Privacy Policy

1. Introduction and Scope

1.1This Privacy Policy explains how All Fair Corporation (“All Fair,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use our website at www.all-fair.com, our web application at app.all-fair.com, and related services (together, the “Service”).

1.2Who it covers. This Policy covers business owners and the people they authorize to use their Accounts; staff of Partner Organizations who use the Service (Section 16); and visitors to our website.

1.3Illuminating Impact. Illuminating Impact LLC is the venture studio that conceived All Fair and supports its development. It provides technology infrastructure and support services to All Fair, such as email, domain and server management, and hosting support, as well as consulting and advisory services. It handles personal information only on All Fair's behalf and under this Policy.

1.4What it doesn't cover. This Policy doesn't cover (a) how Partner Organizations handle information they keep outside the Service, which their own privacy policies govern; (b) third-party services and Connected Accounts, which their own policies govern; or (c) how Businesses handle information about their own customers, employees, and others. Section 15 explains our role when we process that information for a Business.

1.5Business information is treated as personal. For many small businesses, and especially sole proprietors, the business's financial records reveal information about its owner. We treat business financial information as personal information throughout this Policy.

1.6Definitions. Capitalized terms that aren't defined here, such as Business, Partner Organization, Sharing Grant, Share Package, Retained Record, Program Basics, and Sensitive Information, have the meanings given in our Terms of Service at www.all-fair.com/terms.

2. Our Commitments at a Glance

These commitments are part of this Policy.

3. Our Role

3.1For information about you, your Account, and your use of the Service, All Fair decides how the information is used. Privacy laws call this role a “business” or “controller.”

3.2For information about your customers, employees, and others that appears in your records, we act as your service provider (or processor), as described in Section 15.

3.3Partner Organizations are independent. They decide how to use the Retained Records they keep, under their own privacy policies and within the limits set by our Terms of Service.

4. Information We Collect

4.1Information you give us

• Account information: your name, email address, phone number, business name and address, role, and password.
• Business profile: industry, entity type, years in operation, products and services, goals, and other details you add.
• Financial records and documents: documents you upload, such as bank statements, financial statements, invoices, receipts, and business tax documents, and the information we extract from them, such as transactions, balances, revenue, and expenses. These documents may contain Sensitive Information and information about other people (Sections 6 and 15).
• Communications: messages, support requests, feedback, survey responses, and your conversations with AI Features, including voice messages you record for our AI assistant, which we turn into text on our own servers.
• Billing information: billing contact details and address. Our payment processor collects your payment card details; we receive only limited information, such as the card type, the last four digits, and the expiration date.

4.2Information from Connected Accounts

The Service doesn't connect to bank, accounting, payment, or similar accounts yet. When we add connections, we'll update this Policy before they're available, to explain what we import and how.

4.3Information collected automatically

• Device information: device type, operating system, browser, device identifiers, and language settings.
• Usage information: the pages and features you use, clicks, searches within the Service, time spent, and referring pages.
• Log information: IP address, access times, and error and system activity logs.
• Performance information: load times, crash reports, and diagnostics.

How we store and protect it. We store this information with our cloud hosting and product analytics providers in the United States. It's encrypted in transit, and only personnel who need it to operate, secure, or improve the Service can access it. We configure our product analytics so that session recordings in our app mask all text and inputs, which keeps your financial information out of them. We keep this information as described in Section 12. Section 10 describes cookies and similar technologies.

4.4Location information

We infer your approximate location, such as your city or region, from your IP address to help secure your Account and prevent fraud, and our product analytics records it with your activity in our app (Section 10.6). We don't collect precise location from your device.

How we store and protect it. IP-based location is stored in our server logs and our product analytics. It's encrypted in transit, only personnel who need it can access it, and we keep it for the periods in Section 12.

4.5Information from Partner Organizations

If a Partner Organization invites you or sponsors your Account, it gives us your email address and business name, and it can add its own references, such as a cohort or loan number. If you give it access to your onboarding, it can also upload documents for you and help prepare your records, which are added to your Account only when you approve them (Section 8.11).

4.6Information from other sources

If you sign in with Google, Google gives us your name, email address, and profile picture. We receive payment status and fraud signals from our payment processor.

4.7Information we don't collect

We don't collect biometric information. We don't collect precise geolocation, and we don't store full payment card numbers.

5. How We Use Information

Our access to your information. All Fair personnel, and contractors acting for us (including Illuminating Impact), may access your information, including your financial records, documents, and conversations with AI Features, when needed to provide, support, secure, and improve the Service and to comply with the law. For example, our team reviews documents you upload during onboarding to check how they were read. We limit this access to people who need it, and changes anyone makes to your information are logged (Section 12). We don't use personal information for targeted advertising.

6. Sensitive Information

6.1What it is. Sensitive Information means Social Security numbers and other taxpayer identification numbers, government ID numbers, dates of birth, full financial account numbers, and account credentials.

6.2Where it comes from. Most Sensitive Information reaches us inside documents you upload. For example, a tax return shows a taxpayer identification number, and a bank statement shows an account number. You may redact information you don't need to share with us before uploading.

6.3How we handle it. We use Sensitive Information only to provide the Service to you, to secure your Account, and to comply with the law. Only personnel who need it can access it. We never use it to train AI models, and we never provide it to Partner Organizations as data fields. If you share a document that contains Sensitive Information with a Partner Organization, as a Share Package or through the documents area, it will see the document as you uploaded it.

7. AI, Model Training, and Aggregated Data

In short: we use your data to run your features. We don't use it to train AI models. Our AI providers' terms don't let them train on it either, and they keep it only for a limited time (Section 7.5).

7.1Your features. We process your information with AI and statistical models to extract information from documents and to produce your forecasts, insights, and answers, including remembering details from your conversations so that our AI assistant can use them later. This is part of providing the Service.

7.2No training on your data. We don't use your information to train or improve AI models, ours or anyone else's.

7.3If that ever changes. If we ever offer to use customer information to train AI models, it will be opt-in: we'll ask for your separate consent first, and saying no won't affect your Account. We would never use Sensitive Information, or information that identifies your customers, employees, or other individuals, for training.

7.4Benchmarks. We don't produce benchmarks from customers' information yet. If we do, we'll combine de-identified, business-level figures from many businesses, such as typical margins for a type of business in a region. A benchmark never reflects a group of fewer than 10 businesses, and benchmarks never include information about individual customers or employees. We publicly commit to keep de-identified information in de-identified form and not to try to re-identify it, and we require anyone we share it with to make the same commitment.

7.5AI providers. AI Features run on models from outside providers: Anthropic, our primary provider, and OpenAI, which the Service uses automatically if Anthropic is unavailable. They process your information under their terms for business customers, which don't allow them to train their models on it. Each keeps it for a limited time to detect misuse, then deletes it: Anthropic within 30 days, or up to 2 years for content flagged as violating its usage policies, and OpenAI within 30 days. Either may keep it longer if the law requires. Their terms can change. Current providers, with links to their terms, are listed at www.all-fair.com/subprocessors.

7.6Automated decisions. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, except for security and fraud-prevention measures. If one of those measures significantly affects your Account, you can ask for human review by writing to info@all-fair.com with “Automated Decision Review” in the subject line.

7.7Accuracy. Some information and suggestions in the Service are worked out by algorithms, and some are generated by AI. Both can be wrong. They aren't financial, legal, tax, or investment advice, and they don't replace your judgment. They're decision-support tools and shouldn't be the only basis for significant business, financial, or legal decisions.

8. Sharing With Partner Organizations

In short: Partner Organizations, such as community lenders and business support organizations, see a few basics about your Account (Section 8.1) and otherwise only what you choose to share, for the purpose in Section 8.5, for as long as you allow. A partner paying for your Account doesn't change that.

8.1Sponsorship doesn't include access to your data. If a Partner Organization sponsors your Account, it pays for your use of the Service. Every Partner Organization you work with, sponsor or not, receives your Program Basics: your business name; the names and email addresses of the people on your Account; the status and dates of your relationship with it and of any sponsorship; and which areas you've shared with it. It also sees the messages, tasks, and files you exchange with it in the Service. Program Basics never include financial records, transactions, documents, or Service Outputs. Anything more is shared only if you approve it.

8.2How you approve sharing. A Partner Organization can ask for access in two ways. Its invitation to join All Fair can list areas of your business it asks to see, and accepting the invitation gives it access to those areas. Or, once you're connected, it can send you a data request; you choose which of the requested areas to share, and you can add or remove areas before you approve. The areas are products and sales, operating costs, unit economics, profit and loss, forecasts and scenarios, onboarding, and documents. Some areas include the information they're built from: unit economics, for example, includes your sales, recipes and materials, and labor. Your cash information and your conversations with AI Features are never shared as areas. Only you, or someone you've authorized in your Account, can approve.

8.3Two ways to share. With standing access, the Partner Organization can view the areas you approved as they update. With a Share Package, you share one or more files; the Partner Organization can open and download them until you stop sharing them or the share expires.

8.4What we never share as data. We never provide Sensitive Information to Partner Organizations as data fields, but the areas and documents you share show your records as they are, so they can include information about other people that your records contain, such as staff in your labor costs. A document you share is shared as it is, including anything it contains.

8.5How Partner Organizations may use your information. Only to advise you, provide technical assistance, and run the program you're part of. Our Terms prohibit Partner Organizations from using information shared through All Fair to make lending, credit, collection, or other eligibility decisions about you; selling it; using it for unrelated marketing; sharing it except in aggregated form that doesn't identify you; trying to re-identify aggregated information; or entering it into outside AI tools. You can read these rules in Section 24 of our Terms of Service.

8.6How long access lasts. Access lasts until you turn it off. It doesn't expire on its own, and it doesn't end when a sponsorship ends.

8.7Revoking access. You can revoke any Sharing Grant at any time under Advisors → Access in your Account, or by emailing info@all-fair.com. Revocation stops new access through the Service right away; a viewing session the Partner Organization already has open ends within an hour. It works going forward: it stops future access, but it can't take back information the Partner Organization already received. The Partner Organization may keep the Share Packages you sent, files it downloaded while it had access, and its own notes about its work with you, as its records and under its own privacy policy and legal retention obligations, and nothing else. Revoking a Sharing Grant doesn't close your Account, and Sponsors agree not to end your sponsorship because you declined or revoked optional sharing.

8.8Seeing who has access. Advisors → Access in your Account shows the areas you share, and your data export includes a log of what you've shared and when. We don't currently log when a Partner Organization views your information. To find out more about who has access, email info@all-fair.com.

8.9Partner Organizations are independent. Partner Organizations aren't our agents, and their own privacy policies govern the information they keep. We require them by contract to protect your information and follow this Section. If we learn that a Partner Organization has broken these rules, we'll suspend its access and tell you.

8.10Our role and fees. For information in your Workspace, we act on your instructions. Partner Organizations pay us for software and seats, not for access to your data, and we don't sell your information to them.

8.11Information Partner Organizations give us about you. If you give a Partner Organization access to your onboarding, it can upload documents for you and help prepare your records, and nothing it prepares is added to your Account until you approve it. The Partner Organization is responsible for having the right to share it.

8.12More than one partner. If you work with more than one Partner Organization, each has separate Sharing Grants, and none can see another's access, notes, or Share Packages.

9. Other Ways We Share Information

9.1Service providers. We share information with companies that help us run the Service. Their terms with us limit how they may use your information and require appropriate security, and our AI providers' terms don't allow them to train their models on it. Some, such as our payment processor, also use information for their own purposes, like preventing fraud, under their own privacy policies. They include:

We keep the current list, with more detail, at www.all-fair.com/subprocessors and update it before a new provider starts processing your financial records.

9.2At your direction. We share information when you direct us to: with Partner Organizations you share with (Section 8), with Authorized Users you invite, and with anyone else you ask us to share it with.

9.3Legal and safety. We may disclose information if we believe in good faith that it's necessary to comply with the law, a court order, or other legal process; to enforce our Terms; to detect or prevent fraud or security problems; or to protect the rights, safety, or property of our users, the public, or All Fair. Where the law allows, we'll try to notify you before disclosing your information in response to legal process.

9.4Business transfers. If All Fair is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We'll notify you, and anyone who receives your information must either honor this Policy for information collected under it or get your consent to use it differently.

9.5De-identified and aggregated information. We may share de-identified or aggregated information that can't reasonably be used to identify you or your Business, such as benchmark statistics, subject to the commitments in Section 7.4.

9.6No selling and no advertising sharing. We don't sell personal information, and we don't share it for cross-context behavioral (targeted) advertising. We haven't done either in the past 12 months.

10. Cookies and Similar Technologies

10.1What we use. We use cookies and similar technologies, such as local storage and software development kits, for three purposes:

• Essential: signing you in, keeping your session secure, and remembering your cookie choices. These are always on because the Service doesn't work without them.
• Preferences: remembering your settings, such as display preferences.
• Analytics: understanding how features are used so that we can improve them. We use PostHog for this. On our website, it runs only if you allow it (Section 10.3). For our app, see Section 10.6.

10.2No advertising tracking. We don't use advertising cookies or tracking pixels on the Service or on our website.

10.3Your consent. When you first visit our website, our cookie banner asks for your consent before any non-essential technologies run. “Accept all” and “Reject all” are equally easy to choose, no optional category is pre-selected, and choosing “Reject all” actually stops those technologies from running. You can change your choices at any time under Cookie settings, linked at the foot of every page of our website.

10.4Global Privacy Control. We honor the Global Privacy Control (GPC) signal from every user, wherever you live. When we detect it, we treat it as a request to opt out of any sale or sharing of personal information and, on our website, to turn off non-essential cookies.

10.5Do Not Track. There's no common standard for responding to browser “Do Not Track” signals, so we don't respond to them. We do honor GPC as described above.

10.6Analytics in our app. When you're signed in to our web application, we use PostHog to understand how the Service is used: the pages you visit and the actions you take, your device and browser, your approximate location (from your IP address), and your email address, so that we can connect activity to your Account. We also record sessions in the app to find and fix problems; recordings mask all text and everything you type, and we keep them for 30 days. To opt out, email info@all-fair.com.

11. How We Protect Information

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption: information is encrypted in transit using TLS. Our database and file-storage provider, Supabase, encrypts stored data, including backups, at rest using AES-256, and holds a SOC 2 Type 2 report.
• Access controls: role-based access and the principle of least privilege. Signing in to the Service with a password also requires a code we email to you, and our personnel use multi-factor authentication on every system that holds customer information. Changes anyone makes to customer information, including our personnel, are logged; viewing isn't logged yet.
• Extra protection for Sensitive Information, as described in Section 6.
• Partner access controls: the same sign-in protections for Partner Users as for everyone else, view-only access, and separation between Partner Organizations.
• Service provider oversight: written contracts with security and confidentiality obligations.
• Infrastructure: our cloud hosting providers maintain SOC 2 reports.
• Monitoring and response: monitoring for suspicious activity, and a documented incident response process.
• People: confidentiality obligations and a written information security program, with annual privacy and security training for our team.

No system is perfectly secure. If a security incident affects your information, we'll notify you, and regulators where the law requires, without unreasonable delay. We'll tell you what happened, what information was involved, what we're doing about it, and what you can do to protect yourself.

12. How Long We Keep Information

We keep information only as long as we need it for the purposes in this Policy, or longer if the law requires.

Active standing. We keep your Account and its information while your Account is in active standing. It stops being in active standing when you close it or ask us to delete it, when a seat you pay for ends because you canceled it or it went unpaid, when a sponsorship ends and you don't move to a paid seat, or when we suspend or terminate it for a breach of our Terms of Service. We delete its information 30 days after that, except as the table below and Section 13.5 describe. Until then, you can export your data or ask us for a copy at info@all-fair.com.

When we delete information, it's removed from our backups within [35] days as they cycle.

13. Your Rights and Choices

13.1Rights for every user. Wherever you live, you can:

• access the personal information we hold about you;
• correct information that's inaccurate;
• delete your information, subject to the exceptions in Section 13.5;
• export your information in a machine-readable format;
• withdraw consent by revoking Sharing Grants or unsubscribing from marketing; and
• appeal if we decline a request (Section 13.6).

13.2Controls in the Service. You can turn a Partner Organization's access to each area on and off under Advisors → Access, export your data as a spreadsheet under Settings → Data & Privacy, and change your cookie choices under Cookie settings on our website. The export doesn't yet include the files you uploaded or your conversations with AI Features, and you can't yet delete your Account yourself; for either, email info@all-fair.com.

13.3Making a request. Email info@all-fair.com with “Privacy Request” in the subject line. We'll verify your identity, usually by confirming that you control your Account's email address. You may use an authorized agent; we'll ask for your written permission and may verify your identity directly.

13.4Response time. We'll respond within 30 days. If we need more time, we'll tell you why and respond within 45 days of receiving your request.

13.5Exceptions. We may keep information when we need it to complete something you asked for, meet a legal obligation (such as keeping billing records), protect security, or establish or defend legal claims. If we keep anything, we'll tell you what we kept and why.

13.6Appeals. If we decline your request, you can appeal by replying with “Privacy Appeal” in the subject line. Someone who didn't handle your original request will review it, and we'll respond within 45 days. If you're still not satisfied, you can contact your state attorney general.

13.7No discrimination. We won't deny you service, charge you a different price, or otherwise treat you differently for exercising your privacy rights.

14. Additional Information for U.S. State Residents

14.1Illinois only. The Service is offered only to businesses located in Illinois. Some states give their residents specific privacy rights; we extend the rights in Section 13 to every user, wherever they live.

14.2California. The Service isn't offered in California. Before we offer it there, we'll publish a California version of this Policy with the disclosures California law requires, including about the analytics and session tools we use.

14.3Other states. Depending on where you live, you may also have the right to opt out of targeted advertising, the sale of personal information, and profiling that produces legal or similarly significant effects. We don't do any of these. You can appeal any decision about your request under Section 13.6.

15. Information About Your Customers, Employees, and Others

15.1Your records may include information about other people, such as customers, employees, contractors, or vendors named on bank statements and invoices.

15.2Our role. We process that information as your service provider, only to provide the Service to you and on your instructions. We don't use it for our own marketing, we don't sell it, we don't use it in benchmarks, and we don't use it to train AI models.

15.3Your role. You're responsible for giving those individuals any notice that's required and for having the right to share their information with us.

15.4Requests from those individuals. If you're one of those individuals, please contact the Business that holds your information. If you contact us, we'll pass your request to that Business and help it respond.

16. If You're a Partner User

If you use the Service on behalf of a Partner Organization, we collect your name, work email address, organization, role, and activity in the Service, including the changes you make, which our change log records. Your organization manages your access. The rights in Section 13 apply to your information.

17. Privacy Questions, Complaints, and Disputes

17.1Contact us first. If you have a concern about your privacy, email info@all-fair.com. We'll acknowledge your message within [5] business days and aim to resolve it within 30 days.

17.2If we can't resolve it. Disputes about this Policy are resolved under the dispute resolution provisions of our Terms of Service (Sections 44 and 45). Those provisions call for informal resolution first and then, unless you've opted out, individual arbitration.

17.3Regulators. You can also contact the Federal Trade Commission or your state attorney general at any time. Nothing in our Terms limits your right to do so.

18. Children's Privacy

The Service is for adults running businesses. Accounts are available only to people 18 and older, and we don't knowingly collect personal information directly from anyone under 18. If documents you upload contain information about minors, such as dependents listed on a tax return, we process it only to provide the Service to you, and you may redact it before uploading. If you believe a child has given us personal information, contact info@all-fair.com and we'll delete it.

19. Third-Party Services and Links

The Service and our website link to or use services we don't operate, such as Sign in with Google and the Calendly scheduler on our Contact page. Their own privacy policies govern how they handle your information, and we aren't responsible for their practices. Please review their policies before you connect or share information.

20. Where We Process Information

The Service is intended for businesses in Illinois. We process and store information in the United States. Our website, and parts of our app such as its fonts and a charting library, are delivered through networks that operate worldwide (see www.all-fair.com/subprocessors).

21. Changes to This Policy

21.1We'll post each update with a new effective date and keep previous versions at www.all-fair.com/legal/archive.

21.2For material changes, we'll notify you by email or in the Service at least 30 days before they take effect.

21.3We won't use or share information we already hold in a materially different way than this Policy describes unless you give your affirmative consent.

22. Contact Us

All Fair Corporation

Privacy requests and questions: info@all-fair.com (include “Privacy Request” in the subject line)

Mail: All Fair Corporation, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713

Website: www.all-fair.com · App: app.all-fair.com