Privacy and AI disclosures.

Privacy notice — review draft

GREVVY LLC's draft account of current WealthOS processing and proposed privacy commitments. Legal bases, geographic applicability and the operational rights/contact process require review before adoption.

Operator: GREVVY LLC. Effective date: not adopted. Reading or acknowledging a draft is not approval of future services or transactions.

Who operates WealthOS and what this notice covers

GREVVY LLC operates WealthOS and is the proposed contracting party for its software service. This draft describes the website, independent fictional demo, real household-record implementation, member authentication and recovery, review receipts, guide and selected-source controls. The household and billing changes described in this revision are an implementation checkpoint for release review; this page does not itself establish deployment, paid activation or that a particular person's data has been processed. Billing activation, secure document uploads and other pending functions are identified separately.

Privacy questions and requests may be sent to privacy@grevvy.com; security reports to security@grevvy.com. The final notice must still identify the operator's applicable privacy role, address, a complete rights-request process and the locations and people it serves. Those details have not been finalized here. Provider policies govern their own services and must also be reviewed; they do not replace GREVVY LLC's obligations.

Fictional workspace and interest requests

The demo stores sample household preferences, simulated membership, scenarios and interaction state in browser storage. This is not secure authentication or a live financial account record. Reset demo removes relevant local sample state; clearing browser storage also affects locally stored data.

Submitting the interest form sends your name, email, selected topic, message and consent to contact you about that request to WealthOS's server. The request and its submission identifier are stored; a digest derived from the request's network address supports abuse limits and is not a claim of anonymity. If configured, the native email service sends an operational notice containing the request to the WealthOS team. The form distinguishes successful storage from email acceptance, does not enroll you in a marketing list, and sends no confirmation email to you. Do not include private financial records or other sensitive information in the form.

Real member identity, permissions and operation metadata

The member workspace uses the hosted authentication service to create or access a real account. Authentication information, member identifiers, current permissions, grant expiry/revision and operation metadata are processed to authenticate requests, enforce access, limit usage and maintain security. A real member account and household are separate from local simulated household or tier state. When password recovery is requested, the submitted email and recovery request go to the authentication service; a recovered session is verified before a new password is submitted through that service.

For guide and selected-source operations, WealthOS records operation metadata and outcomes rather than saving provider preview text or guide conversations in its application database. This limitation does not apply to the household records you deliberately save, described below. Selected-source approval records include a digest derived from the preview and account, operation and expiry bindings. A digest is derived metadata, not a claim that the underlying activity is anonymous.

When you affirmatively record a document review, WealthOS records the document ID, version, content digest, draft or approved status, expressed intent and server timestamp linked to your signed-in account. The requested activity determines which documents are shown; that context is not stored on each receipt. A receipt remains evidence of the exact version and content reviewed. Revising a document creates a new version requiring its own review; an earlier draft receipt is not converted into a review of changed content or an approved agreement. A review record is not a provider grant or financial instruction; its retention and rights handling must be included in the final operational policy.

Saved household information, membership and invitations

The real household implementation stores the household name, currency, time zone, ownership and membership, effective plan and usage, and records that members explicitly enter. Record categories include assets, liabilities, income, expenses, goals, tasks, scenarios, entities, decisions, reports and contacts, with relevant amounts, dates, status, contact email, notes or summaries. Records have current values, revision identifiers, archive status and timestamps. These data support the household views, manual calculations, collaboration and exports you request; no fictional demo records are automatically imported.

Permitted active household members can read household records, including archived records, and export the data allowed to their role. Owners control invitations and member roles; editors can change permitted records, while viewers cannot. An invitation includes the recipient email, role, status and expiry. Creating a link alone does not send email. If the owner selects email delivery and native delivery is configured, the recipient address, household name, role, expiry and invitation link are sent through the native email service; a separate receipt records the attempt status without storing the link token. Provider acceptance does not establish inbox delivery. Acceptance still requires the matching verified sign-in email. Invite only people entitled to receive the existing household information; access removal cannot recall an export or other copy already obtained.

An invitation capability is kept temporarily in the browser's session storage to carry an explicit invitation through sign-in. The implementation removes it from the page URL after capture and clears it after acceptance, sign-out or an account mismatch. The backend stores a digest of the invitation token, not the raw link token. Keep invitation and recovery links private. Household activity stores action metadata, record and actor identifiers where applicable, and server timestamps; it does not preserve every prior record value as a complete history.

The current household export contains all permitted current record values, including archived records, the current active member list, and recent activity metadata. Only the owner receives invitation metadata: all unexpired pending invitations and a bounded recent historical window. The displayed activity window is limited to the latest 100 events, and the response reports metadata counts. This export is not a complete account-wide rights response, prior-value history, or inventory of all data held by infrastructure and connected providers.

Billing implementation and activation boundary

Paid billing is implemented but inactive pending exact commercial terms, provider configuration and release checks. Merely viewing a plan or creating a Free household does not initiate hosted checkout or establish a paid subscription. The current draft-review receipts do not satisfy the approved-terms requirement for checkout.

If billing is activated and an authorized owner opens checkout, the implementation uses hosted Stripe checkout and a billing-management portal. It links the household to provider customer, checkout, subscription and invoice identifiers and stores billing state, plan entitlements and event/reconciliation metadata. The checkout request includes a household/request reference and the selected configured price. Payment details entered on the hosted page are handled by the billing provider; ordinary household forms are not payment-card fields. The final notice must verify the actual provider configuration, contractual roles, data flows, tax collection, retention and rights procedures before activation. No provider region, retention period or contract term is assumed here.

Optional OpenAI processing

When the live guide is enabled and you ask a question, the conversation and selected fictional scenario are sent to OpenAI using WealthOS's server-held key. The guide does not currently read the real household records described above, accept a personal API key or custom model, automatically read a connected account, or run background financial actions. Do not paste private household information into the fictional-scenario guide merely because it appears within the member workspace.

A separately enabled selected-source workflow can send the exact metadata preview you approve to OpenAI for a checklist. Reading a preview does not automatically send it to AI. The AI and connected-data disclosure explains the separate choice and the limits of cancellation. Providers process requests under their applicable policies and contracts; this draft does not promise zero provider retention or particular provider training settings that have not been verified.

Composio and account-provider requests

Optional account connections use Composio and the provider's authorization flow. A provider grant can be broader than an individual WealthOS read. For example, a read-only mailbox or Drive grant is not narrowed at the provider merely because WealthOS requests one message or file. Inspect the actual provider consent screen before authorizing it.

The implemented selected-source previews are limited to Calendar titles and dates, one selected email's subject and provider timestamp, or one selected Drive file's metadata. These workflows remain subject to availability, the signed-in member's grants, ownership and explicit selection. Preview content is held in page memory and cleared when the selection/access changes, the view is left or the preview expires; it is not persisted as preview text in WealthOS's application tables.

A provider may process more information to authenticate or fulfill a request than the fields WealthOS displays. Data minimization in the application does not establish a narrower OAuth grant or erase the provider's records. File-body imports, message sending and financial writes are not part of these implemented metadata previews.

Infrastructure, disclosures and security

Lovable Cloud and the attached hosted backend support authentication and server functions; Composio supports connection operations; OpenAI supplies optional model responses. Hosting, network and DNS services may process technical request information such as IP addresses, browser characteristics and request times under their deployed configurations. Current contracts, regions, subprocessors, access and logging settings require operator verification before a final production notice is adopted.

The proposed policy limits data use to disclosed service, security and applicable compliance purposes. Any legal demand, organizational disclosure, new marketing purpose or material service-provider change must be evaluated under applicable requirements and disclosed where required. This draft is not permission for an undisclosed sale, unrelated advertising use or public disclosure of private customer content.

The application uses server-side identity and permission checks and keeps service credentials out of client code. No system can promise perfect security. Incident response, notification responsibilities and an operational reporting channel must be established for the released service; no certification or completed audit is claimed here.

Retention, deletion and your controls

Grant and approval validity is enforced independently of metadata cleanup. The existing selected-source receipt and audit cleanup is documented in the implementation; cleanup can be delayed by outages. Archiving a household record retains its contents and does not delete it. Bounded activity or invitation windows limit what a response displays; they are not a promise that older server metadata has been deleted. A complete retention schedule for household records, invitations, authentication/recovery, document-review receipts, billing, support, operational records, backups and any future stored documents has not been adopted in this draft. No new retention period is supplied here.

You can use the implemented pause/revoke controls, disconnect a provider, sign out, reset demo state and clear displayed conversation or preview content. Clearing a view cannot recall information already sent. Revoking WealthOS permission does not necessarily remove the provider's authorization; use Disconnect and provider account settings as appropriate.

You can export the permitted household data within the scope described above and edit or archive records when your role and plan allow. A plan downgrade does not erase retained household records or prevent their permitted reading and export. Reset demo does not delete a real household, member account, provider records or server metadata. Self-service live account/data deletion and a complete account-wide privacy export are not yet provided. Applicable access, correction, deletion, objection or other privacy rights are not waived by those implementation gaps; Requests may be sent to privacy@grevvy.com in the meantime; GREVVY LLC must still establish and publish a complete, working rights-request process before adopting the production notice.

Planned processing and notice changes

Secure file uploads, AI use of real household records, deeper business/financial analysis and financial-account capabilities remain pending work. The implemented manual report record is a member-entered summary, not an imported document or verified business report. Billing activation requires the checks described above. Each new use needs an accurate data inventory, permissions, retention and release checks; this draft does not authorize collecting a new category of sensitive data because a future feature is described on the site.

The final notice must resolve applicable legal bases, sensitive-data treatment, international transfers, age/eligibility rules, jurisdiction-specific rights and any further contact details (current channels: privacy@grevvy.com, legal@grevvy.com). Material changes should be versioned and brought to affected users' attention; any additional consent that is required must be obtained separately. Reviewing this draft does not represent approval of unspecified future processing.

AI and connected-data disclosure — review draft

For a member considering an AI request, connected-data operation or future AI-assisted financial workflow. This disclosure supplements, and never replaces, the actual provider grant, specific read or AI-sharing choice, or separately defined financial mandate. Including future trading in its scope does not activate that functionality.

Operator: GREVVY LLC. Effective date: not adopted. Reading or acknowledging a draft is not approval of future services or transactions.

What the implemented AI features do

GREVVY LLC provides an optional WealthOS guide that explains a selected fictional scenario, identifies assumptions and suggests review questions. OpenAI processes the request using WealthOS's server-held key. The interface identifies the selected model. Suggested prompts only populate a question; the guide runs when you submit it under an active grant.

The selected-source feature is separate. It can prepare a short checklist from an exact bounded metadata preview that you choose to disclose. It has no tool authority to retrieve more data, send messages, edit provider accounts or execute financial transactions. Neither a model response nor a confident tone proves a fact or a completed action.

Connection, reading and AI sharing are distinct choices

First, a provider authorization connects your account under the provider's actual scopes. Second, an active WealthOS read grant and a specific selection permit a bounded preview. Third, a separate affirmative approval permits sending the exact displayed preview to OpenAI. Agreeing to service terms, subscribing to a plan or merely connecting an account does not make those later choices for you.

The implemented Calendar selection is your primary calendar over a positive interval of no more than seven days, with at most twenty events in one response page. Gmail selects one message's subject/date metadata; Drive selects one file's name/type/modified metadata. Bodies, attachments, event descriptions and attendees are not the preview. Some grants remain broader at the provider; see its actual consent screen.

Review the exact disclosure before sending

Titles, filenames and dates can reveal private information. Review the selected account, date window or resource and every displayed field. Only approve disclosure if you are entitled to share that information for the stated purpose. Do not include another person's sensitive content merely because your account can technically access it.

The application binds approval to the exact normalized preview, owner, source, permission revision and expiry. A one-use receipt prevents substituting different content or reusing an expired approval. If the preview changes or expires, request and review a fresh one. This protects the specific workflow; it does not establish that every possible future AI use has been authorized.

Accuracy, source limits and cancellation

AI may omit details, misunderstand context or produce incorrect statements. A calendar event does not prove an obligation, message metadata is not its body, and a filename is not a reviewed document. Verify material output against the provider source. Do not rely on the current guide as personalized financial, tax or legal advice or as an instruction to trade.

You may decline AI sharing and still inspect an available preview. Clearing the preview or pausing/revoking access prevents later permitted work according to the implemented controls but cannot recall bytes already transmitted. A timeout or stopped browser wait does not by itself prove that a provider did not process a request. Inspect status and disconnect where appropriate.

Data handling and future capabilities

WealthOS holds the current preview and checklist in page memory, while its backend stores limited usage/approval metadata, including a digest derived from the preview. Provider processing is governed by the relevant provider arrangements; no unverified promise of zero retention or no training is made by this draft. The privacy notice describes current handling and open operational details.

Any future use of real household records, document bodies, a different model/provider, background activity or external writes must be described and implemented under the applicable permissions. This draft is not a blanket AI, research, training, message-sending or financial-action authorization. Additional processing must not be inferred from a prior checkbox for a different purpose.