Privacy Policy

Effective Date: October 20, 2026

Common Umbrella (“Common Umbrella,” “we,” “us,” or “our”) provides tools that help individuals and businesses organize, understand, and manage business formation, ownership, compliance, documents, projects, and financial information.

This Privacy Policy explains what information we collect, why we collect it, how we use and disclose it, and the choices available to you when you use the Common Umbrella website, application, and related services (collectively, the “Service”).

1. Information We Collect

The information we collect depends on which parts of Common Umbrella you use.

Account information

When you create or use a Common Umbrella account, we may collect information such as your name, email address, profile image, authentication information, and information needed to maintain your account and sessions.

If you sign in using Google, we receive information made available through the Google sign-in process, such as your name, email address, and profile information.

We may also process technical information associated with authentication and security, such as IP address, browser or device information, session identifiers, and authentication events.

Personal and business information

Common Umbrella is designed to maintain records about you and the businesses you operate or manage. Depending on how you use the Service, this may include your legal name, business names, trade names, business descriptions, addresses, mailing addresses, registered office information, state of formation, formation and filing dates, state identification numbers, ownership percentages, members, managers, organizers, registered agents, business relationships, projects, filing status, compliance information, and business shutdown information.

Some of this information may concern other people whom you identify as owners, managers, members, organizers, registered agents, or other participants in a business. You should provide information about another person only when you are authorized to do so.

Tax identification information

If you choose to provide it, Common Umbrella may store sensitive tax identification information, including an Employer Identification Number (“EIN”) or Social Security number (“SSN”).

We treat these identifiers as sensitive information. Full tax identifiers are encrypted at rest, and the Service generally uses only the last four digits unless access to the full identifier is necessary. We may maintain security records relating to access or attempted access to sensitive identifiers.

Checking your business and identity with Palm

To find your business in state records, confirm that you can act for it, and watch its state record for changes and filing due dates, we use Palm (PalmFinance, Inc.). When you search for a business, we send Palm the business name and state. When you confirm your identity, we send Palm your name, date of birth, Social Security number, and address, along with the business you are claiming. Palm checks them against government and other records. Your Social Security number will be sent to the Internal Revenue Service (IRS) and kept by Palm. We ask you to agree before we send these details, and we keep a record of each time you agree.

Palm handles this information under its own privacy policy and our agreement with Palm. Palm may keep the information it receives, use it to provide and improve its services, including to develop and train its artificial intelligence models, and may contact you directly when it needs to give you its own notices or ask for your consent. Deleting information from Common Umbrella does not delete Palm's copy.

Documents

You may upload business and legal documents, including formation documents, EIN letters, operating agreements, filing receipts, and related records.

We may store the original document, information about the document, text extracted from its pages, information extracted from the document, and your corrections or confirmations of extracted information.

Uploaded documents are stored in private storage and are scanned for malware before being made available through the Service. Extracted page text is encrypted at rest.

Our current document extraction system processes uploaded documents on infrastructure operated for Common Umbrella. We do not currently send the contents of uploaded documents, extracted document text, or extracted values to third-party artificial intelligence or OCR providers, except an agreement you choose to have read, which is sent to Anthropic as described in “Agreements you ask us to read”.

We do not use your documents to train third-party artificial intelligence models.

Bank and card information

If you choose to connect a bank or card account, Common Umbrella uses Stripe to establish the connection. Connections made earlier may use Plaid.

Common Umbrella does not receive the username and password you use to authenticate directly with your financial institution. That authentication is handled through Stripe (or Plaid, for those earlier connections) and the relevant financial institution.

Depending on the accounts you authorize, we may receive and store information such as the financial institution name, account name, account type, partial account number, currency, transaction dates, transaction amounts, transaction descriptions, merchant names, transaction categories, transaction status, and related transaction information.

Common Umbrella may retrieve historical transactions and periodically refresh connected accounts while the connection remains active.

We use this information to help you identify business and personal activity, associate transactions with businesses and projects, categorize expenses, identify transfers and related transactions, and prepare financial views within the Service.

To suggest how to categorize your transactions, Common Umbrella sends limited transaction information to TypeSafe, an artificial intelligence service. For each transaction, we send the merchant name (or, when there is none, the bank's description with account numbers, email addresses, phone numbers and similar identifiers removed), the amount as a range rather than the exact amount, the category your bank assigned when there is one, and the names and short descriptions of your projects. Each business and project is labelled with a disguised identifier. Businesses are described only generically (for example, “Company 1”), never by their names. As examples, we also send some of your earlier answers: the merchant name (or cleaned description) of a charge you already categorized, whether you chose Personal or a business or project (businesses labelled the same generic way, projects by name), and, for a business charge, the expense category you chose.

We do not send TypeSafe the email address on your account, account names or numbers, your bank login, or company display names. We do not send your name, transaction dates or locations as separate details, but a bank description can still include text printed on your statement, such as a date, a city or a name. Project names and descriptions are sent as you wrote them, so leave out anything you would not want shared. A suggestion never counts in your financial information until you confirm it. TypeSafe's documentation says it does not train its model on customer requests or responses.

Agreements you ask us to read

When you upload an agreement on the Partners page, or choose “Use as a partner agreement” on one of your documents, we send that file to Anthropic's Claude to suggest its terms, such as the partner, the dates, and the prices. We send only that file, and nothing else from your account, such as your name or email. A suggestion is saved only when you save it. We never send other documents.

Anthropic's commercial terms don't allow it to train its models on the files we send. Anthropic deletes them from its systems within 30 days. It may keep a file longer, up to 2 years, if its automated safety systems flag it as possibly violating its usage policy, or where the law requires. The copy in Common Umbrella stays in your Documents until you delete it.

Stripe information

If you connect a Stripe account, we may receive information available through the permissions you authorize, including information about your Stripe account, products, prices, payments, refunds, disputes, fees, payouts, currencies, and related transaction information.

We use this information to provide project attribution and financial reporting features within Common Umbrella.

Connection credentials and tokens used to access Stripe are encrypted at rest.

App Store and Google Play information

If you connect an Apple App Store Connect or Google Play account, we may collect information required to access the account and its financial reports.

For Apple, this may include an issuer ID, key ID, vendor number, and App Store Connect API private key. Private keys are encrypted at rest.

For Google Play, you sign in with a Google account that can see your Play Console reports and allow Common Umbrella read-only access to Google Cloud Storage. We use this access only to read the financial reports in the Play Console report location you give us. We cannot change or delete anything. We keep a long-lived token from Google that lets us keep reading these reports, encrypted at rest, along with the permissions Google granted and the Google account's email address and account identifier, so you can see which account a connection uses.

When you disconnect Google Play and no other connection uses that Google account, we delete the token and ask Google to cancel the access. If someone else using Common Umbrella has also signed in with that Google account, or Google does not confirm, the access may stay active at Google. If you sign in with Google but don't finish connecting, the token is kept until you connect and later disconnect, or until you ask us to delete it. In every case, you can remove the access at any time from the third-party access settings in your Google Account.

We may import information from store reports such as app identifiers, product identifiers, app or product titles, sales, refunds, units, developer proceeds, fees, taxes, currencies, countries, reporting periods, and other fields provided in the store's financial reports.

We use this information to associate app revenue with businesses and projects and to provide financial reporting within Common Umbrella.

Address information

When you enter an address, we may use Google Places or Google Address Validation to help autocomplete, verify, normalize, or confirm the address. Information necessary to perform that verification is sent to Google.

Information we receive from Google

Common Umbrella's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use information from Google, such as your sign-in details and Google Play reports, only to provide the features you use and to keep them secure. We do not sell it, use it for advertising, or use it to train artificial intelligence models.

We do not send information from Google to TypeSafe, Anthropic, or any other artificial intelligence service. It is stored with our hosting and infrastructure providers only to run the Service, and is not otherwise shared except as needed for security or to comply with the law.

People at Common Umbrella do not view it unless you give us permission to view specific information (for example, in a support request), it is needed for security purposes such as investigating abuse, or it is required to comply with the law.

Google Play reports you imported stay in Common Umbrella after you disconnect, until you delete them with “Delete imported history” or ask us to delete them. To delete any information we received from Google, including your sign-in details, email privacy@commonumbrella.com.

Communications

If you contact us, request support, or otherwise communicate with us, we may retain the contents of those communications and information necessary to respond to you.

We also use service providers such as Resend to deliver transactional messages such as email verification and password reset emails.

2. How We Use Information

We use personal information to operate and provide Common Umbrella; authenticate users and secure accounts; maintain records about people, businesses, ownership, projects, and compliance obligations; store and process documents; provide financial and business-management tools; connect to services that you instruct us to connect to; calculate and display financial information; help organize transactions and revenue by business or project; suggest how to categorize bank and card transactions, which you confirm before they count; validate addresses; provide customer support; detect, investigate, and prevent fraud, abuse, malware, security incidents, and unauthorized access; maintain and improve the reliability and functionality of the Service; comply with applicable law; and protect the rights, safety, and security of Common Umbrella, our users, and others.

Financial information displayed by Common Umbrella is provided as an organizational and informational tool. It is not intended to constitute accounting, tax, legal, investment, or other professional advice.

3. How We Disclose Information

We do not sell your personal information.

We do not share personal information for cross-context behavioral advertising or use your financial, tax, business, or document information to target advertising to you.

We disclose information when necessary to provide services that you request. Depending on the features you use, these recipients may include infrastructure and hosting providers; Cloudflare for private document storage; Cloudflare Turnstile to check that integration requests come from a person; Stripe for bank and card connections and Stripe integrations; Plaid for existing bank and card connections; TypeSafe for suggestions about how to categorize bank and card transactions; Anthropic for reading agreements you choose to have read; Palm for checking business records and identity and for watching state records; Apple for App Store Connect integrations; Google for authentication, address services, Google Play integrations, and related Google services; Resend for transactional email delivery; and other service providers that help us operate, secure, and maintain Common Umbrella.

When you connect a third-party service, information may also be processed by that third party in accordance with its own terms and privacy policy.

We may disclose information if we reasonably believe disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; enforce our agreements; investigate fraud or security incidents; or protect the rights, property, or safety of Common Umbrella, our users, or others.

If Common Umbrella or substantially all of its assets are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law. Information received from Google APIs will be transferred in such a transaction only with your explicit prior consent.

4. Financial Account Connections

Connecting a bank, card, Stripe, App Store, or Google Play account is optional.

For bank and card connections, Stripe facilitates access to information from your financial institution. Some existing connections use Plaid instead. Stripe's and Plaid's processing of your information is governed by their own privacy notices and terms.

Transaction information from these connections is also used to suggest how to categorize your transactions, as described in section 1 under “Bank and card information.” Only the limited information described there is sent to TypeSafe, and a suggestion never counts until you confirm it.

Common Umbrella stores encrypted access credentials or tokens where needed to maintain integrations. These credentials are used only to provide the connection and features you request.

Disconnecting an integration stops Common Umbrella from continuing to obtain new information through that connection, subject to the technical steps required to revoke the connection with the applicable provider.

Different integrations have different retention behavior because the underlying providers make historical information available differently.

When you disconnect a bank or card connection, imported accounts and transaction records associated with that connection are removed from Common Umbrella. Rules and classifications that you created yourself, such as merchant categorization rules, may remain.

When you disconnect Stripe, financial information imported from Stripe is removed and can be re-imported if you reconnect. Project assignments and other information that you created in Common Umbrella may remain.

When you disconnect an App Store or Google Play account, Common Umbrella removes the credentials used to access that account (for Google Play, as described under “App Store and Google Play information”) but retains previously imported store history by default. We retain this history because certain historical reports, particularly Apple daily reports, may later become unavailable from the source. You may separately request or use available controls to delete imported store history.

5. Document Processing

Documents uploaded to Common Umbrella may contain sensitive information such as legal names, home or business addresses, tax identifiers, ownership information, and government filing numbers.

Documents are stored privately and are not made publicly accessible through Common Umbrella's storage configuration.

We use automated systems to scan documents for malware and, where supported, read document text and suggest information that may be relevant to your business record.

Extracted information is presented as a suggestion where appropriate. You are responsible for reviewing information before relying on it.

Our current extraction workflow does not send document contents to third-party AI or OCR providers, except agreements you choose to have read (see “Agreements you ask us to read”). (Bank transaction suggestions are covered above.) If we materially change this practice in the future, we will update this Privacy Policy and provide any notice or consent required by applicable law.

6. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain your records, comply with legal obligations, resolve disputes, enforce agreements, protect the Service, and fulfill the purposes described in this Privacy Policy.

Retention also depends on the type of information and the feature involved.

Deleting an uploaded document removes the document and associated extraction data, including stored page text and extracted facts, subject to ordinary backup and recovery processes.

Bank and card transaction data associated with a connection is removed when that connection is revoked, although user-created categorization rules may remain.

Stripe-imported financial information is removed when the applicable Stripe connection ends, while user-created project information and assignments may remain.

App Store and Google Play financial history is retained after disconnect unless you delete the imported history or the business or personal record that owns it is deleted. This retention is intentional because some store history may no longer be available from the original provider later.

Information sent to Palm is kept by Palm under its own policies, as described in “Checking your business and identity with Palm.”

We may retain limited security, audit, transaction, or legal records where reasonably necessary even after other information has been removed.

7. Security

Common Umbrella uses administrative, technical, and organizational measures designed to protect personal information.

Current safeguards include encrypted storage of tax identifiers and integration credentials; private storage for uploaded documents; encryption of extracted document text; malware scanning of uploaded files; secure cookies in production; access controls based on authenticated users and business membership; limited storage credentials; and measures designed to prevent sensitive information, credentials, document contents, and provider error responses from appearing in application logs.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

If you believe your Common Umbrella account or information has been compromised, contact us promptly at privacy@commonumbrella.com.

8. Your Choices and Privacy Rights

You can choose whether to connect third-party services and can disconnect supported integrations through Common Umbrella.

You may also update certain business, personal, project, and classification information through the Service.

Depending on where you live and which privacy laws apply to Common Umbrella, you may have rights regarding your personal information, including rights to request access to or information about personal information we maintain; request correction; request deletion; obtain a copy of certain information; or appeal or otherwise challenge our response to a privacy request.

Because Common Umbrella does not sell personal information or share it for cross-context behavioral advertising, we do not currently offer a sale or targeted-advertising opt-out.

To submit a privacy request, contact privacy@commonumbrella.com. We may need to verify your identity before fulfilling a request. Certain information may be exempt from deletion or other requests where permitted by law, including information we must retain for legal, security, fraud-prevention, or recordkeeping purposes.

We will not discriminate against you for exercising privacy rights provided by applicable law.

9. Cookies and Similar Technologies

Common Umbrella uses cookies and similar technologies necessary to authenticate users, maintain sessions, secure the Service, and remember information needed for the operation of the application.

The form for requesting a new integration loads Cloudflare Turnstile, which receives your IP address and processes browser and device signals to tell people from bots. We do not use Turnstile anywhere else in the Service.

The current Service does not use personal information for third-party behavioral advertising.

If we introduce additional analytics, advertising, or tracking technologies, we will update this Privacy Policy and provide any controls required by applicable law.

10. Information About Other People

Common Umbrella may allow you to enter information about business co-owners, members, managers, registered agents, organizers, employees, contractors, or other people associated with your business.

You are responsible for ensuring that you have an appropriate basis to provide that information to Common Umbrella and for providing any notices to those individuals that may be required by law.

11. Third-Party Services

The Service may connect to or contain links to services provided by third parties.

Common Umbrella does not control the privacy or security practices of those third parties. Their collection and use of information is governed by their own agreements and privacy policies.

We encourage you to review the privacy practices of services you choose to connect to Common Umbrella.

12. Children's Privacy

Common Umbrella is a business-management service and is not directed to children under 13.

We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Common Umbrella, please contact us so that we can address the information appropriately.

13. Changes to This Privacy Policy

We may update this Privacy Policy as Common Umbrella evolves.

When we make changes, we will update the effective date above. If a change materially affects how we collect, use, or disclose personal information, we will provide additional notice when required by law or when we believe additional notice is appropriate.

14. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or a request concerning your information, contact:

Common Umbrella / Focus Pocus, LLC
Email: privacy@commonumbrella.com
Mailing address: 418 Broadway
Ste N
Albany, NY 12207-2950