Privacy Policy

DoorWillow (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, website, or services (collectively, the “Service”).

By accessing or using our Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use our Service.

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, and password when you create an account
• Identity Verification: Date of birth, government-issued ID, and other verification information
• Financial Information: Bank account details, routing numbers, and transaction history when you link your financial accounts
• Communications: Any information you provide when you contact customer support

2.2 Information Collected Automatically

• Device Information: IP address, device type, operating system, browser type, and unique device identifiers
• Usage Data: Pages visited, time spent, click patterns, and interactions with our Service
• Location Data: Approximate location based on IP address

2.3 Information from Third-Party Services

• Plaid: When you link your financial accounts, we use Plaid (a financial data aggregation service) to securely access your account information. Plaid collects and processes your financial data on our behalf. We receive the data you authorize us to access, including account balances, transaction history, and account holder information.
• Other Third Parties: We may receive information from analytics providers, advertising partners, and credit reporting agencies where permitted by law.

We use the information we collect to:

• Provide and Maintain the Service: Process transactions, manage your account, and deliver requested services
• Improve Our Service: Analyze usage patterns to enhance functionality and user experience
• Security and Fraud Prevention: Detect, investigate, and prevent fraudulent or unauthorized activities
• Legal Compliance: Comply with applicable laws, regulations, and legal processes
• Communications: Send you service-related notices, updates, and marketing communications (where you have opted in)
• Customer Support: Respond to your inquiries and resolve issues

We do not sell your personal information. We share your information only in the following circumstances:

4.1 With Plaid

When you link a financial account, we use Plaid to securely connect to your financial institution. By linking your account, you authorize Plaid to:

• Access your financial data
• Transmit that data to us securely
• Process that data in accordance with Plaid's own privacy policy

4.2 With Service Providers

We share information with trusted vendors who perform services on our behalf, including:

• Cloud hosting and infrastructure providers
• Payment processors
• Data analytics providers
• Customer support platforms
• Security and fraud prevention services

4.3 Legal Requirements

We may disclose your information where we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation or court order
• Protect the rights, property, or safety of our Company, our users, or others
• Prevent or investigate possible wrongdoing

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change of ownership.

We implement industry-standard security measures to protect your information:

• Encryption In Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption At Rest: Your data is encrypted when stored using AES-256 encryption
• Multi-Factor Authentication (MFA): Phishing-resistant MFA (biometrics, passkeys, hardware OTPs) is required for consumer access
• Role-Based Access Control (RBAC): Access to your data is limited to authorized personnel based on job function
• Vulnerability Management: We use Qualys to perform regular vulnerability scans against our production assets and employee endpoints to detect and remediate security risks

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your jurisdiction, you may have the following rights:

6.1 California Residents (CCPA/CPRA)

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale or sharing of your personal information (we do not sell your data)
• Right to Correct: Request correction of inaccurate personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

6.2 General Data Protection Regulation (GDPR) — EU/UK Residents

• Right of Access: Obtain confirmation of whether we process your data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (“right to be forgotten”)
• Right to Restrict Processing: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests

6.3 How to Exercise Your Rights

To exercise any of these rights, contact us at support@doorwillow.com.

We will respond to verified requests within 30 days.

We retain your personal information only for as long as necessary to:

• Fulfill the purposes described in this Privacy Policy
• Comply with legal and regulatory obligations
• Resolve disputes and enforce agreements

Specific retention periods are set out in our internal Data Retention Policy. To request information about those retention periods, email support@doorwillow.com. You may request deletion of your data at any time by contacting us at the email address above.

We use cookies and similar technologies to:

• Remember your preferences
• Understand how you use our Service
• Improve site functionality and performance

You can control cookies through your browser settings. Disabling cookies may affect certain features of our Service.

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

If you access our Service from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where our service providers are located. By using our Service, you consent to such transfers.

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Sending an email notification (where required)
• Displaying a prominent notice within the Service

The “Effective Date” at the top of this page indicates when this policy was last revised. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

This Privacy Policy is governed by the laws of the State of Georgia, United States, without regard to its conflict of laws principles.