Privacy Policy

1. Introduction

Remitloom, Inc. ("the Company," "we," "us," or "our") provides AI-assisted bookkeeping and bank reconciliation automation for startup and SMB finance teams. Our core service processes bank feed data and general ledger entries submitted by finance professionals to generate nightly reconciliation matches, exception reports, and audit trail records. We operate the website remitloom.com and the associated reconciliation platform (collectively, the "Service").

This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have. It applies to information we collect through the Service and through direct communications with you.

The Company is based at 233 South Wacker Drive, Suite 8400, Chicago, IL 60601 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, email, phone) when you fill out a form, request a demo, or subscribe to updates;
• Company and role information you choose to share (employer, title, company size, finance-stack context);
• Bank account connection credentials submitted via OAuth read-only authorization to your banking institutions;
• Accounting software connection credentials submitted via OAuth read-only authorization to your accounting platform;
• The content of any messages you send us.

Bank feed data and general ledger data connected through the Service are processed solely to generate reconciliation matches, exception reports, and audit trail exports for your finance team. We do not use this financial data for any purpose other than operating the reconciliation service on your behalf, and we do not use it to train models without explicit written consent.

2.2 Information Collected Automatically

When you visit remitloom.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5).

2.3 We Do Not Knowingly Collect Children's Data

remitloom.com is a professional finance tool not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Operate the reconciliation service: run nightly bank-to-ledger matching, generate exception reports, and maintain the audit trail for your finance team's close process;
• Respond to inquiries and provide requested information;
• Operate, maintain, and improve the Service;
• Send service updates and (with your consent where required) marketing communications;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations, including obligations applicable to financial software processors handling bank account data.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (e.g., hosting, email delivery, analytics, bank data aggregators) under contractual confidentiality terms;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. For finance teams using our reconciliation service, match records and audit trail data are retained for the subscription period plus 12 months following termination, to support post-close audit reviews. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information and financial data, including TLS encryption in transit, restricted-access databases, least-privilege access controls, and read-only OAuth scopes for bank and accounting system connections. We never store bank login credentials. No system is perfectly secure; we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. Illinois Residents

Illinois does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (e.g., GLBA as it applies to financial data processors), those laws may give you additional rights with respect to data covered by them. Finance teams using our reconciliation service retain responsibility for their own compliance obligations with respect to the financial data they connect to the Service.

9.4 California Visitors

If you are a California resident visiting from another state, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. The Company does not sell personal information and does not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to: