Privacy Policy

Effective Date: April 15, 2026  |  Last Updated: November 9, 2026

This Privacy Policy describes how Christian Hidalgo Avila, doing business as CHA Bookkeeping ("CHA Books," "we," "us," or "our"), collects, uses, stores, and shares information when you use our website and services at chabookkeeping.com (the "Service"). By using the Service you agree to the practices described here.

1. Information We Collect

We collect the following categories of information:

• Account Information: Your name, email address, and business details you provide when registering or setting up your business profile.
• Transaction and Financial Data: Sales records, expense records, invoices, and related financial information you enter into the Service.
• Payment Information: When you subscribe, payments are processed by Stripe or Square. We do not store your full credit card number. We store your Stripe Customer ID and subscription status to manage your account.
• Bank Account Data (Plaid): If you choose to connect a bank account, we use Plaid Technologies, Inc. to facilitate the connection. Plaid retrieves your bank transaction data on your behalf and provides it to us. We store your Plaid access token securely in our backend and the transaction data in your account. We do not store your bank login credentials.
• Crypto Wallet Data: If you connect a Phantom wallet, we store your verified Solana wallet address and CHA_PRO token balance information associated with your account. We do not store your private keys or seed phrase.
• Usage Data: Device type, browser type, IP address, pages visited, and general interaction data collected automatically when you use the Service.
• Communications: Messages you send us via email or the in-app feedback tool.

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To process subscription payments and manage your account status
• To import and display your bank transactions for categorization and reporting
• To verify Solana wallet ownership and process CHA_PRO token subscription payments
• To generate financial reports, receipts, and invoices within the Service
• To send transactional emails such as subscription confirmations and expiration notices
• To respond to support requests and feedback
• To comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We share data only with the following third-party service providers as necessary to operate the Service:

• Firebase / Google Cloud — database, authentication, and cloud functions hosting
• Stripe — payment processing and subscription management (Stripe Privacy Policy)
• Square — point-of-sale payment processing (Square Privacy Policy)
• Plaid — bank account connectivity (Plaid Privacy Policy)
• Helius — Solana blockchain data and webhook services
• Anthropic — AI-powered receipt scanning (receipt image data is sent to Anthropic's API for processing), the built-in STAR TRACK AI assistant on the Core, Plus, Premium and STAR BOOKS plans, daily checks, and the assistant on your own Claude API key if you add one (see section 6)
• Google (Gemini API) — the built-in STAR TRACK AI assistant without a plan, and the backup when Anthropic is unavailable (see section 6)
• Supabase — hosting for our AI service: AI usage counts, the AI memory notes and instructions you save, and the encrypted storage of your own AI API key if you add one (see section 6)

We may also disclose information if required by law, court order, or to protect the rights and safety of our users or the public.

4. Bank Data and Plaid

By connecting your bank account you authorize us to retrieve your transaction history through Plaid. Your bank credentials are entered directly into Plaid's secure interface and are never transmitted to or stored by us. You may disconnect your bank account at any time through your Account Settings, which will revoke our access. For more information on how Plaid handles your data, visit plaid.com/legal/privacy-statement.

5. Crypto Wallet Data

Connecting a Phantom wallet requires you to sign a verification message using your wallet. We store only your public wallet address and token balance information. We never have access to your private key, seed phrase, or the ability to initiate transactions on your behalf. On-chain transaction data is public by nature of the Solana blockchain.

6. The AI Assistant (STAR TRACK)

STAR TRACK's Ask AI assistant answers questions about your own money and can suggest changes to your transactions. A suggested change is applied only when you press Confirm. Ask AI follows the CHA STAR AI terms, one set for every CHA STAR app, which you agree to once, the first time you use it. In short:

• What is sent: your question and only the data it needs (such as amounts, dates, merchant names, your categories, account names and balances) go to our AI service and on to an AI model provider: Anthropic's Claude on the Core, Plus, Premium and STAR BOOKS plans, Google's Gemini without a plan or as a backup when Claude is unavailable. Never your account numbers, your bank's internal IDs, your name or your email address.
• What our AI service keeps: a link to your account (your user ID), AI usage counts (never the text), the AI memory notes and instructions you choose to save, the AI model you picked, and that you agreed to the AI terms (which version, and when). It does not keep your questions, the answers or your transactions. You can view, edit and delete your memory notes and instructions in Settings → AI.
• Daily checks: when your reminders are on, our servers check your transactions for things that may need your attention (for example a possible duplicate charge or a category running over budget). Only the items that need your attention are sent to Anthropic's Claude Haiku model to write a short summary: for each one, a description of the check, the merchant name, amount, date and category. Your account names, balances, other transactions, name and email are not sent. The results are saved in your own account, not on our AI service. When reminders are off, no checks run on a schedule.
• Notifications: push notifications on your lock screen use generic text, such as how many things there are to look at. They do not show merchants or amounts; the details are in the app.
• Your own AI key (optional, paid plans): if you add your own Anthropic (Claude) API key in Settings → AI, Ask AI uses it under your own Anthropic account's terms. Your key is encrypted and stored in Supabase Vault, never shown back (only its last 4 characters), never logged, and sent only to Anthropic. You can remove it at any time.

How Anthropic and Google handle the data they receive is in the CHA STAR AI terms.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or tax compliance purposes. Bank access tokens are revoked immediately upon account deletion or disconnection.

8. Data Security

We use industry-standard security measures including encrypted data storage, HTTPS, Firebase Authentication, and restricted access controls to protect your information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights Under CCPA (California Residents)

As a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Opt-Out of Sale: We do not sell your personal information.

To exercise any of these rights, contact us at chabooks26@gmail.com. We will respond within 45 days.

10. Cookies and Tracking

We use cookies and similar technologies for authentication and to keep you logged in. We do not use third-party advertising cookies. You can control cookie settings through your browser, but disabling cookies may affect the functionality of the Service.

11. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact:

Christian Hidalgo Avila
CHA Bookkeeping
chabooks26@gmail.com
chabookkeeping.com