How Renew Reminder protects your data

Connecting a bank is optional, and when you do it, we are not in the room. The sign-in screen belongs to Plaid, the service that connects thousands of financial apps to banks and credit unions. You enter your credentials there, Plaid verifies them with your bank, and what comes back to us is a token, not a password.

• The token is read-only. We request one Plaid product: transactions. It lets us read accounts and transaction history. It cannot move money, pay a bill, or change anything at your bank.
• The token is encrypted at rest. We store it as AES-256-GCM ciphertext under a key that lives in the deployment environment, not in the database, so a copy of the database alone cannot use it. If that key is ever missing, new bank links are refused rather than stored unencrypted.
• The token never leaves our servers. It is stripped from every API response, from your data export, and from what our own admin tools display.
• Disconnecting revokes it. Remove a bank from the Accounts screen and we tell Plaid to invalidate the token. Delete your account and the same happens automatically.

Why Plaid and not our own connection? Because bank credentials are the one thing a small team should never hold. Plaid's entire business is holding them safely; ours is reminding you before you get charged.

Every connection between your device and Renew Reminder (the apps, the web app, this website and the public API on the Business plans) is encrypted with TLS, the same standard your bank uses. Our servers do not accept unencrypted connections.

At rest, your data lives in a managed database service, which encrypts everything it stores with 256-bit AES. Passwords are never stored at all: we keep a bcrypt hash, a one-way transformation that lets us check a password without being able to read it. Tokens for a connected bank or Google account are encrypted again, with AES-256-GCM, before they are stored.

• Verified email at sign-up. An account is not active until you enter the code we send to your address, so no one can register with an email they do not control.
• Rate limits on every sensitive door. Sign-in, registration, verification codes and password resets are all throttled, which turns a guessing attack into a very slow one.
• Single-use, expiring reset links. A password reset link works once and only for a short window.
• Sessions that expire. Sign-in tokens are time-limited. “Remember me” extends the window; it does not make it permanent.
• An email when a new device signs in. A sign-in from a device or browser your account has not used before gets an email with the device, the time, the approximate location (worked out on our own server, not by a third party) and the IP address, plus a one-tap route to securing the account.
• Changing your password ends every other session. Sessions that were signed in before the change are refused from that moment, on every device. If someone is in your account, this is how you get them out.
• Every request checks ownership. Your subscriptions, transactions, alerts and conversations are looked up by your account, never by an ID someone could guess.

This is where we differ most from other finance apps, so we will be precise. Many free money apps pay for themselves by selling insight from your transactions, showing you ads, or steering you towards financial products they are paid to recommend. Renew Reminder does none of these. Your plan is our only revenue.

• We do not sell your personal or financial data. To anyone. Ever.
• We do not share it with advertisers, data brokers, marketing partners or “affiliates”. There are no ads in the app.
• We do not use it to recommend financial products, and we take no payment from any merchant for listing them.
• We do not use your data to train AI models, and we do not let anyone else.

What we do use is a small set of service providers to run the product: Plaid for bank connections, Stripe, Apple and Google for billing, and providers for email, text messages, push notifications and AI. Each processes data only on our instructions and only for the job we hired it for. Each kind of provider is described, with what it handles and where, on our sub-processors page and in our Privacy Policy, and we send the full list, with names, on request. If that list ever grows, it changes first.

Trust is easier when leaving is easy. Everything below is a button in the app, not a request to support.

• Disconnect a bank from the Accounts screen. Our access at Plaid is revoked immediately.
• Export your data from Settings as a PDF you keep: your subscriptions and bills, the transactions we hold and your linked accounts. In the web app you can also select rows in your list and export them as a CSV file.
• Delete conversations with Remi individually, at any time.
• Hide amounts across the app when you are somewhere you would rather not show your spending.
• Delete your account from Settings in the app or on the web, or via our account deletion page. It removes your data from our live systems and revokes your bank connection.

Security is mostly unglamorous habits. These are ours.

• Least privilege. We ask third parties for the narrowest access that does the job: one Plaid product, one calendar of your choosing, and nothing we would have to explain.
• Ownership enforced on the server. The apps never decide what you may see; the server does, on every request, and administrative access is verified the same way.
• Separate spaces. Your personal space and each company workspace share nothing. Your personal subscriptions never show up in a workspace, and a workspace's vendors never show up in your personal space.
• Small blast radius. Bank connections are optional, so someone who never links a bank has no bank data with us at all. A default that limits what we hold is worth more than any policy.

Linking a bank account or card is optional everywhere in Renew Reminder. Without one, you add subscriptions and vendors yourself, import a statement or a spreadsheet, or forward bills by email.

• Plaid only, read-only. Bank links go through Plaid and nothing else. The link reads balances and transactions; it cannot pay, transfer or change anything.
• The US and Canada only. Plaid connects banks in the US and Canada for Renew Reminder. Banks elsewhere cannot be linked; tracking by hand works anywhere.
• Personal: Premium. On a personal account, bank linking is part of Premium, for up to 5 bank accounts. The free plan has no bank connection.
• Business: Admins link. In a workspace, only an Admin can link a bank account or card. Each one is one of the workspace's connections (bank, card or AWS): Business Starter includes 3 and Business includes 10; more cost $9 a connection a month, on a paid plan only.

In a business workspace

The connection stays with the person who linked it. If they leave the workspace, or the workspace is deleted, the accounts and their transactions go back to that person's personal space. If a free trial ends without a plan, bank and card connections linked to the workspace may be disconnected at the end of a calendar month, at least seven days after we email the Admin who handles billing. The transactions already imported are kept.

About Plaid

Plaid's own handling of your data is described in its End User Privacy Policy, and you can see and manage every app you have connected through it at my.plaid.com.

When your company uses Renew Reminder, you trust us with your vendor list, what you pay, who owns each contract, the contract documents you attach and, if you choose, a read-only view of a bank account or card. This part of the page is for whoever reviews that decision. Everything above, about sign-in, encryption and Plaid, applies to workspaces too. Workspaces run in the web app.

What a workspace stores

• Your team: the names, email addresses and roles of the people in the workspace and the people invited to it. Phone numbers only for Admins who turn on text-message alerts.
• Owner tags: the name of the person responsible for a vendor and, if you add it, their email address, whether reminders to them are on, whether they have unsubscribed, and their Keep or Cancel answers.
• Vendors: each vendor's name, cost and currency, billing cycle, renewal date, notice period, category, contract details, owner and notes, the decisions recorded on it (renew, renegotiate or cancel) with who decided and when, any vendor contacts you add, and the contract PDFs you attach.
• Bank and card data, only if an Admin links one: account names, types and balances, and transactions (merchant, amount and date).
• AWS cost data, only if an Admin connects AWS: the AWS account ID, the read-only role Renew Reminder may use and its external ID (encrypted), and AWS's figures: costs by service and by day, AWS's forecast, its savings recommendations and the alerts sent. We never hold AWS keys. Disconnecting removes the role details; the cost history stays until an Admin deletes it.
• What you choose to add: the rows of a spreadsheet you import (the file itself is read in your browser and never sent to us), receipts and documents you scan, and messages to Remi, our AI assistant.
• What we send: which reminders, escalations and spend reports went out, to whom, by which channel and when.
• Billing: your plan and invoices. Stripe holds your card details, and we never see the full card number.

We never store your bank login or your full card number. Please don't put health data, government ID numbers or other sensitive personal data in a workspace. It isn't built for them.

A workspace has two roles, Admin and Member. One Admin, the Admin who handles billing (shown as “Admin · Billing”), holds the plan: the person who created the workspace, or the person it was handed over to.

A Member can also be set to view only: they see what a Member sees and can download the PDF, but they cannot add, edit or decide anything. Anyone can leave a workspace at any time, except the Admin who handles billing, who hands it over or deletes it first.

Who sees which vendors

Admins choose one of two settings for the vendor list:

• Everyone sees every vendor (the default). Every member sees the whole list. Members edit the vendors they own.
• Members see their own. Members see only the vendors they own. Admins still see everything.

Owner tags are labels, not logins

An owner tag names the person responsible for a vendor, such as a manager in another team. A tagged person has no login and sees nothing inside Renew Reminder. They get renewal emails only when reminders are turned on for them on that vendor (a spreadsheet import never turns them on), they can answer Keep or Cancel from the email, and every email has a one-click unsubscribe link. Emails to owner tags stop while a workspace is read-only.

How it is enforced

Our server checks every request against the person's active membership of that workspace and their role in it. The app never decides on its own what someone may see. Asking for a workspace you are not in gets the same refusal whether it exists or not, so workspace IDs reveal nothing. A company workspace and each person's own personal space are kept apart: nothing in one shows up in the other.

At Renew Reminder, only the people who need access to provide support, keep the service secure or fix problems can reach your data, and they are bound by confidentiality. Our admin tools never show bank tokens.

• Database: a managed database service, in Germany (Frankfurt). It encrypts everything it stores with 256-bit AES.
• Servers: our API, the web app and this website run on servers hosted in France (European Union).
• Contract documents and attached images: a private storage bucket with our file storage provider, which places them automatically; no region is set. Nothing in it has a public link: a file opens only through a link our API signs, which expires within minutes.
• Service providers: some of the providers we use, such as Stripe, Plaid and our AI providers, process data in the United States. Each kind, with what it handles and where, is on our sub-processors page, and the full list, with names, is available on request.

For transfers out of the European Economic Area, the United Kingdom or Switzerland, our Data Processing Addendum includes the EU standard contractual clauses, with the UK addendum and the changes Swiss law requires.

Every request takes the same path: from your device to our API, and from our API to our database. Other providers are called only by our API, and only when a feature needs them.

Renew Reminder uses AI only when someone uses an AI feature: asking Remi, our assistant; reading a receipt, document or statement you upload; reading a contract PDF attached to a vendor, where a person confirms what it found before anything is saved; and finding bills in email you forward or a Gmail account you connect. Nothing is sent for features you don't use.

• What is sent. The message, file or email being read, and the subscription or vendor details that request needs. Never a bank login (we don't have one) or a bank token.
• One AI model provider, for most requests. Remi and the readers for uploads, statements and contracts run on its models. It keeps requests for no more than 30 days, except where it needs them to enforce its usage policies, and does not use them to train its models.
• A routing service, for the rest. Reading bills in email goes through the routing service only to AI model providers that keep nothing, running the same models. Voice input uses a speech-to-text model, Remi's memory uses an embedding model, and a model from another provider is the fallback when the main one is unavailable. The routing service also carries requests that the main provider cannot take directly. Every request tells the routing service to use only providers that do not train on the data, and free models, which may, are never used.
• Not for training. We do not use your data to train AI models, and we do not let anyone else.
• What we keep. Conversations with Remi are stored so it can recall earlier context; you can delete any of them. To look into a wrong answer, we also keep the text of most AI requests and their answers for 30 days (never images or audio), with card numbers, bank account numbers, ID numbers, email addresses and phone numbers masked first. In a workspace, an Admin can turn this off under AI privacy in the workspace's settings, and the copies already kept are deleted.

Taking your data out

• A full export, for Admins. From the vendor list, an Admin can export every vendor (active, ending and cancelled) with every field, as a CSV file that imports straight back into Renew Reminder, and download every contract PDF as one ZIP file with a folder for each vendor. A very large set of documents is downloaded vendor by vendor instead. Both work even when the workspace is read-only.
• For everyone. Any member can download a PDF of the vendors they can see, and select rows in the list to export them as a CSV file.
• In another format. Email us and we will send a copy of your workspace data in another commonly used format.

Deleting

• Vendors. While the workspace has a plan or a free trial running, Admins can delete vendors, and restore one deleted by mistake.
• Someone leaves or is removed. The vendors they looked after stay in the workspace. Their own bank accounts and transactions go back to their personal space.
• Deleting the workspace. Only the Admin who handles billing can do it. Its plan stops renewing (it stays paid to the end of the period already paid for) and everyone loses access at once. Bank accounts and cards go back to the people who linked them; nothing else is moved into anyone's personal space. For 30 days the workspace is kept out of sight, and the Admin who handles billing can restore it with everything in it.
• After 30 days. We delete the workspace and what it held: its vendor records, with their history, owner tags and contract documents; the activity on those records and any images attached to it; its conversations with Remi; its budgets, categories, statement imports and unsubscribe list; its API keys; its member list and invitations; and the log of reminders and reports we sent for it. Two records are kept longer: a log of each AI request and contract download, with no content in it (400 days), and the journal of changes to its records (one year).
• When a trial or plan ends. The workspace becomes read-only until the Admin who handles billing chooses a plan. Nothing is deleted. Members can still be removed, vendors moved out, data exported and the workspace deleted.
• A person's own account. Anyone can delete their own account in Settings. That removes their data from our live systems and revokes their bank connections. If they hold a workspace's plan, a workspace with no other members is deleted with the account at once; one with other members must be handed over or deleted first.

You can also ask us in writing to delete data at any time, and we delete it within 30 days. Copies kept by our sub-processors under their own retention, such as email delivery logs, are deleted on their normal cycle, and copies in our database backups are removed as those backups expire, within four weeks. Section 11 of the Data Processing Addendum sets out these commitments in full.

If something goes wrong

If a security incident affects your workspace's personal data, we tell its Admins by email without undue delay, with what we know at the time, and add details as we learn them. We will help you meet your own duty to tell regulators and the people affected. If a breach affects a personal account, we tell that person directly and promptly, and notify regulators where the law requires it.

To report an incident or a vulnerability, write to support@renewreminder.com with “Security” in the subject line. How we handle reports is below.

Questionnaires

We answer a reasonable written security or privacy questionnaire once a year, as section 12 of the Data Processing Addendum says. Send it to support@renewreminder.com.

Documents

• Data Processing Addendum: covers the personal data your company puts into a workspace. Email us if you need a signed copy.
• Sub-processors: the kinds of provider we use. The full list is available on request, and we email every workspace's Admins at least 30 days before a new one starts handling workspace data.
• Terms of Service and Privacy Policy.
• Our security contact details, in /.well-known/security.txt.

Who we are

Renew Reminder is operated by Onda Software Solutions LLC, 83 Chuparrosa Dr, San Luis Obispo, CA 93401-7411, USA, the party to our Terms and Data Processing Addendum. Our contact for security and data protection is support@renewreminder.com.

We are a small team, and we would rather tell you where the edges are than let you find them. Today there is:

• No SOC 2 report or other third-party certification or audit. What we have instead is a product designed to hold as little as possible: no bank credentials, no card numbers, no ad profiles.
• No two-factor sign-in. It is on our list.
• No single sign-on through a company identity provider (SAML), and no automatic user provisioning (SCIM). Sign in with Google is available.
• No Business view in the iPhone and Android apps. Workspaces run in the web app, which also works in a phone's browser, and renewal emails reach owners anywhere.
• No uptime guarantee (SLA) and no public status page. Our Terms provide the service as it is and as available.
• No choice of region. Every account and workspace is stored in the same place, described above.
• No bug bounty. We answer every report personally, and we will not pursue anyone who reports in good faith.

Found something? Email support@renewreminder.com with “Security” in the subject line and as much detail as you can: steps to reproduce, the account or endpoint involved, and what you think the impact is. A person reads every report, and you will hear back within two working days.

Responsible disclosure

Please give us a reasonable time to fix an issue before publishing it, do not access or modify data that is not yours, and stop as soon as you have confirmed a problem. In return we will not pursue legal action against research conducted in good faith under these guidelines, and we will credit you when the fix ships if you would like us to.