Privacy Policy

This Privacy Policy explains how Good Boys Ventures LLC ("Reimbursable," "we," "us," or "our") collects, uses, and shares information when you visit reimbursable.com, use our web application at app.reimbursable.com, or use the Reimbursable iOS app (together, the "Service").

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Who this policy covers

This policy applies to individuals who visit our marketing site, use our free tools (such as the HSA-eligible items directory and HSA ROI calculator), create an account, or use our paid features. It does not apply to third-party websites or services that we link to.

Reimbursable is not a healthcare provider, health plan, or insurance company. We are not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and we do not receive Protected Health Information from healthcare providers. Information you upload to the Service (such as receipts and Explanation of Benefits documents) is treated as personal financial data, with the protections described below.

2. Information we collect

2.1 Information you provide

• Account information. When you sign up, we collect your email address and a password (stored as a salted hash by our authentication provider). You may optionally add your name and profile details.
• Receipts and documents. When you upload receipts, Explanation of Benefits ("EOB") documents, or related images, we store the file and any text we extract from it (for example, merchant, date, amount, and line items).
• Expense data. Categories, notes, dates, dollar amounts, and reimbursement status that you record for each expense.
• Payment information. If you purchase a paid plan, our payment processor (Stripe) collects your payment card and billing details directly. We receive a token, the last four digits of your card, and your billing country — not your full card number.
• Communications. Messages you send us via email or support forms, and your responses to surveys or feedback prompts.

2.2 Information collected automatically

• Device and usage data. IP address, browser type, operating system, device identifiers, referring pages, and timestamps. On iOS we may collect crash logs and performance metrics.
• Cookies and similar technologies. See Section 5.
• Analytics events. Pages viewed, buttons clicked, search terms entered into the directory, and similar interactions. We use this to understand how the Service is used and to improve it.

2.3 Information from your device (with permission)

• Camera and photo library (iOS app). If you grant permission, the iOS app accesses your camera and photo library so you can capture or attach receipt images. Photos remain on your device until you choose to upload them.
• Push notifications (iOS app). If you enable notifications, we use Apple Push Notification service to send reminders and updates.

3. How we use information

We use the information we collect to:

• Provide, operate, and maintain the Service, including storing receipts, parsing documents, and showing you your reimbursement history;
• Authenticate accounts, prevent fraud, and protect the security of the Service;
• Process payments and manage subscriptions;
• Send service-related communications (account, billing, security, and support messages);
• Send product updates and marketing emails (you can unsubscribe at any time);
• Analyze usage to improve and develop new features;
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not share your receipts or expense data with advertisers.

4. When we share information

We share information only in the limited circumstances below.

4.1 Service providers

We use trusted vendors to operate the Service. They process information on our behalf under contractual obligations of confidentiality and security:

• Hosting and database. Supabase — account data, expense records, and uploaded files.
• Payments. Stripe — subscription billing and payment card processing.
• Email delivery. Transactional and marketing email providers.
• Analytics. Google Analytics — aggregated, mostly anonymized usage statistics.
• Document parsing and AI. We may use third-party optical character recognition or large language model providers to extract data from receipts and EOB documents. We do not authorize these vendors to use your content to train their models, except as needed to provide their service to us.
• Crash reporting and infrastructure. Error monitoring and content delivery providers that keep the Service reliable.

4.2 Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with a law, regulation, subpoena, or other legal process; (b) protect the rights, property, or safety of Reimbursable, our users, or the public; or (c) investigate, prevent, or address fraud, security, or technical issues.

4.3 Business transfers

If Reimbursable is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (for example, by email or by a notice on the Service) before your information becomes subject to a different privacy policy.

4.4 With your direction

We share information at your direction, such as when you choose to export your data or use a feature that publishes content.

5. Cookies and analytics

We use cookies and similar technologies to keep you logged in, remember preferences, and measure how the Service is used. Most browsers let you refuse or delete cookies; doing so may affect functionality (for example, you may be logged out).

Our analytics provider (Google Analytics) places cookies and collects information such as IP address, pages viewed, and time on page. You can opt out using the Google Analytics Opt-out Browser Add-on.

We do not currently respond to "Do Not Track" browser signals because no industry consensus on how to interpret them yet exists.

6. Security

We use industry-standard safeguards to protect information, including encryption in transit (TLS), encryption at rest for stored files and databases, access controls, and regular review of our infrastructure. No system is perfectly secure, however, and we cannot guarantee the absolute security of your information.

You are responsible for keeping your account credentials confidential. If you believe your account has been compromised, contact us immediately at support@reimbursable.com.

7. Data retention

We retain your account information and uploaded content for as long as your account is active. If you delete your account, we delete or de-identify your personal information within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

Aggregated or de-identified data that cannot reasonably be linked to you may be retained indefinitely.

8. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal information;
• Export a copy of your data;
• Object to or restrict certain processing;
• Opt out of marketing emails (use the unsubscribe link in any email or update your account preferences);
• Lodge a complaint with a data protection authority.

To exercise these rights, email us at support@reimbursable.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling certain requests.

California residents. Under the California Consumer Privacy Act (CCPA/CPRA), California residents have additional rights, including the right to know what categories of personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of "sales" or "sharing" of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

9. Children's privacy

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us with personal information, contact support@reimbursable.com.

10. International users

The Service is operated from the United States, and information we collect is processed and stored in the United States. If you are accessing the Service from outside the United States, you consent to the transfer, processing, and storage of your information in the United States, which may have data-protection rules different from those of your country.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. If we make material changes, we will provide additional notice (for example, by email or through a notice on the Service). Your continued use of the Service after changes take effect means you accept the updated policy.

12. Contact us

If you have questions about this policy or our privacy practices, please contact us:

Good Boys Ventures LLC
Email: support@reimbursable.com
Mailing address: 6333 E Mockingbird Lane, Dallas, TX 75214