Privacy Policy

1. Who we are & scope

Cecchin ("we," "us," or "our") provides a personal artificial-intelligence service that helps you understand your finances, plan toward financial freedom, and organize your day. This Privacy Policy describes how we handle your personal information when you create an account and use the Cecchin app and website.

We are based in the United States (State of Florida). For any privacy-related request, contact us at hello@cecchin.co.

2. Information you give us

When you sign up and use Cecchin, we may collect:

• Account information — your email address, used to create and secure your account (sign-in is handled by Amazon Cognito).
• The information you enter — your "rich life" goals, income, expenses, savings, and any money figures, tasks, or notes you choose to provide.
• Content you import — if you choose to import your history from another AI assistant (for example ChatGPT, Claude, or Grok), the content of that export.
• Financial account data you connect — see section 3 (Plaid).
• Google account data you connect — see section 3b (Gmail, Calendar, Tasks, Drive).
• Usage information — basic records of how you use the app, used to operate and improve the service and to enforce fair-use limits.

You are always in control: the app works with whatever you choose to share, and you can delete your data at any time (section 8).

3. Financial account information (Plaid)

If you choose to connect a bank, credit-card, or other financial account, we do so using Plaid Inc. ("Plaid"). When you connect an account through Plaid, we may receive:

• Account information (account name, type, and masked account numbers).
• Balances and transaction history (dates, amounts, descriptions, categories).
• Identity information associated with the account, where provided by the institution.

We use this financial data only to serve you, to:

• Categorize your transactions and show you where your money goes.
• Surface insights, forecasts, and "what if" analysis for your own decisions.
• Help you plan toward your goals.

Cecchin is read-only and analyze-only: we can read your account data to analyze it, but we cannot move money, make payments, or transact on your accounts. We do not sell your financial data, use it for advertising, or use it to train AI models, and we do not share it except with the service providers that run the service (bound by confidentiality), your professional advisors at your request, or as required by law.

Credentials for your financial institutions are handled by Plaid; we never receive or store your banking username or password. Plaid's handling of data is described in the Plaid End User Privacy Policy. You can disconnect an account or request deletion of the financial data we hold at any time in the app or by emailing hello@cecchin.co.

3b. Google account information (Gmail, Calendar, Tasks, Contacts, Drive)

If you choose to connect a Google account, we receive an access credential that lets Cecchin read, on your behalf:

• Recent messages in your inbox — sender, subject, date and a short preview; and the full text of a message you open in the app.
• Upcoming events on your primary calendar.
• Your task lists and their tasks.
• Your contacts — their names, email addresses, phone numbers and organisation, including the “other contacts” Gmail collects automatically from the people you email. You can create and edit a contact, and create, rename and delete a group, from the app; deleting a group removes the label only — the people in it stay in your contacts. Cecchin never deletes a contact, and never changes one on its own. A copy of this contact list is kept in your Cecchin account so the app opens instantly instead of re-reading your whole address book every time; it is encrypted, it is covered by export and delete like everything else here, and disconnecting Google deletes it.
• Names and modification dates of recently changed Drive files.

Cecchin never sends email. There is no send capability in the software at all. When you ask it to draft a reply, the draft is shown to you to edit, and saving it places it in your Gmail drafts — sending is always your own action, in Gmail. The only other things Cecchin can write to your Google account are a new calendar event, a new task, or a task's own title, notes, date or completion, and only after you ask. It can delete two things, each only when you tap Delete and then confirm, never on its own: a task, and a contact group. Deleting a group removes the label only — every person who was in it stays in your contacts. It deletes nothing else, and never edits an event or a message that already exists. Contacts: Cecchin can create a contact and edit one you already have (name, organisation, email addresses, phone numbers, and which of your groups it belongs to), and it can create, rename and delete a contact group — each on a form you fill in and save yourself. It cannot delete a contact, and it never changes a contact on its own initiative.

When you ask Cecchin about your day, your upcoming calendar entries are sent to the AI provider described in section 4 so it can answer about them; when you ask about your mail, the sender, subject, date and short preview of recent messages are sent too. The full text of a message is sent only when you open that message and ask for a draft or a summary. All of it is treated strictly as data: instructions written inside an email are never followed. Your Google data is not sold, and is not used to train anyone's models.

You can disconnect your Google account at any time in the app, which revokes the credential with Google and deletes it from our systems.

4. How your data is processed by AI

To generate your briefs, analysis, and answers, Cecchin sends the relevant parts of your information to large language models run by Anthropic through Amazon Web Services (Amazon Bedrock). This processing happens only to produce results for you. Specifically:

• Your personal and financial data is processed to serve you — never sold, and never used to train AI models.
• When Cecchin answers you in writing, your stored personal and financial data — accounts, balances, transactions, and the figures derived from them — is sent only to Anthropic, reached through Amazon Bedrock or Anthropic's own API, and not to other AI providers.
• Voice conversations are the exception. If you start a spoken conversation, that call is handled by a realtime voice model operated by another AI provider (currently OpenAI, xAI or Google), because Anthropic does not offer a realtime speech model at this time. For the duration of that call, your spoken audio and the financial figures needed to answer you are sent to that provider, under their own commitments not to train on data submitted through their business APIs. Voice is opt-in and session-based: there is no always-on microphone, each call is started by you, and we do not record or retain the audio. If you never start a voice call, this paragraph never applies to you.
• Two further features can send text to other AI providers (currently OpenAI, Google and xAI), and neither includes your stored data:
  • Compare models — an optional button. When you tap it, the question you typed is sent to several providers so their answers can be compared. Only that question text is sent.
  • Agent self-improvement — when an agent proposes a change to its own instructions, the proposed wording is sent to several providers for an independent opinion on whether to keep it. Your figures are not included.
• Where we use other AI providers for general, non-personal tasks (such as public research), your private financial and personal data is not included.

5. How we use information

We use your information only for legitimate purposes, including to:

• Provide the service and generate your analysis, briefs, and answers.
• Maintain and secure your account.
• Improve your experience and the reliability of the service.
• Comply with legal and regulatory obligations.

We do not use your information for advertising, profiling for sale, or targeted marketing. We do not sell your information.

6. How we share information

We share personal information only in limited circumstances:

• With the service providers that operate the service — Amazon Web Services (hosting, storage, and the Amazon Bedrock AI service), Anthropic (the Claude AI service, reached through Amazon Bedrock or Anthropic's own API), Amazon Cognito (sign-in), Plaid (account connections), RentCast (property value estimates — it receives the property address you provide and, where you supply them, the building's type, bedrooms, bathrooms and square footage, and only when you request an estimate; never the rest of your property record), Amazon Location Service (completing a partial address — it receives only the address text in that one box, including as you type it, so suggestions can be offered; the US Census Bureau's public geocoder is used as a fallback), and — only if you start a voice call — the realtime voice provider for that call (OpenAI, xAI or Google) — each bound by their own commitments and used only to run Cecchin.
• Back into your own connected accounts, at your request — for example the text of a draft you asked Cecchin to write is sent to Google to be saved in your Gmail drafts, and the title and time of an event you add are sent to your own calendar (section 3b). Nothing is sent anywhere on its own.
• When required by law, court order, or lawful authority request.
• With your professional advisors, at your request.

We do not sell, rent, or trade personal information.

7. Data retention

We keep your information for as long as your account is active, or as needed to provide the service, plus any period required by applicable law. When you delete your account, we delete your personal and financial data (see section 8), except where we are legally required to retain limited records.

8. Your rights & choices

You have the right to:

• Access and download a copy of the information we hold about you.
• Correct inaccurate information.
• Delete your account and your data.
• Disconnect any connected financial account.
• Withdraw consent and stop using the service at any time.

You can export or delete your data yourself in the app, or contact hello@cecchin.co and we will respond within 30 days. Depending on where you live (for example, California), you may have additional rights under local law; we honor those requests through the same contact.

9. Security

We take administrative, technical, and physical measures to protect your information, including encryption of your data at rest, keeping each customer's data separated, restricted internal access, and secure sign-in. No system is perfectly secure. If you believe your account or information has been compromised, contact us immediately at hello@cecchin.co.

10. Children

Cecchin is a financial service intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top indicates the last revision, and we will notify you of material changes.

12. Contact

For privacy questions or to exercise your rights, contact us at:

Email: hello@cecchin.co
Website: cecchin.co