IronVest Privacy Policy

Account & Service Data

• •Email address (optional for some features) – to forward Masked Emails and send communications
• •Name, phone, address (optional) – for account functionality and auto-fill features
• •Payment information – processed by our payment partners, we don't store credit card numbers
• •Bank account verification (if you choose to connect a bank account) – a verification provider (such as Plaid) may process bank account details and login information as needed to complete verification
• •Biometric data (Premium users) – processed by Anonybit for identity verification

Email Communications Data

We use Customer.io for ALL email delivery, which automatically collects when you interact with our emails:

• •IP addresses and estimated geolocation
• •Device and browser information
• •Email click behavior and timestamps
• •Email engagement metrics

Your Control: Copy and paste email links instead of clicking to avoid this tracking.

Device & Usage Data

• •Website analytics – via Matomo to improve our site experience
• •Form interaction data – anonymized data about forms you use (not linked to your account)
• •Mobile app data – device tokens and app usage for push notifications via Customer.io
• •Installation metrics – anonymous data about app downloads and versions
• •Browser extension telemetry (optional) – limited, de-identified form and feature interaction telemetry to improve form detection and autofill performance; you can control this in product settings where available

InboxGuard Data

• •We process only the data needed to provide InboxGuard's security features (such as detecting phishing and securing email content).
• •We do not use Google user data for advertising or profiling.
• •We do not use Google user data to train AI models unrelated to InboxGuard's security features.

Encrypted Data (We Cannot Access)

• •Your master password
• •Your login credentials and passwords
• •Your browsing activity and personal accounts
• •Masked Email/Phone/Card data (encrypted with 256-bit AES encryption)

Data Collected by the Extension

Data Storage: Local vs. Cloud

• •Free users: All sensitive data (passwords, masked identities, payment info) is stored locally on your device only, encrypted with AES-256. No data is sent to or stored on IronVest servers.
• •Premium users: Encrypted data is synced to IronVest's secure cloud servers to enable cross-device access. Data remains encrypted in transit and at rest — IronVest cannot decrypt your vault.
• •Security analysis data (screenshots, navigation, page content, installed extensions): Processed locally or in real-time only. This data is never stored on our servers, never logged, and never shared with third parties.

User Consent & Controls

• •Autofill: You choose which credentials and data to save. The extension only fills forms when you initiate it.
• •AI features: Disabled by default. You must opt in to enable AI-powered security analysis.
• •Telemetry: Optional and can be disabled in extension settings.
• •Data deletion: You can delete all locally stored data by removing the extension. For cloud-synced data, contact privacy@ironvest.com.

Categories of Third Parties We Share With:

• •Email service providers (Customer.io)
• •Payment processors (Stripe, Galileo)
• •Telecommunications providers (Twilio, Bandwidth)
• •Biometric authentication services (Anonybit, Coresight)
• •Fraud prevention services (LexisNexis, Stripe)
• •Customer support tools (Groove, MightyCall)
• •AI processing services (AWS Bedrock - only when you use optional AI features)

Detailed Third-Party Partners

Types of Emails We Send

• •Transactional emails – Verification codes, password resets, security alerts (cannot opt out)
• •Important announcements – Critical service updates (cannot opt out)
• •Marketing emails – Newsletters, promotions (can opt out anytime)

Email Link Tracking

When you click links in our emails, Customer.io automatically collects:

• •IP address and geolocation data
• •Device information (browser, OS, device model)
• •Click timestamps and behavior patterns
• •Email client information

To avoid tracking: Copy and paste email links instead of clicking them.

Your Email Controls

• •Unsubscribe from marketing emails anytime
• •Essential emails (security alerts, verification codes) will continue
• •Contact privacy@ironvest.com to adjust preferences

Security Measures

• •Industry-standard 256-bit AES encryption
• •Secure servers and encrypted data transmission
• •PCI-DSS compliant payment processing
• •Regular security assessments

Data Retention

• •Active accounts: Data retained while you use IronVest
• •Closed accounts: Data deleted within 3 years
• •Biometric data: Deleted when purpose fulfilled or within 3 years
• •Financial data: Retained as required by PCI and banking regulations
• •AI interactions: Not stored (processed in real-time only)

All Users

• •Access: Get copies of your data
• •Delete: Request data deletion (subject to legal requirements)
• •Correct: Fix inaccurate information
• •Contact: privacy@ironvest.com

California Residents (CCPA)

• •Know what data we collect and why
• •Opt out of data sales (we don't sell data)
• •Equal service regardless of privacy choices

Colorado Residents (CPA)

• •Right to data portability
• •Opt out of targeted advertising and profiling
• •Appeal declined requests

Nevada Residents

You may opt out of the sale of your personal information by emailing privacy@ironvest.com (we do not sell personal information).

European Users (GDPR)

• •Data processing based on contract, legitimate interests, consent (where required), and legal obligations, depending on the context
• •Right to object to processing
• •Data Protection Officer available

Children's Privacy

IronVest is not intended for users under 18. We don't knowingly collect children's data.

International Data Transfers

We transfer data internationally using appropriate safeguards like EU Standard Contractual Clauses.

Third-Party Links

Our Sites may link to third-party websites. Their privacy practices are governed by their own privacy policies, not ours.

Law Enforcement

We only provide information under valid court orders and will notify you if legally permitted. We disclose only the information we are legally required to provide.