Privacy Policy

Last updated: November 15, 2026

Plenarax is a personal finance app operated by Drivetrain LLC, a Wyoming limited liability company ("Drivetrain", "we", "us"). This policy explains what information we collect when you use Plenarax at plenarax.com and portal.beamrayapps.com (together, the "Service"), how we use it, who we share it with, and the choices you have.

Information we collect

Account information. Your email address and the password you choose. Passwords are handled by our authentication provider and are never visible to us.
Financial information you connect. When you link a bank or card account, we receive information from that institution through Plaid Inc. ("Plaid"): account names and types, the last digits of account numbers, balances, and transaction details such as date, amount, merchant and category.
Connection tokens. Plaid gives us a token for each connection so the Service can refresh your transactions. Tokens are stored on our servers only and are never sent to your browser.
Payment information. If you buy a subscription, your payment is processed by Stripe, Inc. We receive the status of your subscription and limited details such as the card brand and last four digits; we do not receive or store your full card number.
Technical information. Basic logs our hosting providers create when you use the Service (such as IP address, browser type and the time of a request), and the cookies needed to keep you signed in.

What we do not collect

We never see or store your online banking username or password. You enter those directly with your bank or with Plaid, not with us.

How bank connections work (Plaid)

We use Plaid to connect to your financial institutions. By linking an account you authorize Plaid to collect your financial information from your institution and share it with us, as described in the Plaid End User Privacy Policy. You can disconnect an account at any time in the Service, and you can also manage the connections Plaid holds for you at my.plaid.com.

How we use your information

To provide the Service: showing your accounts and transactions in one place and pointing out recurring charges.
To keep your data current by refreshing transactions from the institutions you connected.
To run your account and subscription, and to send service messages such as security notices, receipts and reconnection reminders.
To keep the Service secure, prevent abuse and fix problems.
To meet legal obligations.

We do not sell your personal information, we do not share it for advertising, and we do not use your financial data to target ads.

Who we share it with

We share information only with service providers that help us run the Service, and only as needed for that purpose:

Plaid: bank and card account connections.
Supabase: database and sign-in. Your data is stored on Supabase servers in Canada (Montreal).
Vercel and Cloudflare: hosting and secure delivery of the website and app.
Stripe: subscription payments.

We may also disclose information if required by law, to protect the rights, safety or property of our users or others, or as part of a merger or sale of the business, in which case this policy will continue to apply to your information.

How we protect it

All traffic to the Service is encrypted in transit (HTTPS), and data is encrypted at rest by our database provider.
Database access rules ensure each user can reach only their own records.
Bank connection tokens are readable only by our servers.
Administrative accounts used to operate the Service are protected with multi-factor authentication.

No system is perfectly secure, but we work to protect your information and will notify you as required by law if a breach affects it.

How long we keep it

We keep your information while your account is open. If you delete your account, we disconnect your linked institutions through Plaid and delete your account and financial data from our active systems within 30 days. Limited records may be kept longer where the law requires it (for example, payment records for tax purposes), and copies may persist in encrypted backups for a short period until they are overwritten.

Your choices and rights

Disconnect any linked account at any time.
Ask for a copy of your data, a correction, or deletion of your account by emailing [email protected].
Depending on where you live (for example, California), you may have additional rights to know, delete or correct personal information. We honor these requests and will not treat you differently for making them.

Children

The Service is intended for adults. You must be at least 18 years old to use it, and we do not knowingly collect information from children.

Changes to this policy

If we make material changes, we will update the date above and notify you by email or in the Service before the changes take effect.

Contact

Drivetrain LLC, operator of Plenarax
Email: [email protected]