Privacy Policy

Overview

This Privacy policy describes how Residual Genius LLC ("we") collects, uses, and protects information when you use Residual Genius (the "Service"). We are incorporated in Florida with our principal place of business at 101 N J St, Suite 2, Lake Worth Beach, FL.

Information We Collect

• Account Data: name, email, organization name, role, authentication identifiers (via Supabase Auth).
• Financial and Operational Data You Upload: residual reports, Schedule A documents, merchant identifiers, reconciliation results, and related metadata.
• Payment Data: billing status and subscription identifiers processed by Stripe. We do not store full payment card numbers.
• Usage Data: logs, device and browser type, IP address, and product analytics (when enabled). See Analytics below.

How We Use Information

• Provide, secure, and improve the Service, including AI-assisted parsing and reconciliation.
• Authenticate users and enforce organization-level access controls.
• Process payments and manage subscriptions.
• Communicate about audits, account status, mediation cases, and support.
• Comply with law and protect against fraud or abuse.
• Prepare pseudonymized internal facts and k-anonymized aggregate outputs only under the controls described below.

Organization Isolation

Customer Data is isolated per organization ("tenant"). Users within your organization see only data tied to your org_id unless you are a platform administrator with explicit cross-org access. We use organization-scoped queries, role-based permissions, and database row-level security on configured tables so one customer cannot access another customer's uploads, reconciliation rows, or Schedule A materials. We do not use your identifiable organization data to train general-purpose models offered to other customers. The optional data-intelligence layer described below is not active in production today.

Pseudonymized Internal Data and Aggregated Outputs

If this optional layer is activated after legal and operational review, we may prepare internal facts with direct business names, merchant identifiers, and account numbers removed. Those facts retain restricted provenance and organization pseudonyms so we can enforce deletion and data-quality controls. We therefore treat them as pseudonymized, not anonymous.

Aggregate outputs combine qualifying facts across multiple organizations and must pass a minimum cohort rule before use. The internal layer and any commercial output remain disabled in production pending counsel review, documented data rights, and operational approval.

We do not sell, license, or share your identifiable financial data, residual reports, Schedule A materials, or merchant-level records with third parties for their own marketing or commercial purposes. Any future benchmark or data-product use would be limited to approved aggregate outputs and remain subject to this policy and applicable law.

AI Processing

Residual and Schedule A files may be sent to third-party AI providers (for example, Anthropic) to extract structure and reconcile line items. We configure processing to minimize unnecessary data retention by providers per their enterprise or API terms. Do not upload data you are not authorized to share with subprocessors.

Storage and Subprocessors

Primary infrastructure includes:

• Supabase: authentication, PostgreSQL database, and file storage for uploads (United States).
• Vercel: application hosting and serverless functions.
• Anthropic: optional AI-assisted parsing and reconciliation when enabled.
• Stripe: payment processing for subscriptions and usage billing.
• Resend: transactional email notifications when enabled.

A current subprocessor list and data processing addendum is available on request at info@cardsmart.io.

Retention

Successfully processed upload objects are scheduled for removal after an audit finishes. Failed or interrupted upload objects may be retained while your account is active to support diagnosis and retry. Derived audit records are retained while your account is active and as needed to provide the Service. You may request organization deletion subject to legal and backup constraints. Backup copies may persist for a limited period after deletion while systems rotate.

Account and Organization Deletion

You may request deletion of your organization and associated Customer Data by emailing info@cardsmart.io. After we verify your identity, a platform administrator runs our deletion workflow for your organization only. Regular agents cannot delete another organization's data.

When deletion completes, we remove:

• Residual uploads and stored files for your organization
• Reconciliation results, uploads, merchants, portfolios, and Schedule A materials
• Mediation cases, agreements, and related communications
• Learning signals, intelligence feedback, and org-scoped analytics tied to your account
• Pseudonymized internal fact rows keyed to your organization pseudonym
• Your organization record and member login accounts

We may retain the following after deletion:

• Backup Copies: encrypted database and storage backups until rotation (typically up to 35 days on Supabase-managed infrastructure).
• Legal and Billing Records: Stripe subscription and invoice history where law or payment-network rules require retention (not your residual file contents).
• Security Audit Trail: platform audit_log entries are anonymized (org_id and actor identifiers removed) with a final deletion record, not erased. The completed workflow receipt keeps only a random job ID, timestamps, status, and aggregate counts. Privacy-minimized global security observations are not organization/account-linked and expire on fixed schedules (up to 90 days); public-link attempt windows are scheduled for physical erasure once older than 24 hours.
• Cross-Org Aggregates: k-anonymized statistics in data_intelligence that cannot be attributed to a single organization once aggregated.

Analytics

We may collect privacy-respecting product events (for example, signup completed, audit submitted) without embedding personally identifiable information in event payloads. Analytics are flag-gated and disabled by default until configured. We do not use third-party advertising cookies in the product today.

Your Rights

Depending on jurisdiction, you may have rights to access, correct, delete, or export personal information. Contact info@cardsmart.io. We respond to access, correction, deletion, and portability requests per applicable law.

Changes

We may update this policy. Material changes will be posted with an updated date. Continued use after changes constitutes acceptance where permitted by law.

Contact

Residual Genius LLC, 101 N J St, Suite 2, Lake Worth Beach, FL
info@cardsmart.io · 610-731-4637