Oriole Privacy Policy

Overview

This Privacy Policy explains how the Oriole retirement-planning application (“Oriole,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information. It applies to Oriole’s website and web application. Plaid has a separate privacy policy that governs Plaid’s processing when you use Plaid Link.

Information we collect

How we use information

• Provide account aggregation, spending analysis, retirement projections, exports, and related features.
• Authenticate users, maintain sessions, secure Plaid connections, and prevent misuse.
• Synchronize the financial data you authorize and keep connected-account information current.
• Operate, troubleshoot, improve, and support Oriole.
• Comply with applicable legal obligations and protect users, Oriole, and others.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and Oriole does not use third-party advertising trackers.

Your consent

When you create an Oriole account, you consent to Oriole collecting, processing, and securely storing the information you provide and the financial data you choose to connect for account aggregation and retirement-planning features. Oriole records the date of your consent and the version of this policy you accepted. Plaid Link separately lets you choose the financial institutions, accounts, and available data scopes you authorize. You may withdraw authorization for a connected institution by disconnecting it in Oriole, and you may request deletion of your Oriole account and data.

Plaid

Oriole uses Plaid to let you connect financial accounts. When you use Plaid Link, Plaid collects and processes information under Plaid’s End User Privacy Policy. You control whether to connect an account and which available accounts to share. You may disconnect a Plaid connection in Oriole.

How we disclose information

We disclose information only as needed for the following purposes:

• Service providers: Plaid for account connectivity; infrastructure and hosting providers for application and database operation; Cloudflare for DNS, routing, and access protection; and an email-delivery provider for authentication and account messages.
• Legal and safety: when reasonably necessary to comply with law, enforce agreements, investigate misuse, protect security, or protect the rights and safety of users or others.
• Business changes: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice obligations.
• At your direction: when you request or consent to a disclosure.

Service providers may process information in the United States, Germany, and other locations where they operate.

Retention and deletion

We retain account and financial information while your account is active and as needed to provide the service. Disconnecting a Plaid connection requests removal of the Plaid Item and clears the local Plaid access token. Deleting your Oriole account requests removal of active Plaid Items and deletes the household’s application records. The dedicated encrypted Oriole database backup set retains the newest 14 daily copies. Separately, encrypted shared-host disaster-recovery snapshots that may contain an Oriole database dump are retained on a rotation of 30 daily, 12 weekly, and 12 monthly snapshots. Deleted records may remain in encrypted backups until the applicable backups expire and are pruned; backups are access-restricted and are not used for ordinary business operations. Security and operational logs may be retained for up to 90 days. Limited information may be retained longer when required by law, necessary for security or dispute resolution, or converted into a form that cannot reasonably identify you.

Your choices and privacy rights

• Use manual accounts and balances instead of connecting an account through Plaid.
• Disconnect a financial institution and stop future synchronization.
• Export supported account, transaction, category, and retirement-scenario information.
• Delete your Oriole account from the application.
• Request access, correction, deletion, or a copy of personal information, subject to applicable law.

To submit a privacy request, email privacy@orioleapp.com. We may need to verify your identity before completing a request. We will not discriminate against you for exercising an applicable privacy right.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include encryption in transit, encrypted production database storage and backups, application-level encryption for Plaid access tokens, access controls, multi-factor authentication for sensitive operations, vulnerability scanning, logging, and secure-development checks. No system can guarantee absolute security.

Children

Oriole is not directed to children under 18, and we do not knowingly collect personal information from children under 18.

Changes to this policy

We may update this policy as Oriole, our vendors, or legal requirements change. We will post the updated policy here and revise the effective date. We will provide additional notice when required by law.

Contact us

Questions or requests about this policy can be sent to privacy@orioleapp.com.