Proppy Privacy Policy

5.1 What Plaid Does

When you connect your financial account, you will be prompted to authenticate with your financial institution through Plaid. By connecting your account, you direct Plaid to access and share certain financial account information with Forge Wealth Group Ltd, as operator of Proppy, for the purposes described in this Privacy Policy. Plaid's End User Privacy Policy applies to Plaid's collection and use of your information: https://plaid.com/legal/#end-user-privacy-policy. You should review Plaid's End User Privacy Policy before connecting your financial account.

5.2 What Bank Data Proppy Receives

Proppy uses Plaid for transaction import only. When you connect a bank account through Plaid, Proppy may receive:

• • Institution name
• • Account name
• • Account type
• • Account currency
• • Last four digits or account mask
• • Transaction history
• • Transaction amount
• • Transaction date
• • Merchant or transaction description
• • Transaction category information
• • Bank connection status

5.3 What Proppy Does Not Receive

Proppy does not receive or store:

• • Your bank login credentials
• • Your full bank account number
• • Your routing number
• • Payment initiation credentials
• • Social Security numbers
• • Credit scores

Your bank login credentials are entered through Plaid and are never stored by Proppy.

5.4 Read-Only Access

Proppy's bank connection is read-only. Proppy cannot:

• • Move money
• • Initiate payments
• • Make transfers
• • Withdraw funds
• • Deposit funds
• • Trade on your behalf
• • Change your bank account

5.5 Imported Transactions Are Separate Until Confirmed

Raw imported bank transactions are kept separate from your confirmed Proppy ledger. Imported transactions do not affect your dashboard totals, True Net Profit, reports, tax estimates, or Tax Pack exports unless and until you review and confirm them.

5.6 Disconnecting Your Bank

You can disconnect a connected bank account in Proppy. When you disconnect a bank account:

• • Proppy stops syncing new transactions from that connection.
• • Proppy revokes its connection authorization with Plaid where supported.
• • Confirmed ledger entries you previously approved may remain in your Proppy records unless you delete them or request account deletion.
• • Unconfirmed raw imports associated with the disconnected bank may be deleted or no longer synced.
• • Receipts, notes, classifications, and reports created from confirmed ledger entries may remain as part of your user records unless deleted under this policy.

Phone MFA by SMS may be required before connecting, reconnecting, or disconnecting banks. US users may also be able to manage certain Plaid connections through Plaid Portal: https://my.plaid.com

6.1 Account and Profile Data

• • Email address
• • Password authentication information handled securely by our authentication provider
• • Optional full name
• • Optional country
• • Home currency preference
• • US state or state code for tax estimate settings
• • Firm names
• • Account names
• • Transaction details you manually enter, including dates, amounts, categories, notes, and merchants
• • Subscription status, such as free or pro

We do not store plaintext passwords.

6.2 Financial and Transaction Data

• • Manual payouts entered by you
• • Manual prop firm costs entered by you
• • Receipt attachments uploaded by you
• • Bank connection metadata, such as institution name and connection status
• • Bank account metadata, such as account name, last four digits or mask, type, and currency
• • Raw bank transaction imports
• • Transaction amount, date, merchant, description, and category information
• • AI-suggested transaction classifications
• • User-created merchant classification rules
• • Tax settings, such as set-aside percentage, tax mode, state selection, and other income flags

Receipt attachments may include image files or PDFs.

6.3 Authentication and Security Data

• • Login and session information
• • Phone number for SMS MFA, where required for bank-linking actions
• • Device and session information used for security, fraud prevention, rate limiting, and account protection
• • IP address and request timestamps
• • Security event records

6.4 Device Permissions and Device Data

Depending on your choices and device settings, Proppy may request access to:

• • Camera, to attach receipts to transactions
• • Photo library, to upload receipt attachments
• • Push notifications, to send optional reminders and import-ready alerts
• • Location while using the app, only to detect a US state for tax estimate settings

Location use is limited. GPS coordinates are processed on-device and are not stored or transmitted by Proppy. If you confirm the detected state, Proppy saves only the resolved two-letter US state code. Proppy does not use continuous background location tracking.

6.5 Technical and Diagnostic Data

• • Device type
• • Operating system version
• • App version
• • Crash and error information
• • App preferences, such as theme and dashboard layout

We use this information to identify bugs, improve reliability, protect accounts, and maintain the service.

6.6 Subscription and Payment Data

In-app purchases are processed by Apple App Store or Google Play. Proppy may receive subscription entitlement information, such as:

• • Subscription tier
• • Product ID
• • Expiry date
• • Entitlement status

Proppy does not collect or store full payment card numbers.

9.1 What AI Does

AI may suggest whether an imported transaction appears to be, for example, a payout, prop firm fee, platform fee, subscription, or other category.

9.2 What AI Does Not Do

• • Automatically change your confirmed ledger
• • Automatically change your tax exports
• • Make financial decisions for you
• • Provide tax advice
• • Provide accounting advice
• • File taxes
• • Replace professional review

You must confirm an imported transaction before it affects your ledger, totals, reports, or exports.

9.3 Data Minimisation for AI

When AI classification is used, Proppy sends only the limited transaction details reasonably needed to suggest a category. This may include merchant name, transaction description, amount, currency, date, category hints, and similar transaction patterns. We do not send bank login credentials, full bank account numbers, routing numbers, or payment card numbers to AI classification providers.

9.4 AI Audit Logs

We may retain AI classification records for quality, debugging, compliance, abuse prevention, and service improvement. AI audit logs are generally retained for 12 months, unless a longer period is reasonably needed to investigate security, fraud, abuse, technical issues, legal requests, or disputes.

10.1 Service Providers

We use trusted service providers to help operate Proppy. These providers may process personal information only as needed to provide services to us. Service providers may support:

• • Bank account connection and transaction import
• • App hosting and data storage
• • Authentication and account security
• • Receipt and file storage
• • Crash, diagnostic, and error monitoring
• • Subscription and entitlement management
• • AI transaction classification
• • Customer support
• • App distribution and in-app purchases

10.2 Plaid

If you connect a bank account, Proppy uses Plaid to help connect your financial account and receive transaction information. Plaid may process information under its own privacy policy. Plaid's End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy

10.3 Apple and Google

Apple and Google process app distribution, device platform, and in-app purchase information according to their own terms and privacy policies. Proppy does not receive or store your full payment card number.

10.4 Legal Compliance and Protection

We may share information where we believe it is reasonably necessary to:

• • Comply with applicable law, regulation, legal process, or government request
• • Enforce our Terms of Service
• • Protect the rights, property, or safety of Forge Wealth Group Ltd, Proppy, users, or others
• • Detect, prevent, or investigate fraud, abuse, security incidents, or technical issues

10.5 Business Transfers

If Forge Wealth Group Ltd is involved in a merger, acquisition, financing, reorganisation, sale of assets, insolvency, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and legal protections.

11.1 Active Accounts

We retain account information while your account remains active, including your profile, ledger, transactions, receipts, bank connection metadata, confirmed imports, classification rules, subscription status, app preferences, and support records.

11.2 Account Deletion

You may request account deletion by emailing support@forgewealth.co.uk with the subject line "Privacy Request." After we verify your request, we aim to delete your account and associated personal information within 30 days, unless we need to retain limited information for security, fraud prevention, dispute resolution, legal compliance, or other purposes permitted by law.

11.3 Receipts and Attachments

Receipt attachments are deleted with the related transaction or account, subject to the same retention policy and any legal exceptions.

11.4 Bank Disconnect

When you disconnect a bank account:

• • New transaction syncing stops.
• • Proppy revokes its connection authorization with Plaid where supported.
• • Confirmed ledger entries may remain as user-created records.
• • Unconfirmed raw imports may be deleted or no longer synced.
• • You may delete confirmed entries or request account deletion.

11.5 Diagnostic Logs

Crash, error, and diagnostic logs are generally retained for 90 days, unless longer retention is needed to investigate security, fraud, abuse, technical issues, legal requests, or disputes.

11.6 Export Files

Tax Pack export links are designed to be short-lived. Export files are not intended to be permanently stored by Proppy unless required for technical delivery, troubleshooting, security, fraud prevention, legal compliance, or other purposes permitted by law. If you download an export to your own device or cloud storage, that copy is outside Proppy's control.

11.7 Legal and Tax Records

Proppy provides record-keeping and exports only. You are responsible for retaining records needed for your own tax, accounting, legal, or reporting obligations. Proppy does not intentionally retain confirmed user tax or ledger records after verified account deletion, except where limited retention is necessary for security, fraud prevention, dispute resolution, legal compliance, or other purposes permitted by law.

15.1 Categories of Personal Information Collected

In the last 12 months, we may have collected the following categories of personal information:

We do not collect bank login credentials, full bank account numbers, routing numbers, Social Security numbers, or credit scores.

15.2 Purposes

• • App functionality
• • Account management
• • Bank transaction import if you choose to connect Plaid
• • Ledger and dashboard features
• • Tax Pack exports
• • Subscription management
• • Security and fraud prevention
• • Customer support
• • Diagnostics and debugging
• • AI classification suggestions
• • Legal compliance

15.3 Sale and Sharing

• • We do not sell personal information.
• • We do not share personal information for cross-context behavioural advertising.
• • We do not use financial data for third-party advertising.

15.4 Sensitive Personal Information

We do not use or disclose sensitive personal information to infer characteristics or for purposes other than providing Proppy, securing the service, processing transactions you request, complying with law, and other permitted purposes.

15.5 California Rights

California residents may have the right to:

• • Know what personal information we collect, use, disclose, sell, or share
• • Access personal information
• • Delete personal information
• • Correct inaccurate personal information
• • Opt out of sale or sharing
• • Limit certain uses of sensitive personal information
• • Not be discriminated against for exercising rights
• • Use an authorised agent

To exercise rights, email support@forgewealth.co.uk with the subject line "Privacy Request." We may verify your identity before responding. If an authorised agent submits a request, we may require proof of authorisation and verification of the user's identity.

17.1 Data Linked to the User

• • Contact information, such as email address and phone number for MFA
• • Financial information, such as manual transactions, bank transaction imports, bank account metadata, payouts, and costs
• • User content, such as receipts, notes, firm names, account names, and transaction records
• • Identifiers, such as push token and device/session identifiers
• • Purchases, such as subscription entitlement status
• • Usage and diagnostics, such as crash/error reports and app version

17.2 Data Uses

• • App functionality
• • Account management
• • Bank import functionality
• • Record-keeping and exports
• • Subscription management
• • Security and fraud prevention
• • Diagnostics and debugging
• • AI classification suggestions
• • Customer support

17.3 Data Not Used For

• • Third-party advertising
• • Data broker sale
• • Cross-app advertising tracking
• • Sale of personal information
• • Moving money, initiating payments, or making transfers

17.4 Tracking

Proppy does not use cross-app tracking for advertising. Confirm this against the production build and third-party SDK settings before App Store submission.