Silvia Privacy Policy

Last Updated: September 2026

1. Introduction and Scope

This Privacy Policy (“Policy”) describes how Silvia, Inc. and its subsidiaries (collectively, “Silvia,” “we,” “us,” or “our”), collect, use, disclose, retain, and protect personal information when you visit our websites, use our products and services, or otherwise interact with us.

This Policy covers all products and services operated by Silvia and its subsidiaries.

Collectively, these are referred to as the “Services.” Where data practices differ between products, this Policy includes product-specific sections clearly labeled as such (see Section 13).

This Policy is incorporated into the Silvia, Inc. Terms of Service. By using the Services, you acknowledge that you have read this Policy. This Policy does not apply to third-party services you may connect to through the Services; those are governed by their own privacy policies.

Geographic Focus: The Services are designed for and primarily offered to users in the United States. We do not specifically target or market to users in the European Union, United Kingdom, or other jurisdictions outside the United States. However, because the Services are accessible globally, this Policy includes provisions addressing the rights of users in those jurisdictions where applicable.

Data Controllers: Silvia, Inc. is the data controller for personal information collected through the Services. For inquiries, contact privacy@cfosilvia.com.

2. Personal Information We Collect

We collect personal information across the categories described below. The specific data elements depend on which Services you use and how you interact with them.

2.1 Account and Identity Information

Information you provide when you create an account, update your profile, or verify your identity: full name, email address, phone number, username, password (stored in hashed form), date of birth or age range, profile photo, household size, employment status, income range, financial goals, risk tolerance, authentication credentials, and login history.

2.2 Payment and Subscription Data

When you purchase a subscription: name on payment method, billing address, payment card type and last four digits, expiration date, billing ZIP code, plan type, subscription dates, billing cycle, payment amounts, transaction confirmations, and refund history. Full payment card numbers and bank account numbers are processed exclusively by our payment processor (Stripe) and are never stored on our systems.

2.3 Device, Technical, and Usage Data

Information collected automatically: IP address, browser type and version, device manufacturer and model, operating system, screen resolution, unique device identifiers, usage and interaction data (pages visited, features accessed, session duration), performance and diagnostic data (crash reports, error logs), approximate geographic location derived from IP address, referral and attribution data, and analytics data collected through PostHog and similar tools.

2.4 Marketing and Communications Data

Your marketing preferences and opt-in/opt-out status, email engagement data, referral information, survey responses, and social media interactions with our accounts.

2.5 Information from Third-Party Sources

We may receive information from payment processors, analytics providers, marketing platforms, and publicly available sources. We may combine this with information we collect directly.

2.6 Support and Feedback Data

Support communications (emails, chat transcripts, phone recordings where disclosed), feedback and ratings, beta and research participation data, and community contributions.

2.7 Product-Specific Data Collection

Additional data collected by Silvia and Silvia Insights is described in Section 13.

3. How We Use Your Personal Information

We use personal information for the following purposes. For users in the EEA, UK, and Switzerland, the applicable legal basis is noted in brackets.

3.1 Service Delivery [Contract]

Providing, maintaining, and operating the Services; creating and managing accounts; processing payments and subscriptions; providing customer support.

3.2 Product Improvement [Legitimate Interests]

Analyzing usage patterns, conducting A/B testing and user research, performing internal analytics and benchmarking.

3.3 Personalization [Legitimate Interests; Consent where required]

Tailoring content, features, and recommendations based on your usage and preferences; customizing notifications and alerts; remembering settings across sessions.

3.4 Marketing [Consent; Legitimate Interests for service communications]

Sending service-related notices and administrative messages (not marketing; cannot be opted out of while you maintain an account). Sending promotional communications where you have opted in or where permitted by law. You may opt out of marketing at any time by clicking unsubscribe, adjusting preferences in account settings, or contacting privacy@cfosilvia.com.

3.5 Safety, Security, and Compliance [Legal Obligation; Legitimate Interests]

Detecting and preventing fraud, unauthorized access, and abuse; complying with applicable laws and regulations; enforcing our Terms; maintaining audit logs.

3.6 Aggregate and De-Identified Data [Legitimate Interests]

We may create aggregate or de-identified data sets by removing information that could identify you. Such data is not personal information under applicable law. Product-specific uses of anonymized data are described in Section 13.

4. Automated Decision-Making and Profiling

Certain features of the Services, particularly within Silvia, involve automated processing to evaluate aspects of your financial situation, including financial health scores, behavioral profiles, risk tolerance assessments, and personalized recommendations.

No automated decision made through the Services has legal or similarly significant effects on you. Silvia does not make binding financial decisions on your behalf, approve or deny credit, set insurance rates, or take any action that produces legal effects. All Outputs are informational and require your independent judgment. Silvia takes actions in a connected Google account only at your request and after you confirm each action, as described in Section 13.3.

If you are located in the EEA, UK, or Switzerland, you may contact privacy@cfosilvia.com to request human review of any automated Output, express your point of view, or contest any result. You may also opt out of certain profiling activities through your account settings.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

Where required by applicable law, we process personal information only with a valid legal basis:

Where we rely on legitimate interests, we have conducted balancing tests to confirm our interests are not overridden by your rights. Records of our balancing assessments are available upon request to our Data Protection Officer. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

6. How We Share and Disclose Personal Information

6.1 Service Providers

We share information with trusted service providers who assist in operating the Services (cloud infrastructure, payment processors, analytics, customer support). They are contractually bound to use your data only for specified purposes and to maintain appropriate security. These include the third-party AI model providers that process your requests to generate responses, the messaging and voice providers described in Sections 13.1.4 and 13.1.5, and the search and web content providers that support deep research requests.

6.2 Financial Integration Partners

When you link financial accounts, your data is shared with integration partners (Plaid, SnapTrade, Coinbase) to facilitate connectivity. Data sharing is governed by your authorization and their privacy policies.

6.3 Legal and Regulatory Disclosures

We may disclose personal information to comply with law, regulation, or legal process; protect rights, property, or safety; detect or prevent fraud; or enforce our Terms.

6.4 Business Transfers

In the event of a merger, acquisition, or similar transaction, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

6.5 Anonymized Data Recipients

We may license Anonymized Data derived from Silvia user data to third parties for analytics, benchmarking, and research purposes. Anonymized Data is not personal information and is not subject to personal data restrictions. See Section 13.1 for details.

6.6 With Your Consent

We may share your information when you direct us to do so or provide explicit consent.

7. Sale of Personal Information

Silvia does not sell your personal information as that term is defined under the CCPA/CPRA.

Where we commercialize Anonymized Data (as described in Section 13.1), that data has been de-identified and no longer constitutes personal information. We do not knowingly sell or share the personal information of individuals under 16.

You may exercise your right to opt out of any future sale or sharing by clicking the “Do Not Sell or Share My Personal Information” link on our homepage or contacting privacy@cfosilvia.com.

8. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as necessary for legal compliance, dispute resolution, and legitimate business purposes.

Messaging data, call recordings and transcripts, and Google User Data are retained as described in Sections 13.1.4, 13.1.5, and 13.3.5. Section 13.3.5 controls over this Section 8 for Google User Data.

When personal information is no longer needed, we securely destroy, delete, or anonymize it.

9. Data Security

We implement industry-standard technical and organizational measures including: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, regular security assessments and penetration testing, incident response and breach notification procedures, employee security training, and SOC 2 Type II compliant infrastructure.

9.1 Breach Notification

For GDPR: we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay where required. For U.S. residents: we will comply with applicable state breach notification laws. No method of transmission or storage is 100% secure. We encourage you to use strong passwords and enable two-factor authentication.

10. Cookies and Tracking Technologies

We use cookies and similar technologies for session management, analytics, preferences, and integration functionality. We do not use third-party advertising cookies on Silvia. Full details are in our Cookie Policy at www.silvia.com/cookies.

You can manage cookie preferences through your browser settings or our cookie consent mechanism. We honor Global Privacy Control (GPC) signals where required by law.

11. Your Rights and Choices

11.1 Access and Portability

You may request a copy of the personal information we hold about you in a structured, commonly used, machine-readable format.

11.2 Correction

You may request that we correct inaccurate or incomplete personal information.

11.3 Deletion

You may request deletion, subject to certain exceptions (legal compliance, fraud prevention, contractual obligations). You can delete your account through account settings or by contacting privacy@cfosilvia.com.

11.4 Restriction, Objection, and Withdrawal of Consent

You may request restriction of processing, object to processing based on legitimate interests, or withdraw consent at any time. Withdrawal may limit available features as described in Section 5.

11.5 Opt-Out of Marketing

Follow unsubscribe instructions in any marketing email, adjust notification preferences, or contact privacy@cfosilvia.com.

11.6 Global Privacy Control

We honor GPC signals where required by law. We do not currently respond to browser-based Do Not Track (DNT) signals, as there is no uniform standard.

11.7 Right to Appeal

If we decline a privacy request, you may appeal by contacting privacy@cfosilvia.com with the subject line “Privacy Rights Appeal.”

11.8 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights.

To exercise any right, contact privacy@cfosilvia.com. We will verify your identity and respond within the timeframes required by applicable law (generally 30 to 45 days). For detailed information on how to submit a request, our verification process, response timelines, authorized agents, and appeals, see our Data Subject Request Procedure.

12. State and International Privacy Disclosures

12.1 California (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. This section describes our practices for the preceding 12 months.

Categories of personal information collected, sources, business purposes, and categories of recipients are described in Sections 2, 3, and 6. We have not sold personal information in the preceding 12 months. We have not shared personal information for cross-context behavioral advertising. We collect financial account information as sensitive personal information and use it only as necessary to perform the Services.

Your California Rights: Right to Know, Right to Delete, Right to Correct, Right to Opt Out of Sale/Sharing, Right to Limit Sensitive PI, Right to Non-Discrimination. You may designate an authorized agent with written proof of authorization.

12.2 Virginia, Colorado, Connecticut, Texas, and Other U.S. States

Residents of states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing. Contact privacy@cfosilvia.com to exercise your rights. If we decline a request, you have the right to appeal.

12.3 European Economic Area, United Kingdom, and Switzerland

While the Services are designed for and primarily offered to US residents, if you are located in the EEA, UK, or Switzerland and use the Services, the following applies: legal bases for processing are in Section 5, your rights are in Section 11, automated decision-making information is in Section 4, and international transfer safeguards are in Section 14. You have the right to lodge a complaint with your local data protection authority.

12.4 Canada

Canadian residents may have rights under PIPEDA and provincial legislation. Your information may be transferred to and processed in the United States.

12.5 Brazil

If you are located in Brazil, you have rights under the LGPD including confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing. Contact privacy@cfosilvia.com.

13. Product-Specific Data Practices

13.1 Silvia Platform

13.1.1 Additional Data Collected

In addition to the categories in Section 2, Silvia collects:

• Financial Account and Transaction Data: Linked account data (names, types, masked numbers, balances, status), transaction records (date, amount, merchant, category, status), investment holdings (securities, cost basis, market value), cryptocurrency data (public wallet addresses, token balances), debt and liability data (loan balances, interest rates, payment schedules), and real estate data (property values, mortgage details).
• Inputs, Prompts, and Conversational Data: All text, voice, and other inputs through chat, voice calls, iMessage, RCS, SMS, email, or other channels; AI-generated Outputs; full conversation history; uploaded files and documents; voice recordings and transcriptions.
• Derived and Inferred Data: Financial insights and scores (net worth, cash flow, savings rate), behavioral profiles (spending patterns, income regularity), risk assessments, AI model outputs (recommendations, forecasts, alerts), and automated categorizations.

13.1.2 AI Model Training

We use Silvia Inputs, Outputs, and feedback to train, evaluate, and improve our AI models. Data used for training is de-identified or anonymized before use. You may opt out through Account Settings > Privacy > Model Training or by contacting privacy@cfosilvia.com. Opting out does not degrade service quality or affect our ability to use your data for runtime processing or to create Anonymized Data.

Regardless of opt-out, we may use data flagged for safety review, submitted as explicit feedback, or reported for violations, for maintaining the safety and integrity of the Services.

13.1.3 Anonymized Data Program

Silvia may create anonymized, de-identified, or aggregated data sets from Silvia user data (“Anonymized Data”). Once anonymized, this data is no longer personal information and may be used, licensed, and otherwise commercialized for lawful purposes, including industry benchmarking, market research, analytics products, academic research partnerships, and improving machine learning models.

Anonymization Standards: Removal of all direct identifiers; suppression, generalization, or perturbation of quasi-identifiers; application of k-anonymity, l-diversity, or differential privacy techniques as appropriate; validation testing against re-identification before external use; compliance with CCPA/CPRA de-identification requirements, GDPR anonymization standards, and NIST de-identification guidelines.

Protections: All third-party recipients are bound by agreements that prohibit re-identification, restrict downstream sharing, require breach notification and data deletion upon termination, and include audit rights. The program is subject to periodic privacy team review, annual re-identification risk assessments, and board-level reporting.

13.1.4 Messaging Channels

You can use Silvia by sending messages to Silvia’s phone number. Messages are delivered through Apple iMessage. If iMessage is unavailable, including if you use an Android device, messages are delivered through RCS (Rich Communication Services), and if neither iMessage nor RCS is available, through SMS. Messages are transmitted by Apple, Google, wireless carriers, and our messaging service provider, which delivers iMessage, RCS, and SMS messages on our behalf.

Through messaging channels, we collect:

• Identifiers: your mobile number and messaging identifiers.
• Message content: text, images, screenshots, documents, voice notes, reactions, and other content you send to Silvia, and Silvia’s responses.
• Message metadata: timestamps, delivery and read status, the channel used (iMessage, RCS, or SMS), and device and carrier information made available to us by our messaging providers.
• Information about other people that you include in your messages. You should share information about another person only if you have the right to do so.

Radar alerts. If you set up Radar alerts in the Silvia app and turn on SMS delivery, we send the alerts you configure to your mobile number. Alerts may include financial information, such as balances, transactions, and account names. SMS messages are not end-to-end encrypted and may be visible to your wireless carrier. You can turn off SMS delivery of Radar alerts in the Silvia app or by replying STOP.

Deep research. When you ask Silvia to run a deep research request, Silvia sends search queries based on your request to third-party search and web content providers. We do not include your financial account data or Google User Data in those queries.

Group conversations. If a Silvia user adds Silvia to a group conversation, Silvia receives and processes the messages, images, and other content shared by all participants while Silvia is in the conversation, along with participants’ phone numbers or messaging identifiers. This includes participants who are not Silvia users. We use this information only to provide Silvia’s responses in that conversation. [We do not use messages from participants who are not Silvia users to train AI models, create Anonymized Data, or build Silvia memory about them.] If you are not a Silvia user and want information about you deleted, contact privacy@cfosilvia.com.

Messages on your devices. Messages from Silvia are stored on your devices and may be stored in device backups, synced to your other devices, and displayed in lock screen and notification previews. Silvia cannot access or delete messages stored on your devices or in your backups.

Messaging provider obligations. Our messaging service provider receives and processes message content and metadata on our behalf, solely to deliver messages, under a written agreement that requires it to protect your information and prohibits it from using your information for its own purposes, including training AI models. Apple, Google, and your wireless carrier handle messages under their own terms and privacy policies.

Retention. Message content is stored as part of your conversation history and retained as described in Section 8. Our messaging service provider is contractually limited in how long it may retain message content.

13.1.5 Voice Calls

You can call Silvia’s phone number to speak with Silvia’s AI voice assistant. Silvia does not place outbound calls to you. Calls are routed through a telephony service provider and processed by a voice AI service provider, which converts your speech to text and generates Silvia’s spoken responses.

Recording and transcription. Calls with Silvia are recorded and transcribed. At the start of each call, Silvia tells you that you are speaking with an AI and that the call is recorded. By continuing the call, you consent to the recording. If another person joins or can be heard on the call, you are responsible for obtaining that person’s consent to the recording.

Information we collect. Your phone number and caller ID information, call audio (processed in real time and not stored), call transcripts, AI-generated call summaries, and call metadata such as the date, time, and duration of the call.

No voiceprints. We do not use your voice to identify or authenticate you, and we do not create voiceprints or other biometric identifiers from your voice.

Voice provider obligations. Our telephony and voice AI service providers process call audio and transcripts on our behalf, solely to provide the voice service, under written agreements that require them to protect your information and prohibit them from using it for their own purposes, including training AI models.

Retention. We do not store audio recordings of calls, and our voice AI service provider processes calls under zero-retention terms and does not store them. Call transcripts, summaries, and call metadata are stored with your account and retained as described in Section 8.

13.1.6 Memory

Silvia remembers information from your conversations and connected accounts, including Google User Data, and uses it as context to personalize later responses and Radar alerts. Deleting information from memory does not delete it from your conversation history.

13.2 Silvia Insights

13.2.1 Additional Data Collected

Silvia Insights collects: which articles and content you access, time spent on each piece, content preferences, reading history, navigation patterns, newsletter open rates, click-through behavior, and engagement metrics.

13.2.2 AI-Generated Content and Your Data

We do not use your personal information as inputs to the AI models that generate Silvia Insights content. We may use aggregate, de-identified usage data to inform editorial decisions. We do not sell or provide your personal information to third-party AI model providers for training.

13.2.3 No Anonymized Data Commercialization

Silvia Insights does not create anonymized data sets from subscriber data for sale or licensing. We may use aggregate usage data internally for product improvement only.

13.3 Google User Data

If you connect a Google account to Silvia, you authorize Silvia to access data from Gmail, Google Calendar, and Google Drive through Google’s APIs (“Google User Data”). This Section 13.3 governs Google User Data and controls over any other provision of this Policy that would otherwise apply to it.

13.3.1 Google User Data We Access

• Gmail: your messages and their contents, including senders, recipients, subjects, message bodies, and attachments, and your labels. At your request, Silvia also creates drafts, sends drafts you approve, and archives, trashes, labels, or marks messages as read or unread.
• Google Calendar: your events and their details. At your request, Silvia also creates, updates, deletes, or responds to events.
• Google Drive: your files and folders and their contents. At your request, Silvia also creates, updates, renames, moves, trashes, restores, or shares files and folders.

Silvia accesses Google User Data when you connect your Google account, to record which account you connected, and when you ask Silvia to perform a task that requires it. Information Silvia retrieves to complete a task may be stored in Silvia’s memory and used as context in later conversations and Radar alerts, as described in Section 13.1.6.

Silvia takes an action that creates, sends, changes, shares, moves, trashes, or deletes Google User Data only after you confirm that specific action.

13.3.2 How We Use Google User Data

We use Google User Data only to provide and improve the user-facing features you use in Silvia, such as answering your questions about your email, calendar, and files, remembering relevant context from them, drafting replies, and managing events and documents on your behalf.

Silvia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Google API Services User Data Policy is available at https://developers.google.com/terms/api-services-user-data-policy.

13.3.3 What We Do Not Do with Google User Data

• We do not use Google User Data to develop, improve, or train generalized or non-personalized AI or machine learning models, and it is excluded from the AI model training described in Section 13.1.2.
• We do not use Google User Data to create Anonymized Data, and it is excluded from the Anonymized Data Program described in Section 13.1.3 and from the disclosures described in Section 6.5.
• We do not sell Google User Data.
• We do not use or transfer Google User Data for advertising, including personalized, retargeted, or interest-based advertising.
• We do not use Google User Data to determine creditworthiness or for lending purposes.
• We do not allow any person to read Google User Data unless you have given us your affirmative agreement to view specific data, it is necessary for security purposes such as investigating abuse, or it is necessary to comply with applicable law.

These restrictions also apply to information from Google User Data that is stored in Silvia’s memory.

13.3.4 Sharing Google User Data

We transfer Google User Data to third parties only:

• as necessary to provide or improve the features you use in Silvia, with your consent, which you give when you connect your Google account and ask Silvia to perform a task;
• for security purposes;
• to comply with applicable law; or
• as part of a merger, acquisition, or sale of assets, and only after obtaining your explicit prior consent.

The first of these includes the service providers that host and operate the Services, the third-party AI model providers that process your request to generate a response, and, if you ask Silvia about Google User Data through a messaging channel or a voice call, the messaging and voice providers described in Sections 13.1.4 and 13.1.5. These providers process Google User Data only on our behalf and are contractually prohibited from using it for any other purpose, including training their own models.

13.3.5 Storage, Retention, and Deletion

Google User Data is encrypted in transit and at rest. Content from Google that appears in your Silvia conversations is stored as part of your conversation history until you disconnect the Google account or delete the conversation.

To operate, secure, and troubleshoot the Services, we also keep records of which Google features were used in a conversation, such as that a Gmail search ran, whether it succeeded, how long it took, and the size of the result. These records do not contain the content of your Google User Data and are never used to train AI models.

You can disconnect a Google account at any time in Silvia’s settings. Disconnecting revokes Silvia’s access, deletes the access tokens we hold for that account, and deletes the Google User Data from that account that we hold, including Google content in your conversation history and information stored in Silvia’s memory, within 30 days. You can also remove Silvia’s access from your Google Account permissions page. To request deletion of Google User Data we hold, contact privacy@cfosilvia.com or follow our Data Subject Request Procedure.

14. International Data Transfers

Silvia, Inc. is based in the United States. If you access the Services from outside the United States, your personal information will be transferred to and processed in the United States.

Where required by applicable law, we implement appropriate safeguards including Standard Contractual Clauses (SCCs), adequacy decisions, the EU-U.S. Data Privacy Framework (and UK/Swiss extensions where applicable), and consent where required.

15. Children’s Privacy

The Services are not intended for individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a child under 18, we will promptly delete it. Contact privacy@cfosilvia.com if you believe a child has provided us with personal information.

16. Third-Party Links and Integrations

The Services may contain links to third-party websites and services. We do not control them and are not responsible for their privacy practices. This Policy does not apply to third-party services.

17. Data Protection Officer

Silvia has designated a Data Protection Officer responsible for overseeing data protection compliance:

Email: dpo@cfosilvia.com

Mailing Address: Data Protection Officer, Silvia, Inc., 600 Lexington Avenue, New York, NY 10022

Because the Services are designed for and primarily offered to users in the United States, Silvia has not appointed representatives in the European Union or United Kingdom under GDPR Article 27 or UK GDPR at this time. If our user base in those jurisdictions grows to a point where appointment is required, we will update this Policy with the relevant contact information.

18. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date, post the updated Policy, notify you by email, and where required by law, obtain your consent. Your continued use after changes constitutes acceptance.

19. Contact Us

Silvia, Inc.

600 Lexington Avenue, New York, NY 10022

Privacy Inquiries: privacy@cfosilvia.com

Data Protection Officer: dpo@cfosilvia.com

Security: security@cfosilvia.com

General Support: support@cfosilvia.com

Legal Notices: legal@cfosilvia.com