Privacy Policy

Worth It! LLC ("we," "us," or "our") operates the Worth It! platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and any optional profile information you provide (company name, phone number).

1.2 Financial Documents

You may upload business financial documents including tax returns (Forms 1120, 1120-S, 1065, 1040 with Schedule C, and Schedule C), balance sheets, income statements, and other financial records. These documents may contain personally identifiable information (PII) such as names, addresses, Social Security Numbers (SSNs), Employer Identification Numbers (EINs), and detailed financial data.

1.3 Data Minimization — Social Security Numbers Are Not Retained

We practice data minimization: we collect and retain only what the valuation requires. We do not extract, use, or store Social Security Numbers or individual taxpayer identification numbers. If an SSN appears in an uploaded document, it is stripped at the point of ingestion and is never written to our database. We retain the business Employer Identification Number (EIN) and the financial figures needed to produce your valuation report; preparer personal details are likewise not retained.

1.3 Payment Information

Payment processing is handled by Stripe, Inc. We do not store credit card numbers or full payment details on our servers. We store transaction records including amounts, dates, and Stripe customer/subscription IDs for billing and account management.

1.4 Usage Data

We automatically collect information about how you interact with the Service, including IP address, browser type, device information, pages visited, and timestamps. This data is used for analytics, security monitoring, and service improvement.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your financial documents and generate valuation reports
• Process payments and manage subscriptions
• Send transactional emails (receipts, report notifications)
• Respond to support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Financial Document Handling

Your financial documents require special care due to the sensitive nature of the data they contain:

• Storage: Documents are stored in encrypted cloud storage (Supabase) with row-level security ensuring only you can access your own files.
• Processing: Documents are transmitted via encrypted connections (TLS 1.2+) to our processing servers.
• Access: Only our automated AI processing system accesses your documents. No human reviews your documents unless you explicitly request support assistance.
• Retention: Uploaded documents are automatically deleted 90 days after upload. You may request earlier deletion at any time.

4. AI Processing Disclosure

To generate valuation reports, your uploaded documents are processed by third-party AI services:

• Anthropic (Claude): Document images and extracted data are sent to Anthropic's Claude API for financial analysis, narrative generation, and data extraction. After the initial extraction, only minimized data (the business identity, financial figures, and industry classification — never SSNs) is sent for analysis. Anthropic processes this data under their Privacy Policy and commercial API terms, which prohibit using customer data for model training.
• Modal: Uploaded document images are processed by Modal for optical character recognition (OCR) to read the figures from your documents. Modal receives the document image solely to perform extraction; the data it returns is then minimized before storage.

We select AI providers that commit to not training on customer data submitted through their commercial APIs. However, we encourage you to review the privacy policies of these providers for complete information.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security (RLS) in our database ensuring data isolation between users
• Secure authentication via Supabase Auth with bcrypt password hashing
• Regular security reviews and dependency updates
• Access logging and monitoring

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Auto-Deletion Policy

To minimize data retention and protect your privacy:

• Uploaded documents: Automatically deleted 90 days after upload.
• Generated reports: Retained until you delete them or your account is terminated.
• Account data: Deleted within 30 days of account termination.
• Payment records: Retained for 7 years as required for tax and accounting compliance.

You can delete your data yourself at any time using the "Delete My Data" option in your account settings — this immediately removes your uploaded documents (both the database records and the stored files) and your reports. You may also request deletion by contacting privacy@worthit.app.

7. Third-Party Services

We use the following third-party services to operate the platform:

Each third-party provider operates under their own privacy policy. We encourage you to review them.

8. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Opt-Out: We do not sell personal information to third parties.

To exercise these rights, contact us at privacy@worthit.app.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing activities
• Data portability (receive your data in a structured format)
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@worthit.app. We will respond within 30 days.

10. Cookies and Tracking

The Service uses essential cookies for authentication and session management. We do not use third-party advertising cookies. Analytics cookies, if implemented, will be clearly disclosed and offer opt-out mechanisms.

11. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice. The "Effective Date" at the top of this page indicates when it was last revised.

13. Contact Us

For privacy-related inquiries, contact us at:

Worth It! LLC
Privacy Inquiries: privacy@worthit.app
General Support: support@worthit.app

This Privacy Policy is governed by the laws of the Commonwealth of Virginia.