1Account Privacy Policy Vol.1

Information you provide

Registration and contact information includes your name and the email address you use to register. We collect a telephone number or mailing address when needed for an enabled feature. Account security information includes authentication records, recovery settings, and consent history. Do not use your Social Security number as a password or send passwords through support messages.

Bill information includes the biller name, account reference, amount due, due date, and payment history you provide or authorize us to receive. An uploaded statement may also contain a service address or other household details. Remove unrelated information before uploading. We do not need every page of a document when a smaller extract will serve the same purpose.

When live payments are enabled, payment information may include funding-account identifiers, payment tokens, routing information, authorization records, transaction references, and settlement status. The connection screen must identify the applicable provider and requested access. A provider may receive information directly that 1Account does not receive.

Verification and sensitive information

An enabled verification process may require a date of birth, government identification, or a tax identifier. We request sensitive information only through the designated secure flow when necessary for a disclosed purpose. We do not collect it merely because it may become useful later. Providers may return a verification result rather than a copy of the underlying document.

Bills can reveal sensitive circumstances. A hospital bill may identify a healthcare relationship. A toll statement may reveal travel locations. We restrict these details to the payment or support purpose for which they are needed. Do not upload clinical records, call histories, or viewing histories unless a specifically disclosed feature genuinely requires them.

Information collected through use

Technical records may include IP address, browser type, device identifiers, timestamps, and security events. We collect interaction records needed to understand errors or suspected misuse. Optional voice or chat features can process the content you intentionally submit. Recording, transcription, or access to a microphone requires the notice and permission appropriate to that feature. We do not collect device biometric templates merely because you use a device passkey. Any separate biometric collection requires its own assessment and notice.

We receive information from you, your device, authorized account connections, payment providers, billers, and verification providers. We may receive relevant fraud reports from affected institutions or individuals. We do not acquire unrestricted access to unrelated accounts. New categories or materially different purposes require updated disclosures and any legally required consent before collection.

Providing and improving the service

We use relevant information to create your account, display authorized bills, schedule requested payments, and provide transaction records. We also use it to answer support requests and investigate payment errors. We retain evidence of instructions and authorizations so transactions can be explained and reconciled.

Security uses include verifying access, assessing transaction risk, detecting account takeover, and protecting users or staff from threats. Legal uses include meeting applicable recordkeeping duties and responding to valid legal process. We use information to establish or defend claims only where lawful and reasonably necessary.

Product analysis should use aggregated or deidentified information where practical. If we deidentify personal information, we take reasonable measures to prevent identification and require recipients not to reidentify it except as legally permitted for testing the deidentification process. Removing a name alone does not necessarily make a record anonymous.

Cookies and communications

Essential cookies or similar storage support authentication and security. Disabling them may prevent a feature from working. Optional analytics must be identified in the applicable collection notice and preference controls. We do not place advertising pixels on authenticated payment pages or include bill-account identifiers in analytics events.

Our policy is not to sell personal information or share it for cross-context behavioral advertising. We do not use sensitive bill details for advertising. Paid biller placement must be labeled. It does not authorize disclosure of your private bill history.

You may unsubscribe from promotional emails through their unsubscribe link. Necessary account notices and security communications may continue. Text-message marketing requires any separate consent required by law. We honor legally required opt-out preference signals, including Global Privacy Control where applicable. We do not separately act on legacy Do Not Track signals. These statements must match deployed controls.

AI assistance and automated review

If an AI assistant is enabled, its feature notice will explain what content goes to the provider and how it is retained. We do not permit identifiable financial records or support conversations to train a provider’s general-purpose model without a separate lawful basis and any required opt-in. Do not enter passwords or one-time codes into chat.

AI output may be inaccurate. A suggestion does not authorize a payment. Automated risk tools may flag a transaction for review. You may contact us about a restriction or inaccurate information. Any legally required explanation, human review, or appeal remains available.

Disclosures needed for requested services

We disclose relevant information to payment processors, financial institutions, and networks involved in your requested transaction. The information can include the payer identity, biller reference, amount, and authorization evidence. Billers may receive information needed to identify your account and apply your payment. We do not send your entire bill portfolio to a biller merely because you pay one of its bills.

Providers supporting hosting, authentication, customer support, or security may process information on our behalf. We require contracts appropriate to their role, including confidentiality and restrictions on use. A bank or biller may independently retain information under its own legal duties. Calling an entity a service provider does not determine its legal status.

An authorized household delegate receives only the access you grant through a supported feature. Knowing your address or sharing your last name is not sufficient authorization. We verify authority before disclosing another person’s records. Do not submit information about someone else unless you have the necessary authority.

Sensitive bill categories

For telecommunications bills, we seek the account and billing details needed for the requested service. Customer Proprietary Network Information, or CPNI, is subject to special protections in the telecommunications context. Paying a phone bill does not by itself make 1Account a carrier or transfer a carrier’s permissions to us. Access to protected records requires the authority and restrictions applicable to that connection.

For utility bills, authorized access to billing information does not authorize unrestricted access to detailed meter usage. For streaming subscriptions, payment processing does not require entertainment viewing history. For toll bills, we limit use of vehicle or trip information to what is necessary for account matching, payment, or a requested dispute. Additional sector-specific restrictions apply where legally relevant.

Medical billing information receives restricted access. Its presence does not establish that every 1Account activity is covered by HIPAA. We evaluate the actual relationship and required agreements before operating a regulated healthcare integration. Credit reporting requires separate disclosures and a lawful basis. This policy does not itself authorize a credit inquiry or furnishing of payment history.

Other permitted disclosures

We may make limited disclosures to professional advisers under confidentiality duties. A potential business transfer permits necessary due diligence subject to safeguards. A successor must handle transferred data consistently with applicable law and the commitments governing it. Legal and fraud-related disclosures are described on page 5. Any other optional disclosure requires an appropriate notice and legal basis.

A provider’s policy governs its independent practices. We remain responsible for our own conduct and any duties the law places on us when selecting or using providers. Naming an industry example does not imply affiliation or live integration.

Safeguards and access

Our security program must be appropriate to the information we handle. We require encryption for sensitive information in transit and at rest, subject to any legally permitted documented alternative. Access must follow least privilege. Staff access to customer information must use multifactor authentication or a legally permitted documented alternative. We review access and remove it when responsibilities end.

We require secure development practices, vulnerability management, and incident response procedures. Provider oversight includes review of the safeguards relevant to its role. Access logs support investigation of misuse. We do not promise perfect security or describe unverified certifications as achieved. A security incident does not eliminate our legal obligations.

Retention and deletion

We retain account information while needed to provide your service. After closure, we delete or deidentify information when no longer reasonably needed, subject to legal requirements. Transaction records and authorization evidence are retained for applicable payment, accounting, tax, dispute, or regulatory periods. Verification records are kept only for their documented verification or legal purpose.

Security logs and support records follow purpose-specific schedules. Legal holds can suspend deletion of relevant records. Backup copies may remain until the applicable rotation period ends. Retained backup information is restricted and is not restored for unrelated use. We do not retain every category indefinitely.

Detecting and reporting suspected fraud

We investigate credible indicators of fraud. An automated flag is not proof of wrongdoing. Where permitted, we may request verification or restrict an affected feature while reviewing a risk. Any payment hold or cancellation must follow applicable law and the governing payment terms. Users may contact support about errors or restrictions.

We will report suspected fraud when reporting is legally required. We will also refer credible evidence to the appropriate payment partner or law-enforcement authority when lawful and reasonably warranted. This may include the FBI Internet Crime Complaint Center at ic3.gov. We preserve relevant evidence and limit disclosures to information reasonably necessary for the purpose. No report guarantees investigation or recovery.

We evaluate legal demands for validity and scope. We notify affected users when appropriate unless prohibited by law or a legitimate investigation restriction. We do not disclose the existence or contents of confidential suspicious activity reports where disclosure is prohibited. Reporting duties depend on the regulated role actually performed.

Incident response

We investigate suspected breaches and take proportionate containment steps. We notify affected people, partners, or authorities as required by applicable law. Notification timing depends on the governing requirements and permitted delays. Report suspected compromise promptly through the verified contact on page 7. Also notify your funding institution where appropriate.

Rights that may apply

Depending on your residence and the law’s coverage, you may request access to personal information, a portable copy, correction of inaccuracies, or deletion. You may also have rights to opt out of sale, sharing for cross-context advertising, targeted advertising, or certain profiling. Some laws provide a right to limit qualifying uses of sensitive information. We apply the rights required for your circumstances.

For California residents, covered information may include identifiers, customer-record information, commercial and financial records, internet activity, approximate location, communications, and sensitive information described on page 2. Collection is feature-dependent. Business disclosures follow page 4. Retention follows page 5.

CCPA coverage depends on statutory thresholds and applicable exemptions. A financial-information exemption is not automatically a company-wide exemption. Where a separate financial privacy notice is legally required, we provide it and explain applicable sharing choices. We do not describe ordinary payment processing as an unrestricted sale of your information.

How to make a request

Use [Insert working privacy request URL] or email [Insert monitored privacy email]. State the right you wish to exercise and provide enough information for us to locate the account. We may ask you to verify identity using a method proportionate to the sensitivity of the request. We do not require you to create an account solely to submit a request.

Do not send a full Social Security number, bank password, or one-time code by email. An authorized agent may submit a request where permitted. We may require proof of authority and identity verification consistent with law. Opt-out requests must not be burdened with verification that the law does not permit.

We follow the deadline applicable to your request. For covered California requests to know, delete, or correct, the usual response period is 45 calendar days. A permitted extension requires timely notice and an explanation. Other requests may have shorter deadlines. We explain a denial unless prohibited. Where an appeal right applies, use the same privacy contact and identify the decision you wish to appeal.

Limits and safeguards

A deletion request may not remove records needed to complete an authorized transaction, prevent fraud, comply with law, or address a legal claim. Any exception must satisfy applicable law and remain limited to its purpose. We protect other people’s rights when responding. We do not disclose credentials or information that would create an unreasonable security risk.

We do not unlawfully discriminate or retaliate against you for exercising privacy rights. You may complain to the California Privacy Protection Agency, your state attorney general, or another competent regulator without first waiving a claim or accepting arbitration under this policy.

Oversight and staff responsibilities

1Account management is responsible for implementing this policy. Personnel may access personal information only for authorized work. Confidentiality obligations continue after employment or engagement ends. We investigate misuse and apply appropriate corrective action. Staff and LLC member information used in an employment or ownership relationship is covered by separate notices where required.

We protect staff from harassment and credible safety threats through lawful security measures. Ownership of the company does not create unrestricted access to user records. Internal exceptions must be documented and lawful. We review this policy at least annually and when material practices change.

Children and processing locations

The service is intended for people aged 18 or older. We do not knowingly collect personal information from children under 13. Contact us if a child has submitted information so we can investigate and take required action. An adult’s authority to pay a household bill does not authorize unnecessary collection about children.

Information may be processed in the United States or other locations used by approved providers. Access from abroad does not waive local rights. Expansion into another jurisdiction requires assessment of its laws and any necessary supplemental notice.

Legal effect and boundaries

Applicable federal law and applicable state law govern our information practices. Company policies operate within those laws. This notice does not create a general investment-adviser, trustee, or fiduciary relationship. It does not eliminate a duty arising from law or an actual agreement. 1Account is not a bank. This policy does not promise FDIC insurance or coverage against fraud or platform failure.

Limitations of liability and dispute terms belong in a separate enforceable agreement. This policy provides no blanket immunity for 1Account, its members, or its staff. Nothing here waives statutory privacy remedies or applicable unauthorized-transfer protections. A user’s security mistake does not increase liability beyond what governing law permits.

Updates and contact

We post revisions with a new effective date. We give additional notice of material changes where required. We obtain consent when law requires it. Continued use alone is not substituted for legally required consent to a new purpose. Previous data remains subject to applicable restrictions.

Privacy requests and security concerns: [Insert monitored privacy email]. Request form: [Insert working privacy request URL]. Mail: 1Account LLC, Attention Privacy, [Insert business mailing address]. We can provide an accessible version on request.