purposes only. Our partners are strictly prohibited from storing this data or using it to train AI models.

Raw email content received in your dedicated parse inbox is purged within 24 hours of successful parsing; the structured transaction data extracted from each email is retained subject to Section 4 (Data Retention).

For more information on how our partners handle your data, please refer to:

• OpenAI's privacy policy
• Google Gemini's privacy policy

Important Note: Skwad does not sell this information to any third parties, and we do not use your data to develop, improve, or train generalized AI models and/or ML models.

1.3.1 Google API Services User Data Policy — Limited Use

Skwad's Gmail integration uses the gmail.readonly scope to read messages you have explicitly authorized us to access (for example, spending alerts and bank/merchant statements you forwarded to your dedicated parse address or that arrive in a connected Gmail label). Skwad's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Gmail data only to provide and improve the user-facing features described in this Privacy Policy (parsing transaction details, surfacing spending insights, and syncing to your Skwad account).
• We do not use Gmail data for advertising of any kind.
• We do not sell or transfer Gmail data to third parties for advertising, market research, or AI/ML training purposes.
• We do not allow human review of your Gmail content, except (a) with your affirmative consent for specific messages, (b) for security or abuse-prevention purposes, (c) to comply with applicable law, or (d) for limited debugging by authorized engineers under strict access controls.
• We process Gmail data only on infrastructure operated by Skwad's vetted sub-processors (Section 5).

You may revoke Skwad's access to your Gmail account at any time from your Google Account permissions page; revocation stops all future ingestion immediately.

1.4 Receipt Information

If you choose to use our receipt or statement scanning feature, we may collect and store images and text of your uploads for expense tracking and processing purposes. We do not sell this information to any third parties.

1.5 Financial Information

Through our integration with SimpleFIN or Plaid, we may collect and process your financial account information, including account balances, transaction history, and account details, to provide you with financial insights and expense tracking services. This information is collected with your explicit consent and only for the purposes outlined in this policy.

1.6 Cookies and Tracking Technologies

We use cookies and similar tracking technologies in three categories:

• Strictly necessary — session identifiers, sign-in tokens, CSRF protection, and load-balancing cookies. The Service cannot function without these and they cannot be disabled through the Service.
• Preferences — light/dark mode, currency display, dismissed prompts, and similar UI choices stored locally in your browser.
• Analytics — product analytics provided by PostHog (see Section 5) measuring aggregate feature usage and performance. You can opt out at any time by emailing [email protected], by enabling your browser's "Do Not Track" or Global Privacy Control signal, or by blocking cookies through your browser settings.

We do not use cookies for cross-context behavioral advertising, and we do not sell or share cookie data with advertising networks.

2. HOW WE USE YOUR INFORMATION

2.1 Personalization

We may use the information we collect to personalize your experience on Skwad, including providing tailored recommendations and insights based on your spending habits. This helps us deliver a more relevant and enjoyable experience for you.

2.2 Account Management

We use your personal information to create and manage your Skwad account, process transactions, and communicate with you about your account status. This includes sending you important updates, security alerts, and other administrative messages.

2.3 Platform Improvements

We analyze usage data to improve the functionality, performance, and user experience of Skwad. This helps us identify and fix bugs, optimize our Platform, and develop new features and services that meet the needs of our users.

2.4 Marketing Communications

With your explicit consent, we may use your contact information to send you promotional materials and updates about Skwad and its features. You can opt-out of receiving these communications at any time by following the unsubscribe instructions provided in the messages or by contacting us directly.

3. DATA SECURITY

We take the security of your information seriously and implement a variety of industry-standard measures to protect it against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, firewalls, role-based access controls, and regular security review. Our security program is designed to be consistent with the FTC Safeguards Rule (16 CFR Part 314) as it applies to providers of financial products or services.

Breach notification. If we confirm a personal-data breach that creates a meaningful risk of harm to you, we will notify affected users without undue delay and, where feasible, within seventy-two (72) hours of confirmation. The notification will describe the nature of the incident, the data categories involved, the steps we are taking, and what you can do to protect yourself.

Not a credit reporting service. Skwad provides spending insights based on the data you connect or upload. We are not a consumer reporting agency under the Fair Credit Reporting Act (FCRA), do not provide credit scores or credit-related advice, and our outputs should not be relied on for credit decisions, lending, employment screening, insurance, or other purposes covered by the FCRA.

3.1 AUTOMATED DECISION-MAKING (ADMT)

Skwad uses automated processing — including AI / machine-learning models — to operate several core features:

• Transaction categorization — assigning a category (Groceries, Transportation, etc.) to each charge so it feeds your budget and spending reports.
• Receipt and statement extraction — reading the merchant, amount, date, and line items from receipts and statements you upload or forward.
• Recurring transaction detection — identifying repeating charges so they can be surfaced in the recurring widget and used for forecasting.
• Email parsing ("Skwad Scan") — extracting structured transaction details from spending alerts and statements you forward to your dedicated parse address.
• Merchant inference — mapping a raw bank descriptor (for example, SQ *MERCHANT NAME 12345) to a known merchant identity.

Each of these outputs is reviewable in your dashboard. None of them is used as the sole basis for a legal or similarly significant decision affecting you (such as denial of credit or employment).

Your rights regarding automated processing:

• Human review. You may request human review of any specific automated output by emailing [email protected] with a description of the output and the change you would like to see. We will respond within thirty (30) days.
• Opt-out of automated categorization. You may opt out of automated transaction categorization for your account; transactions will then remain in "Uncategorized" until you assign a category manually. To opt out, email [email protected].
• Quebec residents (Law 25 Article 12.1). If you are a Quebec resident, we will additionally provide, on request, the personal information used to make the decision and the principal factors and parameters that led to it.
• California residents (CPRA ADMT regulations). California residents have access, opt-out, and meaningful-information rights under the CPRA's automated decision-making technology (ADMT) provisions; see Section 10 for how to exercise them.

4. DATA RETENTION

We retain personal information only for as long as necessary to operate the Service, support you, and meet legal, accounting, audit, and dispute-resolution needs. Specific retention periods are:

• Active accounts. Receipts, transactions, budgets, goals, chat history, and account settings are retained for as long as your account is active.
• Closed accounts. Account, profile, and request data are deleted within ninety (90) days of account closure or your verified deletion request, whichever is earlier.
• Financial transaction data. Transaction history (balances, transactions, account metadata) is retained for as long as your account is active, regardless of whether the underlying bank link with Plaid or SimpleFIN remains connected.
• Raw "Skwad Scan" emails. Emails received in your dedicated parse address are purged within twenty-four (24) hours of successful parse; only the structured transaction data extracted from them is retained.
• Usage logs and IP addresses. Retained for ninety (90) days, then aggregated or deleted.
• Encrypted backups. Retained for thirty (30) days on a rolling basis, after which they are overwritten.
• Legal holds. We may retain data longer when required by law, subpoena, or pending dispute. Retained data remains protected by this Policy.

To request deletion of your account or specific data, email [email protected]. We will confirm receipt and complete the request within thirty (30) days, subject to the legal-hold exception above.

5. THIRD-PARTY SERVICES AND SUB-PROCESSORS

Skwad may integrate with third-party services or platforms, such as payment processors or analytics providers, to facilitate certain features or functions of our Platform. These third-party services may have their own privacy policies governing the collection, use, and disclosure of your information. We encourage you to review the privacy policies of these third-party services before using them in conjunction with Skwad.

Our current third-party service providers include:

Stripe (Stripe, Inc) We use Stripe for payment processing services for transactions made on the Platform. Privacy Policy: https://stripe.com/privacy

OpenAI (OpenAI, L.L.C.) We use OpenAI's language models for data parsing, analysis, and related functionalities. Privacy Policy: https://openai.com/privacy

Google (Google LLC) We use Google's services for data processing, analytics, and related functionalities. Privacy Policy: https://policies.google.com/privacy

Amazon Web Services (Amazon.com, Inc.) We use Amazon Web Services (AWS) for cloud infrastructure, hosting, and related computational services. Privacy Policy: https://aws.amazon.com/privacy/

Sinch (Sinch) We use Sinch's communication APIs for sending and receiving emails. Privacy Policy: https://www.sinch.com/privacy-policy/

SimpleFIN (One Part Rain, LLC) We use SimpleFIN's financial data aggregation and access to banking or financial information for enhanced functionality. Privacy Policy: https://beta-bridge.simplefin.org/info/privacy

Plaid Inc. We use Plaid's financial services infrastructure to securely connect to your bank accounts and retrieve financial data for account and transaction aggregation. Privacy Policy: https://plaid.com/legal/

PostHog (PostHog, Inc.) We use PostHog for product analytics and feature-flag evaluation. Privacy Policy: https://posthog.com/privacy

Sentry (Functional Software, Inc.) We use Sentry for application error and performance monitoring. Privacy Policy: https://sentry.io/privacy/

RevenueCat (RevenueCat, Inc.) We use RevenueCat to manage in-app purchases and subscription state on iOS and Android. Privacy Policy: https://www.revenuecat.com/privacy

Sub-processor changes. We will provide at least thirty (30) days' notice by email or in-product notice before adding or replacing a sub-processor that processes user content (transactions, receipts, statements, email content). You may object to a material change by closing your account before the change takes effect.

6. UPDATES TO PRIVACY POLICY

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

For material changes — including changes that expand the categories of personal information we collect, change the purposes for which we use it, or add new sub-processors that process user content — we will provide at least thirty (30) days' advance notice by email to the address associated with your account or by a prominent in-product notice before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

7. CONTACT US

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:

TCS Digital, LLC Attn: Skwad Privacy 131 Continental Dr, Suite 305 Newark, DE 19713, United States Email: [email protected]

We will make every effort to respond to your inquiries in a timely and satisfactory manner.

8. LEGAL BASIS FOR PROCESSING (GDPR - EEA AND UK USERS)

8.1 Legal Basis

If you are an individual from the European Economic Area (EEA) or United Kingdom (UK), our legal basis for collecting and using your personal information will depend on the specific context in which we collect it. Generally, we will collect personal information from you only where:

(a) We have your consent to do so,

(b) Where we need the personal information to perform a contract with you,

(c) Where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or

(d) Where we need to comply with a legal obligation.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

8.2 Legitimate Interests

Where we rely on legitimate interests as our legal basis for processing, our legitimate interests include:

• Operating and improving our Platform
• Providing customer support
• Fraud prevention and security
• Marketing our services (where you have not opted out)
• Complying with legal obligations

9. YOUR RIGHTS (GDPR - EEA AND UK USERS)

If you are an individual from the EEA or UK, you have certain rights under the General Data Protection Regulation (GDPR) and UK GDPR with respect to your personal information, including the right to:

• Access: Request access to your personal information and information about how we process it
• Rectification: Request correction of inaccurate personal information
• Erasure: Request erasure of your personal information (right to be forgotten)
• Restriction: Request restriction of processing your personal information
• Data Portability: Request transfer of your personal information in a structured, commonly used format
• Object: Object to processing of your personal information, including for direct marketing purposes
• Withdraw Consent: Withdraw consent where we rely on consent to process your personal information
• Lodge a Complaint: Lodge a complaint with a supervisory authority

To exercise these rights, please contact us at [email protected]. We will respond to your request within one month and in accordance with applicable data protection laws.

If you have any unresolved concerns, you have the right to lodge a complaint with a data protection authority in the country where you live, work, or where you believe your rights have been infringed.

10. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

10.1 Applicability

This section applies to California residents and supplements the information in this Privacy Policy. It describes how we collect, use, and share California residents' personal information and the rights available to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

10.2 Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information (terms below correspond to California Civil Code § 1798.140):

• Identifiers: Name, email address, account session identifiers, device identifiers.
• Customer records (Cal. Civ. Code § 1798.80(e)): Name, billing address, payment information.
• Commercial Information: Transaction history, purchasing behavior, subscription and billing history.
• Financial Information: Bank account details, balances, transactions, and other financial data accessed via Plaid or SimpleFIN with your consent (this is also Sensitive Personal Information — see Section 10.10).
• Internet/Network Activity: Usage data, device and browser information, IP address, pages visited, interactions with the Platform, performance metrics, and error reports.
• Geolocation: Approximate location inferred from IP address (city / region level only).
• Inferences: Categories assigned to transactions by our automated processing, recurring-transaction predictions, merchant identifications, and aggregate spending patterns derived from the categories above.

10.3 Sources of Personal Information

We collect personal information from:

• Directly from you when you provide it to us
• Automatically through your use of our Platform
• From third-party service providers and integrations you authorize (such as Plaid, SimpleFIN, or Google for Skwad Scan)

10.4 Business/Commercial Purposes for Processing

We process personal information for the following business/commercial purposes:

• Providing our services and Platform functionality
• Account management and customer support
• Security and fraud prevention
• Marketing and communications (with consent)
• Analytics and Platform improvement
• Legal compliance

10.5 Categories of Third Parties We Share With

We may share personal information with:

• Service providers and vendors who assist in our operations
• Payment processors
• Financial data providers
• Cloud infrastructure providers
• Analytics providers
• Professional advisors (lawyers, accountants, etc.)
• Law enforcement when required by law

10.6 Sale and Sharing of Personal Information

We do not sell your personal information and have not sold personal information in the past 12 months. We may share personal information for targeted advertising purposes, which under California law may be considered "sharing." You have the right to opt out of such sharing.

10.7 Your California Privacy Rights

California residents have the following rights:

Right to Know: You have the right to request information about:

• Categories of personal information we collect
• Categories of sources from which we collect personal information
• Business/commercial purposes for collecting personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we have collected about you

Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.

Right to Correct: You have the right to request correction of inaccurate personal information.

Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information for targeted advertising.

Right to Limit: You have the right to limit the use and disclosure of sensitive personal information (if applicable).

Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.

10.8 How to Exercise Your Rights

To exercise your California privacy rights, please:

• Email us at [email protected] with "California Privacy Request" in the subject line
• Include your full name and email address associated with your account
• Specify which right(s) you wish to exercise

We will verify your identity before processing your request and respond within 45 days (with the possibility of a 45-day extension if needed).

10.9 Authorized Agents

You may designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization, and you may be required to verify your identity directly with us.

10.10 Sensitive Personal Information

We collect the following category of Sensitive Personal Information ("SPI"), as defined by Cal. Civ. Code § 1798.140(ae):

• Financial account information — bank account numbers, balances, transactions, and related metadata accessed via your authorized Plaid or SimpleFIN connection.

We use this SPI only for the following permitted purposes (Cal. Civ. Code § 1798.121):

• Performing the services or providing the goods you requested (transaction sync, spending insights, budget tracking)
• Detecting security incidents, protecting against fraud, and preserving the integrity of the Service
• Verifying or maintaining the quality or safety of the Service
• Complying with legal obligations

We do not use this SPI to infer characteristics about you for advertising, profiling, or any other purpose outside the list above. California residents have the right to limit our use of SPI to the purposes listed; to exercise this right, email [email protected] with the subject line "Limit SPI Use."

10.A OTHER US STATE PRIVACY RIGHTS

If you reside in a US state with a comprehensive consumer privacy law that grants rights similar to those described in Section 10 (California) — including, but not limited to, rights of access, correction, deletion, portability, and to opt out of targeted advertising or sales — you may exercise those rights by emailing [email protected] with a description of the request. We will verify your identity, respond within the timeframe required by your state's law, and apply the same non-discrimination protections described in Section 10.7.

11. INTERNATIONAL DATA TRANSFERS

If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including personal information, to the United States and process it there.

For EEA and UK users, we ensure that international transfers are protected by appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions
• Certification schemes
• Codes of conduct

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

12. CHILDREN'S PRIVACY

Children under 13 (COPPA). The Platform is not directed to children under the age of 13 and we do not knowingly collect personal information from any child under 13. This is consistent with the U.S. Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information from our systems as promptly as we can.

Users under 18. The Platform is intended for adult use and is not designed for individuals under 18. If we learn that a user is between 13 and 18, we may restrict or terminate the account. Parents or guardians who believe a minor has provided personal information to us may email [email protected] to request deletion.

---

BY ACCESSING OR USING THE PLATFORM, YOU SIGNIFY THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU MUST NOT ACCESS OR USE THE PLATFORM.