Who we are

Chirp Digital ("Chirp") is a software development company that develops and licenses personal finance software for financial institutions to offer to their customers for personal finance management. Chirp puts a user's data on center stage, molding it into a cohesive, intelligible, and interactive visualization. Chirp software enables financial institutions to better utilize data and provide customers with a superior platform to manage their personal finances through data cleansing, categorization and classification. Data is sourced from the records of the financial institution with an optional software feature for users to add external accounts such as credit cards, loans, mortgages, and accounts from other financial institutions, for a user's all-inclusive financial management view.

Chirp is based in the United States and has an extensive history of providing exceptional service for key clients who are major players in their respective industries.

This Privacy Policy applies to the website or application from which you access Chirp services and/or any of its affiliated web or mobile applications ("Services"), including Chirp's account-connection widget. Your financial institution and/or its other service providers may have different privacy policies for data collected, stored or utilized outside of the Services.

When you access Chirp's Services through a bank, credit union, or other financial services provider that has engaged Chirp ("Business Client") — for example, by using Chirp's account-connection widget to link a financial account — Chirp generally acts as a service provider to that Business Client. This Privacy Policy describes Chirp's own data practices in that role; however, the Business Client's own privacy notice also applies to you, and you should review it for information about how the Business Client uses your information outside of Chirp's Services.

Definitions — Personal Data

"Personal Data" means any information relating to an identified or identifiable natural person — someone who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Personal Data does not include anonymized information, nor corporate information that relates to an organization but not to an individual (e.g. a corporate name, address, or general phone number) — unless combined with your Personal Data in a way that reasonably allows it to be associated with your identity.

Cross-border data transfers

The EU-U.S. and Swiss-U.S. Privacy Shield Frameworks were invalidated by subsequent court and regulatory decisions and are no longer a valid basis for transferring personal data from the European Union or Switzerland to the United States. Chirp's data provider instead relies on Standard Contractual Clauses (SCCs) for such transfers.

Personal data we process

We process personal data on behalf of our clients to fulfill our contractual obligations as a third-party service provider. We also process personal data obtained from our third-party service providers to aggregate data when customers choose to use these features, as well as personal data we collect directly, such as when a user navigates to our website or when we generate potential sales leads. We process the personal data of client representatives, representatives of potential clients, other business representatives, users, and client customers.

We do not actively collect or otherwise process personal data from minors. The age of a minor varies by country; for personal data collected from the European Union, a minor is under age sixteen (16). We do not actively collect or process special categories of personal data as identified under the GDPR — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation — nor data relating to criminal convictions and offences.

The personal data we process for our personal finance software is based on our contractual requirements with the client and, in turn, their requirements with their customers. We contractually require clients to obtain necessary consents from their customers before providing access to the software; without that consent, access will not be granted.

A. Data processed as a third-party provider on behalf of our clients

We process personal data of our clients' customers on behalf of our clients to perform our contractual obligations under our service agreements — analyzing financial transactions and performing advanced data cleaning, classifying and categorizing for presentation and use of that data. This analysis can extend to financial transactions from external accounts if the feature is activated by the customer. We also process customer data in aggregate form to assist clients in offering meaningful promotions such as personal loans, credit cards, and mortgages.

B. Data processed from third-party service providers

When the external-account aggregation feature is activated, we share personal data with Data Aggregator Service Providers, who share with us the financial transactions of the external account, as authorized by our clients' customers, to perform our contractual obligations. Data sourced this way is shared with our clients and also used by us on their behalf, in aggregate, to customize promotional offers. We do not separately sell personal data.

C. Data processed directly

We process technical and navigational information when you visit www.chirp.digital — IP address, geographical location, device ID, browser type, pages viewed, and length of visit — to provide site features, improve our product and services, and develop and market new offerings.

We process contact and employment-related information when you fill out web forms or download content — name, email, company name, address, phone number, and related information about you or your business or employment. We also process personal data available through social media (Facebook, LinkedIn, Twitter, Google) and other publicly available information, to advance business purposes such as offering our services to corporate representatives. We may also process payment information when you pay for certain CHIRP services.

D. Data processed through the account-connection widget

When you use Chirp's account-connection widget to link a financial account, we receive account and transaction information from your financial institution through our Data Provider (see "B. Third-party providers" under "Sharing of personal data" below), such as account balances, transaction history, account type, and related account details.

How your login credentials are handled depends on whether your financial institution supports OAuth-based authentication. For institutions that support OAuth, you authenticate directly on your financial institution's own login page, and neither Chirp nor its Data Providers receive or store your username or password — we receive only an authorization token confirming that you've granted access. For institutions that do not support OAuth, you enter your username and password directly into the connection widget, which is powered by Chirp's Data Provider; in that case, our Data Provider receives and processes those credentials directly, solely to complete the connection at your direction, and Chirp itself does not receive or store those credentials.

E. California Consumer Privacy Act

Pursuant to CCPA § 1798.110, the categories of personal information we have collected about consumers in the preceding 12 months are:

• Identifiers such as a real name, postal address, online identifier, IP address, email address
• Personal information categories described in the California Customer Records Statute (Cal. Civ. Code §1798.80(e)), including financial account information, and account login credentials in combination with a password or access code that would permit access to an account
• Characteristics of protected classifications under California or federal law
• Commercial information
• Internet or other electronic network activity information
• Geolocation data
• Professional or employment-related information
• Inferences drawn from any of the above to create a profile reflecting a consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

Tracking technologies, cookies, and clear GIFs

This section applies to cookies and tracking technologies used on www.chirp.digital. Chirp's account-connection widget does not use cookies or similar technologies for advertising. We use tracking technologies, cookies, and clear GIFs to collect information from your browser when you visit www.chirp.digital. Cookies store small text files containing a session ID and other data, enabling us to: (1) enable essential features; (2) provide analytics to improve website performance; (3) store user preferences; and (4) facilitate targeted advertising, including through third-party advertising networks. You're free to change your browser settings to prevent cookies, though some site functions may not work as a result. Cookies may also be set within emails to track how often they're opened.

Clear GIFs are transparent graphic images that let us monitor actions on a web page and, combined with cookies, understand how visitors interact with our sites — browser type, operating system, language preference, referring page, timing, and search activity. We may share this information with our employees, service providers, and customer affiliates.

Purposes for processing personal data

We process personal data to fulfil contractual obligations in our service contracts with clients and to assist clients in optimizing advanced data analytics, as well as to operate our business generally — sales leads, information services, web analysis, security monitoring, and recruitment and employment. The legal basis for our processing is either the necessity to perform contractual obligations or our legitimate business interests as a personal-finance-software provider. For cookies and other tracking technologies, we rely on the consent given via our cookie banner; we do not process that category of data if the user selects "Decline."

We may also use your data to comply with applicable laws, exercise legal rights, meet tax and regulatory requirements, and for internal purposes such as auditing, data analysis, system troubleshooting, and research, based on our legitimate interests in performing the activities of the organization.

Sharing of personal data

A. Clients

Personal data we obtain from our third-party service providers is shared with our clients where that data is obtained through use of our licensed software — for example, when a client's customer provides personal data to aggregate external-account data.

B. Third-party providers

We share personal data with third-party providers who process it on our behalf, including Customer Relations Management Software Providers, Lead-generation Service Providers, Data Analytics Service Providers, Technology Software Providers, Data Aggregator Services Providers, Accessor Service Providers, Web Analytics Service Providers, and Security Monitoring Service Providers. These providers are contractually required to protect personal data from additional processing (including marketing) and transfer in accordance with this Privacy Policy and applicable law.

C. Research bodies

For a limited number of users who provide explicit consent, we share personal data with a third party for research on financial behavior aimed at helping users monitor and improve their financial management.

D. Regulatory bodies, public authorities, and law enforcement

We may access and disclose personal data to regulatory bodies where we have a good-faith belief that doing so is required under regulation, including submitting data required by tax authorities, or in response to lawful requests by public authorities or law enforcement, including national security requirements.

E. Other disclosures

We may also disclose personal data to exercise or defend legal rights; take precautions against liability; protect the rights, property, or safety of the Company, individuals, or the public; maintain the security and integrity of our services or infrastructure; protect against fraudulent, abusive, or unlawful uses; or investigate and defend against third-party claims, including disclosures to courts, attorneys, and law enforcement.

Information you consent to share for our SMS notification service (e.g. for your approval process) is not shared with third parties or affiliates except messaging partners, for the purpose of operating that program. In cases of onward transfer of EU individuals' data received under Standard Contractual Clauses, Chirp remains liable in accordance with the applicable transfer mechanism.

F. California Consumer Privacy Act

Pursuant to CCPA § 1798.115, the categories of personal information we have disclosed about consumers for a business purpose in the preceding 12 months mirror those listed under "Personal data we process" above (identifiers, California Customer Records Statute categories, protected classifications, commercial information, internet/network activity, geolocation, professional/employment information, and derived inferences).

Storage of your personal data

Personal data is processed and stored at various locations, including servers in the United States. Where personal data is transferred outside the U.S., Chirp's Data Provider ensures adequate protections such as Standard Contractual Clauses (SCCs), and we endeavor to use U.S. third-party providers that are GDPR-compliant or otherwise provide equivalent safeguards.

Data security

We use industry-accepted standards, protocols, and precautions to protect personal data we store, transmit, or otherwise process against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, and we regularly evaluate new security technology and methods. No data transmission over the Internet can be guaranteed 100% secure, and information you transmit to us is done at your own risk. If we learn of a data breach likely to affect the security of your personal data, we may attempt to notify you electronically and/or by posting notice on our website; depending on where you live, you may have a legal right to written notice of a security breach.

Data retention

Chirp retains personal data of its clients and clients' customers for a period instructed by the relevant client. Where Chirp collects personal data for its own purposes, it retains that data for a reasonable period to fulfil the purposes described above, then archives it for periods required by law before deletion. To request deletion of your data, please contact the client who provided the source of the data — we can provide their contact information on request. We also retain personal data required to meet regulatory obligations, including tax records and transaction history, and regularly audit our databases against our retention policy.

Personal data rights

Individuals have the right to access personal data about them and to correct, amend, restrict, or delete it where inaccurate or processed in violation of applicable principles, except where the burden of providing access would be disproportionate to privacy risk, or would violate others' rights.

Marketing communications include an unsubscribe link. You may also contact us directly, or through your CHIRP representative, to exercise your rights or object to marketing communications. Because CHIRP processes personal data on behalf of clients, requests related to that processing will be forwarded to the relevant client, unless a regulatory requirement calls for a direct response.

Under the GDPR (for individuals in the European Economic Area): the right to request access to, rectification, or erasure of personal data; to restrict or object to processing; to receive a copy of personal data in a digital format; and to lodge a complaint with a local data protection authority.

Under the CCPA: the right to know what personal information is collected; whether it is sold or disclosed and to whom; to say no to the sale of information; to access personal information; to equal service and price even when exercising privacy rights; to an accurate privacy notice at or before collection; to request disclosure of categories and specific pieces of personal information collected; and to request deletion, subject to certain exceptions.

We do not sell personal information. We do share personal information collected through cookies on www.chirp.digital with third-party advertising networks for cross-context behavioral advertising, as that term is defined under the CCPA and similar state laws; we do not share information collected through Chirp's account-connection widget for this purpose. You have the right to opt out of this sharing, including via Global Privacy Control signals (see below) or by contacting us directly.

Global Privacy Control. Some browsers and browser extensions support the Global Privacy Control ("GPC") or similar signals that indicate a choice to opt out of certain data processing, such as sales or sharing for cross-context behavioral advertising. Where we detect a recognized GPC signal, we honor it as an opt-out request to the extent required by applicable law.

Dispute resolution

If you have a concern, complaint, or question about how Chirp handles your personal data, please contact us using the information in the "Contact us" section below. We aim to acknowledge and investigate complaints promptly, consistent with Chirp's Consumer Complaint Policy, and to respond within a reasonable time frame, generally within 10 business days.

If you are not satisfied with our response, you may have the right to file a complaint with a relevant regulator, such as the Federal Trade Commission, or, if you are a California resident, the California Privacy Protection Agency. This section does not create any additional rights or remedies beyond those already available to you under applicable law, and does not limit any right you may have to pursue a claim in a court of competent jurisdiction.

Effective date and amendments

This document is effective as of the date indicated at the top of this Privacy Policy under "Last updated." This document may be amended from time to time.

Contact us