Privacy Policy

Effective Date: August 18th , 2026

1. Introduction

Veru 365, LLC (“Veru365,” “Company,” “we,” “us,” or “our”) operates a white-label, AI-powered financial engagement platform made available to individuals (“you,” “End Users”) through financial institutions and advisory firms that license our platform (each, a “Partner Firm”). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use the Veru365 platform, including our website and Progressive Web Application (together, the “Service”). Please read this Policy carefully. If you disagree with its terms, please discontinue use of the Service.

Because our Service is distributed to you by a Partner Firm, please also review any privacy notice provided directly by your Partner Firm, which may describe how that firm independently uses your information outside the Service.

2. Information We Collect

We collect the following categories of information, directly from you, automatically through your use of the Service, and from the third parties described below. The collection, processing, and retention of information by third parties are governed by their own privacy policies and practices, and they act as independent service providers responsible for their own compliance with applicable privacy laws with respect to that collection.

2.1 Account and Identity Information. We collect your name, email address, phone number, and profile photo when you register or sign in, including through Auth0 (Okta), our identity and access management provider, and if you sign in with a Google account, we receive basic profile claims (email address, email verification status, name, and profile picture, where provided).

2.2 Identity Verification Information. Where advisory features require know-your-customer verification, our vendor Persona collects a government-issued identification document image and a selfie and returns a verification result to us, and we store only that verification result (verified name, date of birth, and inquiry reference), without retaining the identification document image or selfie ourselves.

2.3 Financial Account Data. If you connect bank or brokerage accounts, we collect account identifiers, balances, transaction history, and related financial information through Plaid, based on your authorization, and Plaid access tokens are encrypted before storage and are never stored in plaintext.

2.4 Financial Profile Information. We collect your date of birth, home address, employment status and employer name, investment holdings, cost basis and purchase history, insurance details, real property information, retirement account information, and life events, whether provided directly by you or extracted from documents you upload.

2.5 Tax Information. We collect tax return details, including filing status, wages, interest, dividends, capital gains, retirement and Social Security income, business and rental income, adjusted gross income, deductions, credits, and refund or amount owed, whether you type this information in or we extract it from an uploaded tax return.

2.6 Beneficiary and Household Member Information. Where you provide information about beneficiaries or household members for estate or household planning purposes, we collect their name, relationship to you, date of birth, allocation, and special needs indicator, where applicable, and Section 12 (Information About Other Individuals) describes how we handle this category.

2.7 Uploaded Documents. We collect the documents you upload to our secure document vault (for example, tax returns and financial statements) and the data we extract from them, which may include full account numbers and Social Security numbers, and we use automated tools to detect and redact sensitive fields where technically feasible.

2.8 Conversation Data. We collect the chat messages you exchange with our AI assistant, conversation summaries, assistant memory, and feedback you provide on assistant responses, including a copy of the rated message.

2.9 Calendar Data (Optional). If you connect Google Calendar or another similar calendar service, we access it on a read-only basis to log appointments and calls as client activity, reading event titles, times, and attendees without creating, editing, or deleting calendar events, and calendar tokens are encrypted and deleted upon disconnection.

2.10 CRM and Communications Data. Where your Partner Firm connects its customer relationship management (CRM) system (e.g., Wealthbox, Salesforce, or HubSpot), phone system (RingCentral), or calendar to the Service, client records and activity may flow between that system and ours, including your name, email address, phone number, account summaries, and activity history.

2.11 Technical and Usage Information. We automatically collect your IP address, browser and device information, login frequency, session length, features used, profile completion, and last-active timestamps, and we also maintain consent and disclosure records (what was agreed, when, and from which IP address and browser) as evidence of consent.

2.12 Cookies and Similar Technologies. See Section 6 below.

3. How We Use Your Information

We use your information to:

• Provide, operate, and personalize the Service, including AI-generated financial analysis and educational content tailored to your profile;
• Generate aggregate product analytics, such as feature adoption and engagement;
• Populate your financial profile and auto-fill forms using data extracted from uploaded documents;
• Deliver the AI assistant and maintain a record of your interactions for continuity and, where you use advisory features, as part of the advisory record;
• Calculate and display your financial readiness score;
• Communicate with you by email (e.g. via SendGrid) and SMS (e.g. via Twilio) for account verification, security notices, service updates, and, where you have opted in, product marketing from Veru365;
• Calculate a financial readiness score and similar derived metrics from your financial and behavioral data, which is shown to you and, where applicable, your advisor.
• Synchronize your information with your Partner Firm’s CRM, phone, or calendar systems where your Partner Firm has connected those systems;
• Monitor, diagnose, and resolve errors and performance issues (e.g., Sentry);
• Improve the quality and accuracy of AI-generated responses, including by reviewing feedback you submit;
• Detect, investigate, and prevent fraud, unauthorized access, and misuse of the Service;
• Comply with legal and regulatory recordkeeping obligations described in Section 7; and
• Enforce our Terms of Service and protect the rights, property, and safety of Veru365, our users, and others.

We do not use your information to display third-party advertising, and we do not permit third parties to use data collected through the Service to advertise to you. We do not sell your personal information.

4. Third-Party Service Providers

We engage the following categories of service providers to operate the Service. The collection, processing, and retention of information by third parties are governed by their own privacy policies and practices, and they act as independent service providers responsible for their own compliance with applicable privacy laws with respect to that collection.

• Identity and Access: Auth0 (Okta) – authentication and sign-in.
• Financial Connectivity: Plaid – bank and brokerage account linking, balances, and transactions.
• Identity Verification: Persona – identity document and selfie verification; we receive only the verification result.
• Cloud Infrastructure: Google Cloud Platform – application hosting (Cloud Run), database (Cloud SQL), document storage (Cloud Storage, with customer-managed encryption keys), key management (Cloud KMS, Secret Manager), and logging.
• Artificial Intelligence Providers: Anthropic (Claude) and OpenAI – AI model inference on chat message content and the financial context assembled into prompts; OpenAI additionally provides text embeddings on document text. Google Vertex AI – AI model inference on chat message content and prompt context. Google Cloud Document AI and Vision – optical character recognition and data extraction from uploaded documents, including tax returns, account statements, and identification documents. Google Cloud DLP – automated detection and redaction of personal information in documents and messages. Google Cloud Text-to-Speech – voice output of assistant responses.[1] 
• Communications: Twilio and SendGrid – SMS, voice, and email delivery, including message content and delivery metadata.
• Error Monitoring: Sentry – crash and error reporting, which can include IP address, page URL, and your account identifier.
• CRM and Practice Management (connected at your Partner Firm’s option): Wealthbox, Salesforce, HubSpot – client name, email, phone number, account summaries, and activity. RingCentral – phone number and call/message metadata. Google Calendar – meeting times, titles, and attendees.
• Marketing Website: WP Engine and Cloudflare – website hosting and content delivery. Google Analytics – IP address, pages viewed, referrer, device, and approximate location for visitors to our marketing website only (not the application).

5. Sharing With Your Partner Firm

Unlike the service providers listed in Section 4, your Partner Firm is not acting on our instructions when it uses your information – it uses your information for its own purposes, including advisory services and its own marketing.

5.1 Baseline Access: Anonymized Score Only. By default, your Partner Firm’s authorized personnel (such as your financial advisor) can see only an anonymized view of your account, consisting of your financial readiness score and the anonymized profile and asset categories underlying that score. Your name, email address, phone number, and other identifying details are not visible to your Partner Firm at this baseline level, and your Partner Firm’s personnel cannot contact you directly unless you opt in as described in Section 5.2.

5.2 Opt-In Sharing: Identifying Information and Advisor Contact. If you choose to opt in, your name, email address, phone number, and other identifying details become visible to your Partner Firm’s authorized personnel in the Service’s administrative tools, lead records, and conversation history, and your Partner Firm’s personnel may contact you directly by phone or email, including to provide financial advisory services and to discuss the Partner Firm’s own products and services. This sharing is off by default, requires your affirmative consent, and is not required to use the core Service. We record the timestamp, IP address, and browser used when you provide or withdraw this consent. You may withdraw this consent at any time in Settings or by contacting support@veru365.com, and we will stop this additional sharing going forward; when disabled, your identifying information is encrypted and replaced with anonymized identifiers, consistent with Section 5.1.

5.3 Your AI-Generated Summary. We generate an AI-assisted summary of information you have shared with the Service so that you do not need to repeat your circumstances when you meet with your advisor. This summary is generated regardless of whether you have opted in under Section 5.2. If you have not opted in, any version of the summary made available to your Partner Firm excludes your name, contact information, and other identifying details, consistent with the anonymized baseline described in Section 5.1. If you opt in under Section 5.2, the summary made available to your Partner Firm may include your financial profile, goals, and topics discussed with the AI assistant together with your identifying information. You may decline to generate or share a summary at all; declining will not prevent you from using the core Service, but your advisor will not have the benefit of the summary before your meeting.[2] 

6. Cookies and Tracking Technologies

6.1 Application Cookies. The Service sets two first-party cookies: current_org_slug, which identifies which organization (Partner Firm) you are currently working in, and has_orgs, which records whether you belong to any organization for routing purposes. Neither is used for analytics or advertising. Both are persistent and expire after 365 days, though they are required for the Service to function correctly. Our identity provider, Auth0, also sets a session cookie governed by its own session policy.

6.2 Other Tracking Mechanisms. We use session and share tokens (authentication tokens, chat session identifiers, and expiring share links for documents, plans, and portfolios), a pseudonymous identifier that links pre-signup activity to your account once created, and, if you opt in, web push subscription identifiers to deliver browser notifications. We also maintain first-party behavioral analytics within the Service (login frequency, session length, feature usage, plan edits, profile completion, and last-active timestamps) to operate and improve the Service; this is not cross-site tracking.

6.3 Marketing Website Cookies. Our separate marketing website (not the application) uses a consent management tool that sets a preference cookie (wpconsent_preferences, 30-day duration) and, only after you accept marketing cookies, embeds YouTube video and Google Analytics, which collect IP address, pages viewed, referrer, device and browser information, and approximate location. Google Analytics cookies follow Google’s default retention periods.

6.4 Do Not Track. The Service does not currently respond to “Do Not Track” browser signals.

7. Data Retention

We retain personal information for as long as necessary to provide the Service and to comply with applicable legal and contractual obligations.

7.1 Retention Tied to Partner Firm Requirements. Because the Service supports regulated financial advisory activity conducted by Partner Firms, certain records – including financial and account data, conversation records relevant to the advisory relationship, and related communications – are retained for the periods specified by each Partner Firm under the data processing agreement between Veru365 and that Partner Firm, reflecting the recordkeeping obligations applicable to that Partner Firm’s own regulatory status. Retention periods may therefore differ across Partner Firms and are not independently determined by Veru365.

7.2 Deletion Requests. You may request access to, correction of, or deletion of your personal information at any time through Settings or by contacting support@veru365.com. Where you request deletion, non-regulatory personal information (such as profile details, tax profiles, uploaded documents, and preferences) is deleted within 30 days of a verified request. Where information is subject to a Partner Firm’s retention requirements described in Section 7.1, we will remove directly identifying details (such as your name, email address, and other identifiers) from those records within 30 days of a verified request, and retain the remaining anonymized record only for the period specified by the applicable Partner Firm. Records already committed to immutable audit logs or archives required by a Partner Firm cannot be altered or deleted before the applicable retention period expires.

7.3 Marketing Website Analytics. Marketing website analytics data is retained according to Google Analytics’ standard retention settings.

8. Data Storage and Security

Your data is processed and stored on Google Cloud Platform infrastructure located in the United States. We implement technical safeguards including: encryption in transit using TLS 1.2 or higher; encryption at rest, including field-level encryption on designated sensitive columns; separate encryption for third-party credentials such as Plaid access tokens and connected CRM/calendar tokens; customer-managed encryption keys for documents in cloud storage; row-level security enforced at the database level so that one Partner Firm cannot access another Partner Firm’s data; secrets stored in a dedicated secrets manager rather than in source code, with automated scanning on every code change; immutable archival of records subject to a Partner Firm’s retention requirements, which are locked against modification; and audit logging of access to personal information.

Administratively, we apply least-privilege access controls, require multi-factor authentication for all personnel, conduct background and identity verification checks on employees, require mandatory code review and automated security scanning before any change reaches production, and maintain separate staging and production environments so that production data is not used for testing.

As of the effective date of this Policy, a limited number of authorized personnel have access to production systems containing personal information, consistent with the principle of least privilege described above.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your information using industry-standard safeguards and to notifying affected individuals, consistent with applicable law, in the event of a security incident affecting personal information.

9. Your Privacy Rights

Depending on your state of residence, you may have some or all of the following rights regarding your personal information: the right to know or access the categories and specific pieces of personal information we have collected, the sources of that information, and the purposes for which it is used; the right to request correction of inaccurate information; the right to request deletion, subject to the retention obligations described in Section 7; and the right to data portability, where technically feasible. We do not sell personal information for monetary consideration.

To exercise any of these rights, contact us at support@veru365.com. We will respond to verified requests within the time periods required by applicable law.

9.1 California Residents. If you are a California resident, you have the rights described above under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to non-discrimination for exercising your privacy rights. We will not deny you goods or services, charge you different prices, or provide a different level of service because you exercised a CCPA right. As of the effective date of this Policy, Veru365 does not meet the applicable statutory thresholds that would require a “Do Not Sell or Share My Personal Information” mechanism, and this Policy will be updated if that changes.

10. Identity Verification and Biometric Information

Our identity verification vendor, Persona, processes a government-issued identification document and a selfie as part of verifying your identity. Persona, not Veru365, collects and processes this information, and Persona is responsible for its own compliance with applicable biometric privacy laws with respect to that collection and processing, including obtaining any consent Persona is required to obtain directly from you. We do not ourselves collect, retain, or process the identification document image or selfie; we receive and store only the verification result from Persona, consisting of the verified name, date of birth, and inquiry reference.

11. Information About Other Individuals

If you provide us with information about another person – for example, a beneficiary or household member for estate or financial planning purposes – you represent that you have the authority to provide that information to us and that you have informed that person of, or obtained any consent required for, this use, consistent with your relationship to them and applicable law. We use this information solely to provide planning-related features to you and do not independently market to or otherwise directly contact these individuals using this information. A person about whom information has been provided to us in this manner, or someone authorized to act on their behalf, may contact support@veru365.com with any request concerning that information, and we will respond as appropriate given the context in which the information was provided.

12. Children’s Privacy

The Service is not directed to, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have done so, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, contact support@veru365.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the Effective Date above and provide notice by email or through the Service at least 15 days before the changes take effect. Your continued use of the Service after that notice period constitutes acceptance of the revised Policy.

14. Contact Us

Questions, concerns, or requests regarding this Privacy Policy or our data practices may be directed to:

Veru 365, LLC

Email: support@veru365.com