Version 1.1 · Effective October 2, 2026
RevelFT, Inc. | Stance Trial
This Privacy Policy describes how RevelFT, Inc. ("Company," "we," or "us") collects, uses, stores, and shares information when you use the Stance financial wellness product during the trial period (the "Service"). By using the Service, you agree to the collection and use of information as described in this Policy.
When you register for and use the Service, we collect:
With your explicit consent, we collect financial data from the following third-party data providers:
| Provider | Data Collected | Purpose |
|---|---|---|
| MX Technologies | Bank account information, transaction history, account balances, spending patterns | Financial health assessment, cashflow analysis |
| Equifax (DIT + OneView) | Credit report data, obligation balances, payment history, credit utilization | Debt assessment, obligation scoring, identity verification |
| Argyle | Employment status, employer information, payroll data, income verification | Income assessment, payroll analysis |
You authorize these integrations by accepting the Terms of Service at registration. You may revoke this authorization at any time by contacting us at the address in Section 10.
When you use the Service, we automatically collect:
We generate derived information from your financial data to provide the Service, including:
We use the information we collect to:
We do not use your information to:
Your data is stored on servers located in the United States. During the trial period, data is stored on secured local infrastructure. Upon transition to the full commercial product (Phase II), data will be migrated to a U.S.-based cloud provider with enterprise-grade security controls. We will update this Policy to name the provider before any of your data moves.
We implement the following security controls to protect your information:
| Control | Implementation |
|---|---|
| Password storage | bcrypt one-way hashing — never stored in plaintext |
| SSN/ITIN encryption | Fernet (AES-128-CBC) encryption at rest |
| Session management | Encrypted session tokens with 30-minute activity timeout |
| Access control | Role-based access control (consumer / enterprise / admin), including read-only access to a participant’s screens by a small number of authorized staff, bound by confidentiality, only after the participant has consented; every staff view is recorded |
| Transport security | TLS/HTTPS encryption in transit (Phase II — Azure deployment) |
| Audit logging | All data access, authentication, and consent events logged |
| Account protection | Rate limiting, account lockout after 5 failed login attempts |
No security measure is completely secure. In the event of a security incident affecting your personal information, we will notify you as required by applicable law.
| Data Type | Retention Period |
|---|---|
| Account and financial data | Duration of your account + 30 days after deletion request |
| Credit-report content received from Equifax | No longer than 30 days (records of each inquiry are kept as our provider agreement requires) |
| Consent records | Duration of your account + 5 years (legal requirement) |
| Audit logs | 2 years (including records of staff views of participant screens) |
| De-identified aggregated data | Indefinitely |
| Backup data | 30 days rolling |
We may use, share, license, and commercialize data that has been de-identified or aggregated such that it cannot reasonably be used to identify you ("De-Identified Data"). De-Identified Data may include:
Any third party that receives De-Identified Data from us is contractually prohibited from attempting to re-identify individuals from that data.
We share your personal information only in the following circumstances:
We share limited data with third-party providers necessary to deliver the Service:
| Provider | Data Shared | Purpose |
|---|---|---|
| MX Technologies | Name, account authorization | Account aggregation |
| Equifax | Name, SSN/ITIN, date of birth, address | Credit data retrieval |
| Argyle | Name, employer information | Employment and payroll verification |
| Cloud hosting provider (future) | All account and financial data | Cloud hosting and infrastructure |
These providers are engaged under agreements that limit how they may use your data. Some providers may use information in de-identified or aggregated form, or to operate and improve their own services, as their agreements permit.
We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including to comply with court orders, subpoenas, or regulatory investigations.
In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to a successor entity. We will notify you before your information is transferred and becomes subject to a different privacy policy.
We may share your information with third parties for purposes not described in this Policy when we have obtained your explicit, affirmative consent to do so.
You have the right to access the personal information we hold about you and to request correction of inaccurate information. Contact us at the address in Section 10.
You may request deletion of your personal information at any time by contacting us. We will delete your personally identifiable information within 30 days of a confirmed deletion request, subject to legal retention obligations. De-identified data derived from your usage may be retained as permitted under Section 4.
You may revoke your authorization for us to access your data from MX, Equifax, or Argyle at any time. Revocation will not affect data already collected. Contact us at the address in Section 10.
Upon request, we will provide you with a copy of your personal information in a commonly used, machine-readable format.
You may opt out of the use of your data in de-identified or aggregated analytics by contacting us. Note that opting out does not affect your ability to use the Service.
The Service may contain links to third-party websites or services, including the Social Security Administration website (ssa.gov) for retirement income estimation. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we discover that a user is under 18, we will promptly suspend their access and delete their information. If you believe a minor has provided us with personal information, please contact us immediately at the address in Section 10.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) (Cal. Civ. Code § 1798.100 et seq.), including:
We do not sell personal information. To exercise your California privacy rights, contact us at the address in Section 10.
Questions, requests, or concerns regarding this Privacy Policy should be directed to:
RevelFT, Inc. Legal / Privacy RevelFT, Inc., c/o Agents and Corporations, Inc., 1201 Orange Street, Suite 600, Wilmington, Delaware 19801 privacy@revelft.io
We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or in-product notice at least 30 days before they take effect. Your continued use of the Service after the effective date of an updated Policy constitutes your acceptance of the changes.
This Privacy Policy is incorporated into and forms part of the Stance Terms of Service. In the event of any conflict between this Policy and the Terms of Service, the Terms of Service shall control.