Privacy Policy

Plum Violin is operated by Evercentr Digital Technologies, LLC, a Georgia limited liability company based in Atlanta, Georgia ("Evercentr," "we," "us").

This Privacy Policy explains how Evercentr collects, uses, and protects information when you use Plum Violin (the "Service"). The short version: we collect only what is needed to run a debt planning tool, we never connect to your bank, and we never sell your data.

1. Information we collect

Information you give us

• Account details: your name, email address, and a securely hashed version of your password (we cannot read the password itself). If you sign in with Google, we receive your name, email, and profile picture from Google.
• Plan data: the debts, balances, interest rates, minimum payments, due days, income, living expense categories, savings amounts, and payment records that you type into the Service.
• Files you choose to save: statement images or PDFs and payment receipts that you choose to upload to Files in your account. They are kept in our file storage, are visible only to you, and you can delete any file at any time. When you delete a file, its contents are overwritten and its listing is removed from your account immediately. Photos used only for the "fill in from a photo" feature are processed in memory and are not saved unless you separately upload them to Files.
• Grace conversations: the questions you type to Grace and her replies are stored in your account so you can continue a conversation. You can clear a conversation from the Grace panel at any time.
• Support messages: what you send us through the support form.

Information collected automatically

• Usage and device data: pages visited, features used, approximate location derived from IP address, browser and device type. We use Google Analytics for this (see section 5).
• Log data: IP address, timestamps, and error reports needed to keep the Service secure and working.
• Cookies: a session cookie to keep you signed in, a small local setting to remember dismissed banners, and Google Analytics cookies.
• Quick estimate question: after a quick estimate, you can optionally tell us what made you start looking. If you tap Send, we store only your answer, a timestamp, and the campaign tag of the link you arrived from, if any. We never store the figures you entered in the estimate. We also count how many estimates are completed, with no figures attached.

What we deliberately do not collect

• We never ask for bank or creditor logins, full account numbers, or card numbers. The Service has no bank connections and cannot move money.
• Membership payments are handled by Stripe. Your card details go directly to Stripe; we receive only a customer reference, plan status, and the last four digits and brand of your card for display.

2. How we use information

• To provide the Service: store your plan, run the payoff calculations, and show your progress.
• To manage your account and membership, including free-trial status and billing through Stripe.
• To send transactional emails: a welcome note, password resets, trial reminders (around 48 hours before, the day of, and the day after your trial ends), optional payment-due reminders (you can turn these off in Account & billing), a note when a debt is paid off or a month is closed, billing and cancellation confirmations, and replies to your support requests. We do not send marketing email unless you separately opt in.
• If you ask for the Sound Check Worksheet on our book-reader page, we store your email address to send you the worksheet links and occasional Plum Violin tips, sent via Resend. You can unsubscribe anytime from any of those emails.
• To power the optional AI features described in section 4a.
• To understand how the Service is used and improve it, using aggregated analytics.
• To keep the Service secure, prevent abuse, and comply with law.

We do not sell your personal information, share it with data brokers, or show advertising.

3. Legal bases

Where laws such as the GDPR apply, we process your information to perform our contract with you (providing the Service), for our legitimate interests (security, analytics, improving the Service), with your consent where required (analytics cookies), and to meet legal obligations.

4. Who we share information with

We share information only with service providers who help us run Plum Violin, under agreements that limit their use of it:

• Stripe – payment processing and subscription billing.
• Emergent – application hosting, database, file storage for the files you save, Google sign-in handling, and the gateway through which AI requests and transactional email are sent.
• OpenAI – the AI model behind Grace, the plan explainer, and statement reading (see section 4a).
• Resend – transactional email delivery.
• Google – Google sign-in (if you choose it) and Google Analytics.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy will continue to apply to your information).

4a. AI features (Grace, plan explainer, statement reading)

These features are optional and only run when you use them. They never produce a payment schedule of their own; they explain the plan our calculator already produced.

• What is sent: for Grace and the plan explainer, your plan figures (debt nicknames, balances, rates, minimums, budget amounts, and forecast results) and the message you type. For statement reading, the statement text you paste or the photo you take.
• Who processes it: OpenAI's API, reached through Emergent's integration gateway. Your email address and password are not sent. Before statement text is sent we remove 16-digit card-number patterns we detect, and the model is instructed not to return account numbers, names, or addresses; a photo may still contain such details, so review before you use this feature.
• Storage on our side: statement photos are processed in memory and discarded after the response; the extracted figures are shown to you for confirmation and saved only if you choose to save the debt. Grace conversations and cached explanations are stored in your account until you clear them or delete your account.
• Storage at the provider: requests are subject to OpenAI's API data policies and Emergent's gateway policies. We do not use your data to train models and have not enabled any training option. We cannot independently audit provider-side retention; if that matters to you, use manual entry instead of statement reading and skip Grace.
• Analytics: AI requests and their content are never sent to Google Analytics.

5. Analytics and cookies

Analytics tools load only after you choose "Allow analytics" in the cookie banner. If you choose "Essential only", or make no choice, no analytics script runs and no analytics cookie or browser storage is created. You can change your choice any time with the "Cookies" link at the bottom of every page; switching to "Essential only" stops these tools and deletes their cookies and storage.

• Essential sign-in cookie. Keeps you signed in (named access_token and refresh_token, or session_token if you sign in with Google). It is set only when you sign in, holds no plan figures, and is always on because the Service cannot work without it. We also remember your cookie choice itself in your browser's storage.
• Google Analytics (only after "Allow analytics"). Counts visits and pages viewed in aggregate. It sets cookies and may collect your IP address (anonymized where available), device and browser type. We never send your plan figures or email address to Google. You can also use the Google Analytics opt-out browser add-on.
• PostHog (only after "Allow analytics"). Product analytics, served through our hosting provider, Emergent. It records page views and clicks with page text masked, plus device, browser and approximate location from your IP address, and stores an anonymous ID in a cookie and browser storage. Session recording is turned off.
• Meta Pixel (only after "Allow analytics"). Analytics includes Facebook advertising measurement: it tells us when someone who saw our Facebook ad visits, starts a trial or becomes a member, and it never receives your name, email or plan figures.

The Crescendo video on our home page is hosted on our own site and loads only when you press play. It sets no cookies.

6. Data retention

• Your account and plan data are kept while your account exists. When you delete your account from Account & billing, we immediately delete your profile, plan, payment history, Grace conversations, cached explanations, and saved files from our live systems, and cancel any active subscription first. If the subscription cannot be cancelled at that moment, the deletion is not performed and you are told so, rather than reported as done. Copies in our hosting provider's infrastructure backups expire on the provider's schedule; we do not restore deleted accounts from them.
• Billing records held by Stripe are retained as required for tax and accounting purposes (generally 7 years).
• Support messages are kept for up to 2 years so we can follow up.
• Server logs are kept for up to 90 days.
• Transactional email delivery records (recipient, subject, delivery status) are kept by the email provider according to its retention policy.

7. Your rights and choices

• Access and portability: export your full plan at any time from Account & billing.
• Correction: edit any of your figures directly in the Service, or update your name in your account.
• Deletion: delete your account yourself from Account & billing, or ask us through the support form.
• Email: transactional emails are part of providing the Service. Payment-due reminders can be turned off in Account & billing; the remaining account emails stop when you delete your account.
• Regional rights: if you are in the EU/UK, California, or another jurisdiction with privacy laws, you may have additional rights (for example to object to or restrict processing, or to lodge a complaint with a supervisory authority). We honor these requests regardless of where you live. We do not "sell" or "share" personal information as defined by the California Consumer Privacy Act.

To exercise any right, use the support form. We will respond within 30 days and may need to verify your identity first.

8. Security

We protect your information with encryption in transit (HTTPS), hashed passwords, secure httpOnly session cookies, access controls, and hosting on infrastructure that is monitored and updated. No method of transmission or storage is completely secure, so please use a strong, unique password. If we learn of a breach affecting your data, we will notify you as required by law.

9. Children

The Service is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

10. International users

We are based in the United States and process information there. If you use the Service from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

11. Changes to this policy

We may update this policy as the Service evolves. We will post the new version here with a new effective date and, for material changes, notify you by email or in the Service.

12. Contact us

Evercentr Digital Technologies, LLC
10 Glenlake Parkway, Suite 130 #1010, Atlanta, GA 30328, United States
Privacy questions and requests: support form (choose the "Privacy or data request" topic)