Privacy Policy

Commas, Inc. (“Commas,” “Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through our compliance with this Privacy Policy (as amended, restated, supplemented, or otherwise modified from time to time, the “Privacy Policy”). This Privacy Policy explains how we collect, use, share, and protect information in relation to our Services, and the choices you can make about the collection and use of your information. This Privacy Policy applies throughout the entire duration of your use of all or any portion of our Services. This Privacy Policy applies whether you are a Visitor or a Registered User. Capitalized terms used and not defined in this Privacy Policy have the meanings given to them in our Terms of Use as in effect from time to time, available at https://www.commasapp.com/terms-of-use.

This Privacy Policy constitutes a legally binding agreement between Commas and you, governing your use of our Services. By accessing or using all or any part of our Services, or by clicking to accept or agree to the Privacy Policy when this option is made available to you, you acknowledge that you have read and accept, and agree to become bound and to abide by, this Privacy Policy. If you are entering into this Privacy Policy on behalf of a company, organization, or other business entity, you represent and warrant that you are authorized to enter into this Privacy Policy on behalf of such company, organization, or other business entity. If you do not agree to this Privacy Policy, please do not use or access all or any part of our Services in any way.

 

1. Changes to Our Privacy Policy

Commas may, in our sole discretion, change, modify, supplement, amend, or remove all or any part of our Privacy Policy at any time and from time to time. Any modification will be emailed to Registered Users and posted on this page and become effective from the date of such posting, and from such effective date will supersede all prior versions in their entirety. The “Last Modified” date at the bottom of the page reflects when the most recent modifications became effective. You are deemed to have agreed to the most current version of our Privacy Policy by accessing or using our Services in whole or in part, or by clicking to accept or agree to the Privacy Policy when this option is made available to you, beginning on the “Last Modified” date. If you do not agree to a modification, your sole recourse is to terminate your use of our Services in their entirety immediately. Commas encourages you to periodically review our Privacy Policy to stay informed about any modifications.

2. Information We Collect and How We Collect It

The information we collect depends on how you interact with Commas, the particular features you use within our Services, and the choices you make about how to share data with Commas. We collect information about you from different sources and in various ways, including, without limitation, information you provide directly, information collected automatically, information from third party data sources, information we create, and information from publicly available sources. 

2.1 Information Collected from You. Commas collects certain information from you, including, without limitation: 

(a) Personal information and identifiers. Commas collects each Registered User’s first and last name, postal address, email address, and telephone number. Commas also collects usernames, passwords, and other credentials that allow Registered Users to access their User Accounts. 

(b) Demographic information. Commas collects each Registered User’s age, gender, marital status, and similar demographic information. 

(c) Economic and financial information. Commas collects each Registered User’s employer and job title, individual annual income, employment status, monthly fixed costs, and household income, as well as other financial and spending data that the Registered User authorizes Third Party Services to provide or provides independently. Commas also collects each Registered User’s financial transaction data, financial institution data (i.e., information about where each User has accounts with various financial institutions), and investment account data.

(d) Financial health information. Commas collects each User’s responses to a series of questions related to the User’s financial goals, spending habits, and comfort dealing with and managing money if the User completes the relevant questionnaire and onboarding process.

(e) Expenditure information. Commas collects information about Registered Users’ expenditures, including expenditure types and amounts.

(f) Payment information. If you make a purchase or other financial transaction through our Services, Commas collects your credit or debit card number, financial account information, and other payment information. We also maintain a record of your payment, purchase, and subscription history for all transactions with Commas.

(g) Communications. Commas collects photos, documents, or other files you upload to our Services. Commas also collects and retains all email, SMS, and other communications from Users, including any content or information you provide in connection with customer service communications.

2.2 Information Collected Automatically. When you create a User Account or use our Services, technologies we use automatically collect certain information, including, without limitation:

(a) Log file information. Log file information is automatically reported by your browser each time you make a request to access our Services. It may also be reported when the content of our Services is downloaded to your browser or device. Our servers automatically record certain log file information, including your web request, IP address, browser type, referring/exit pages and URLs, number of clicks, and how you interact with links on the Service, domain names, landing pages, pages viewed, and other such information.

(b) Device information. When you access our Services from a mobile device, Commas collects certain information about your mobile device, including, without limitation, device identifiers. Device identifiers are small data files or similar data structures stored on or associated with your mobile device, which uniquely identify your mobile device. A device identifier may be data stored in connection with the device hardware, data stored in connection with the device’s operating system or other software, and data sent to the device by Commas. This data includes your device type, operating system, browser, language, server resolution, and time spent on our pages. 

A device identifier may deliver information to us about how you browse and use our Services and may help us provide reports or personalized content and advertisements. You can opt out of having your mobile advertising identifiers used for certain types of digital interest-based advertising, by accessing the settings in your iOS or Android mobile device and following the most recent published instructions. However, if you do so, you may be unable to access certain features of our Services. If you opt out, we will remove all data about you and no further data collection or tracking of this nature will occur. The random identifier we previously assigned to you will be removed. This means that if at a later stage, you decide to opt in, we will not be able to track you using the same identifier as before you opted out.

(c) Geolocation data. Commas collects geolocation data, such as may be determined by GPS, IP address, and other data from sensors on or around your device, depending in part on your device and account settings. Depending on these settings, this may include precise location data, for example GPS data for Android features like navigation or finding your phone.

(d) Cookies. Commas may use cookies and similar technologies to collect information about how you use our Services and to provide features to you. Our Services uses pixel tags, web beacons, local storage, and similar tracking technologies (collectively referred to as “Cookies”) that are created when you use our Services and are stored on your computer or mobile device. You may refuse to accept browser Cookies by activating the appropriate setting on your browser or updating your User Account settings. However, if you do so, you may be unable to access certain features of our Services. 

Unless you have adjusted your browser settings or User Account settings so that your browser or device refuses Cookies, our system will issue Cookies when you direct your browser to our Services. You will have the option to accept Cookies via a Cookie consent banner that will appear upon entering our Website on the relevant pop-up screen. Our Service may use local stored objects (“Flash Cookies”) to collect and store information about your preferences and navigation to, from and on our Services. Flash Cookies are not managed by the same browser settings as are used for browser Cookies. Our Services and emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Commas to collect statistics, for example, counting Users who have visited those pages or opened an email, recording the popularity of certain content, and verifying system and server integrity. 

Cookies help us offer convenient features, such as remembering your User Account settings and recognizing your browser. We also use the information we collect via Cookies to generate and compile statistics about Users and their use of our Services to monitor traffic on our Services, analyze trends, develop marketing programs, detect and prevent fraud and security incidents, and improve our design and content.

2.3 Information Collected from Third Parties. Commas collects the type of information described above, in addition to other information as described in this Section, from third parties. Commas takes no responsibility and assumes no liability for any actions or omissions of any such third party. These third party sources include, without limitation: 

(a) Third Party Services that you link to Commas. Third Party Services, including, without limitation, social media accounts you choose to connect to Commas, a Google account you connect to Commas for open authorization login purposes, Stripe, Plaid, and advertisers will share information about your accounts with those Third Party Services with us. These third parties may also share information with us regarding the measuring, reporting, and performance of advertisements on our Services and content from or related to your accounts with such Third Party Services. We may also engage in co-branding or joint marketing activities and those partners may share similar information with us. By linking your Third Party Services to your User Account, you grant us and the relevant Third Party Services the right, power, and authority to act on your behalf to access and transmit your personal and financial information to one another.

(b) Service providers. Third parties collect and provide data in connection with work they do on our behalf, including, without limitation, Stripe, Plaid, other Third Party Services we may utilize to provide the Services to you, or independent contractors as further described below. We use Stripe to process your purchases and payments. We use Plaid to obtain access to certain of your accounts with Third Party Services and collect your Transaction Data. We may use independent contractors to provide additional features or customer service to you. Further, we or Third Party Services we work with who enable us to provide our Services to you may use analytics tools to help us measure usage trends and customer churn on the Services. These tools collect information sent by your device or our Services related to your usage of the Service that assists us and the Third Party Services we work with in improving the service and in other operational purposes.

2.4. Information We Create or Generate. Using information we collected, Commas generates new information, including, without limitation, weekly and monthly spending summaries and trends in your spending over time. 

2.5. Information from Publicly Available Sources. Commas may collect data from publicly available sources. We may combine this information from publicly available sources with your personal information for the purposes described in this Privacy Policy.

3. How We Use your Personal Information 

Commas uses your information for various purposes, including, without limitation: 

(a) Product and service delivery. Commas uses your information to provide and deliver our Services, including to maintain your User Account and to provide personalized content. 

(b) Business operations. Commas uses your information for business operations purposes, including billing, accounting, security, legal compliance, and internal operations purposes. 

(c) Product development. Commas uses your information to develop new services and features. 

(d) Customer support. Commas uses your information to answer your questions and provide customer support. 

(e) Communications. Commas uses your information to send you information, including educational content, invoices, confirmations, technical notices, updates, security alerts, reminders, support, and administrative messages. 

(f) Marketing. Commas uses your information to inform you about our Services, including offers, promotions, rewards, contests, and upcoming events.

(g) Advertising. If you are a Registered User of our Basic Service, Commas may use your information to display personalized advertising to you.

(h) Analytics. Commas uses your information to monitor our Service analytics, including the total number of Users, traffic, and demographic patterns, and usage trends and customer churn. 

4. How and When We Share Your Information with Third Parties 

Commas may share your information with third parties, including, without limitation:

(a) Third Party Services. Certain services made available via our Services, or that our Services are integrated with or with which our Services might otherwise interact, are Third Party Services, including, without limitation, Stripe, Google, and Plaid. Some Third Party Services are required to make our Services available to you. When necessary to provide specific business support services, Commas may share your information, as well as information obtained from tools like Cookies, with Third Party Services. Third Party Services have their own privacy policies. Our Privacy Policy only applies to our Services, and we are not responsible for the privacy practices, security standards, or content of Third Party Services. We recommend that you read Third Party Services’ privacy polices so you can understand the manner in which your personal data will be handled by these providers. Our Third Party Services will be given access to your information as is reasonably necessary to provide the Services. The Third Party Services we use and share information with may change from time to time. 

(b) Third party advertisers. Commas may share your personal information with external business partners or third party analytics and advertising companies. This allows those third parties to, among other things, deliver targeted advertisements that they believe will be of most interest to you. These third parties may in turn combine this data across multiple sites that they work with to improve analytics for their own purposes and for others. 

(c) Financial services and payment processors. When you provide payment data, for example, to make a purchase, Commas will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.

(d) Service providers. We may provide your information to vendors or agents working on our behalf to help us facilitate our provision of our Services to you and generally for the purposes described in this Privacy Policy. Similarly, customer service agents may be outsourced, and they may require access to your information to provide you with assistance.

(e) Corporate transactions. Commas may disclose your information as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

(f) Legal, safety, and law enforcement. Commas may access, disclose, and preserve your information, when we believe in our sole discretion that doing so is necessary to (i) comply with applicable law; (ii) respond to valid legal process, including from law enforcement or other government agencies; (iii) protect and defend the rights or property of Commas; (iv) operate and maintain the security of our Services and investigate violations of our Terms of Use and this Privacy Policy; and/or (v) act under exigent circumstances to protect information of Users or the safety of Users or the public. Commas will only share the information we are required to disclose by law and only when we are required to do so.

(g) Data sale. Commas may sell, rent, trade, license, use, and disclose all non-personal information on an aggregate and anonymized basis to any third party for any purpose, including, without limitation, research and analytical purposes.

 

5. How and How Long We Store Your Information

5.1 Security of Stored Information. Commas takes the security of your information very seriously. We use commercially reasonable safeguards, including standard Google Cloud encryption for data at rest and in transit, to protect the information that you provide from loss, misuse, unauthorized access, and disclosure. However, given the nature of communications and information processing technology, we cannot and do not guarantee that your information will be absolutely safe from access, alteration, or destruction by a breach of any of our physical, technical, and managerial safeguards.

Please do your part to help us. You are responsible for maintaining the secrecy of your unique password and User Account information, and for controlling access to emails and SMS messages between you and Commas, at all times. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

5.2 External Data Storage Sites. Commas may store your data on servers provided by third party hosting vendors with whom we have contracted.

5.3 Duration of Information Storage. Commas stores your information only so long as we need it to provide our Services to you, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Actual retention periods can vary significantly based on your expectations and consent, the sensitivity of the data, the availability of automated controls, and our legal and contractual obligations.

5.4 Data Transfer. Commas, its affiliates, or service providers may transfer information that we collect about you, including personal information, across borders and from your country or jurisdiction to other countries or jurisdictions around the world. If you are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. Our Services are not designed to be accessed or used outside of the United States, and Users in other countries are not permitted to use our Services. By using or accessing our Services, you consent to the transfer of information to the U.S. or to any other country in which Commas, its affiliates, or service providers maintain facilities and the use and disclosure of information about you as described in this Privacy Policy.

6. Your Rights and Choices

You have choices about how your information is collected and used. 

You can notify us of your preferences when you make a User Account. You can access or modify at any time the information associated with your User Account, if applicable, through the settings available in your User Account. Note, however, that if you choose not to provide information that is necessary, or if you choose to delete information or opt out of certain functionality, then some services or features of our Services may not be available or fully functional for you.

6.1 Communication Preferences. We respect your privacy and give you an opportunity to opt out of receiving announcements of certain information:

(a) Emails. When you create a User Account, your email will be automatically enrolled to receive email communications from Commas including Services-related notices, updates, improvements, offers, or other communications which may contain important information about your use of our Services or your User Account, or promotional or educational communications. Users may opt out of receiving certain promotional and other communications from Commas via the opt out link included in such emails. Please note that it may take up to fourteen (14) days for changes to take effect. If you opt out of promotional emails, we may continue to send service-related emails, which you may not opt out of. If you do not wish to receive service-related emails, please delete your User Account. Please note that opting out of email communications may prevent you from receiving messages that are critical to the function and your use of our Services and as a result we may elect in our sole discretion to terminate your User Account.

(b) SMS messaging. Many of our Services’ current and future features make use of SMS messaging. If you wish to opt out of these communications related to the provision of our Services and rely on our Website (or App, if applicable in the future) instead, you may reply with “STOP”. Note that our Services are optimized for use with SMS messaging, and so if you opt out of these communications, while you can still use the full functionality of our Services via the Website, our Services may not work as well to accomplish your goals in using our Services.

6.2 Cookie Options. As described above, upon accessing the Website for the first time from a given device or browser, you will be given a choice as to which Cookies, if any, you would like to accept from the Website. If you do not want us to collect information using Cookies, you can make such a selection in the relevant banner when accessing our Website, or change your browser to reject Cookies from the Website or to alert you before a Cookie is placed on your computer at any time in the future. Each browser is different, so you should check your browser’s “Help” menu to learn how to change your Cookie preferences. Please note that Cookie-based opt-outs only apply to the specific device and browser on which the opt-out Cookie is applied. If you accept a Cookie, you can delete it at any time through your web browser. If you choose not to accept Cookies, you may not be able to enjoy all the features available through our Services.

The Network Advertising Alliance (“NAI”) and the Digital Advertising Alliance (“DAA”) offer opt-out tools to help you manage your choices for participating companies that use Cookies for Interest-Based Advertising and cross-app advertising. For more information about these tools please visit: NAI Opt-Out Page and DAA Opt-Out Page. You can also opt out of Google Cookies by installing  Google Analytics’ opt-out browser add-on at https://tools.google.com/dlpage/gaoptout, and/or the Google Advertising Cookie out-out browser add-on.

You may also be able to limit interest-based advertising through the settings on your mobile device by selecting “limit ad tracking” (iOS) or “opt-out of interest-based ads” (Android). To learn more about interest-based advertising and how you may be able to opt out of some of this advertising, you may wish to visit the NAI’s online resources, at http://www.networkadvertising.org/choices, and/or the DAA’s resources at www.aboutads.info/choices. You may also be able to opt out of some, but not all, interest-based ads served by mobile ad networks by visiting http://youradchoices.com/appchoices and downloading the mobile AppChoices app.

6.3 Right to Know. You have a right to know the information we have collected about you. You may request your information by contacting us at support@commas.app using the email address tied to your User Account. You also have a right to request additional information about our collection, use, disclosure, selling, or sharing of such information.

6.4 Right to Correct. You have a right to request that we correct inaccurate information about you. You can update your information at any time by logging into your User Account or by contacting us at support@commas.app using the email address tied to your User Account.

6.5 Right to Delete. You have a right to delete your personal information. To delete your personal information or User Account, email support@commas.app with your full name and the email subject “Delete my account - [Full Name].” Subject to certain exceptions set out below, on receipt of a verifiable request from you, Commas will delete your personal information from our records and direct any Third Party Services to delete your personal information from their records. When you delete your personal information, our Services will no longer be available to you. Please note that there may be times when we may not be able to comply with requests to delete your personal information or User Account. For example, we may be unable to comply with your request if maintaining your User Account or personal information is necessary to: 

  • Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us; 

  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity; 

  • Debug to identify and repair errors that impair existing intended functionality; 

  • Exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law; 

  • Comply with the California Electronic Communications Privacy Act; 

  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent; 

  • Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; 

  • Comply with an existing legal obligation; or 

  • Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information. 

6.6 Option to Opt Out of the Sale or Disclosure of Your Information. You may have a right, under certain privacy and data protection laws, as applicable, to opt out of the sale or disclosure of your personal information. If you exercise your right to opt out of the sale or disclosure of your personal information, we will refrain from selling or disclosing your personal information, unless you subsequently provide express authorization for the sale or disclosure of your personal information. To opt out of the sale or disclosure of your personal information, email support@commas.app with your full name and the email subject “Opt out of information selling for [Full Name].” If you are accessing our Services in California, Colorado, Connecticut, Nevada, Virginia, or Utah, please see Section 6.7 below.

6.7 Your State’s Privacy Rights.

(a) California privacy rights.

Section 2 sets forth the categories of personal information, including sensitive personal information, that Commas collects and processes about you, a description of each category, and the sources from which we obtain each category. Under the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”), you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:

  • Categories of and specific pieces of personal information we have collected about you;

  • Categories of sources from which we collect personal information;

  • Purposes for collecting, using, or selling personal information;

  • Categories of third parties with which we share personal information;

  • Categories of personal information disclosed about you for a business purpose;

  • If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold;

  • The categories of information we have disclosed to any third party for any third party’s direct marketing purposes during the preceding year; and 

  • The names and addresses of third parties that received such information, or if the nature of their business cannot be determined from the name, then examples of the products or services marketed. 

Further, pursuant to the CPRA, you have the right to opt out of our sharing or disclosing your personalized data to third parties in certain circumstances, and to request that we correct any inaccuracies in your personal information.  You may make such a request by contacting us as provided in Section 8. California law also requires that we disclose how we respond to “do-not-track” requests from our Users. At this time, we do not currently respond to “do-not-track” requests from our Users’ browsers and we do not use your personal data for any automated decision-making or data profiling.

Under California Civil Code Section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marking purposes.

(b) Colorado, Connecticut, Virginia, Nevada, and Utah privacy rights.

Colorado, Connecticut, Virginia, Nevada, and Utah each provide their state residents with rights to:

  • Confirm whether we process their personal information before we do so, and to receive notice of the categories of personal information we collect, the purposes for which such information is collected and used, whether such information is sold or shared, and how long such information is retained;

  • Access and delete certain personal information and see what information we have collected about you;

  • Opt out of personal data processing for targeted advertising and the sale of personal data; and

  • Data portability.

Colorado, Connecticut, and Virginia also provide their state residents with rights to:

  • Correct inaccuracies in their personal information, taking into account the nature of the information and the purposes of the processing; and

  • Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights or appeal a decision regarding a consumer rights request, please submit a request by emailing support@commas.app. 

Nevada provides its residents with a limited right to opt out of certain personal information sales. Residents who wish to exercise this sale opt-out right may submit a request by emailing support@commas.app.

Commas will never discriminate against you for exercising any of the foregoing rights under the laws of the states noted above.

7. Individuals Under 18 Years of Age 

Commas does not permit individuals under 18 years of age to use our Services. Commas does not knowingly collect personal information from individuals under 18 years of age. If we learn that we have collected or received personal information from an individual under 18 years of age, we will delete that information.  

8. Contact Information 

If you have any questions or comments about our Privacy Policy, or if you believe that Commas has not adhered to our Privacy Policy, please contact Commas by emailing support@commas.app.

Commas, Inc.
1 E Erie St Suite 525-2625
Chicago, Illinois 60611 

 ____________________

Last Modified May 17th 2023