Privacy Policy

Effective Date: October 10, 2026

This Privacy Policy explains how Spring Labs, Inc. (“Spring,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Spring’s websites and educational financial-planning services.

1. Information We Collect

Depending on how you use Spring, we may collect the following categories of information.

Account and contact information. This includes your email address, optional display name, invitation and admission status, and records showing that you accepted applicable account or private-beta agreements.

Planning information. This includes savings goals, target amounts and dates, contribution amounts, balance information you enter, expected-return assumptions, planning preferences, tax-profile selections, and other information you choose to provide while creating or updating a plan.

Authentication and security information. This includes sign-in challenge records, session information, and passkey public-key credentials and related metadata. Spring does not receive the fingerprint, face scan, device PIN, or other biometric or local verification information used by your device to unlock a passkey.

Communications. We collect information you provide when contacting support, submitting a form, or otherwise communicating with us.

Technical and security information. When you access Spring, our systems may receive standard request information such as an IP address, browser and device type, timestamps, requested pages, session identifiers, and security events. We use this information to operate, secure, and troubleshoot the service.

Analytics information. If you affirmatively permit analytics, Spring may collect page identifiers, feature interactions, navigation events, campaign attribution, device or browser information, and pseudonymous analytics identifiers. Our analytics implementation is designed not to include invitation tokens, authentication secrets, free-form text, or raw financial values.

2. How We Use Information

We use personal information to:

We do not sell personal information. We do not use personal information for cross-context behavioral advertising.

3. How We Disclose Information

We may disclose personal information:

To service providers. We use providers that support functions such as hosting, database operations, email delivery, security, and analytics. They may process information only for the services they provide to us and subject to applicable contractual restrictions.

At your direction. If you ask Spring to facilitate an introduction or share information with an independent advisor or another third party, we may disclose the information necessary to fulfill that request.

For legal and safety reasons. We may disclose information when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of the service.

In a business transaction. Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate protections.

With your consent. We may disclose information for another purpose that we explain when seeking your permission.

4. Product Analytics and Consent

Spring uses Matomo Cloud to understand how permitted users navigate and interact with the product.

Analytics tracking is disabled until you provide affirmative permission. Before permission is given, Spring does not send tracking requests to Matomo or create a Matomo visitor cookie. If you permit analytics, Spring may use first-party analytics cookies or similar browser storage and may send the analytics information described above to Matomo Cloud.

You can review or withdraw your analytics permission through account settings. Withdrawal stops future analytics collection and cancels unsent analytics events. An active browser Do Not Track setting also prevents Spring from collecting analytics, and Spring does not override that signal.

Private-beta participants are required to permit the limited product analytics described in this policy. If a private-beta participant withdraws that permission, analytics collection stops and private-beta access is paused. Other account holders may decline analytics without losing ordinary access when the applicable program allows it.

Where identifiable raw analytics records remain available, we will make reasonable efforts to honor a valid deletion request. Aggregate or de-identified reports may no longer be capable of being associated with an individual account or browser.

5. Cookies and Browser Storage

Spring uses essential cookies or browser storage for authentication, session management, security, preferences, and other functions necessary to provide the service.

Spring also records your analytics choice so that it can honor that preference. Recording a refusal does not create a Matomo analytics visitor cookie.

When analytics permission is active, Matomo may use first-party cookies to distinguish visits and support aggregate product analysis. Disabling or deleting cookies may affect authentication, saved preferences, or other service functionality.

6. Data Retention

We retain account and planning information while your account is active and for as long afterward as reasonably necessary to provide the service, comply with law, resolve disputes, enforce agreements, protect security, and maintain appropriate business records.

Raw Matomo analytics data is retained for no longer than 13 months. Aggregate analytics reports may be retained for up to 25 months. Aggregate or de-identified information that can no longer reasonably be associated with you may be retained for legitimate analytical or operational purposes.

Security records, communications, and backup copies are retained only for periods reasonably necessary for their purposes and are deleted or de-identified according to our applicable retention processes.

7. Your Choices and Privacy Rights

You may update certain account and planning information through Spring. You may also contact us to request access to, correction of, deletion of, or a copy of personal information associated with you.

Depending on where you live, you may have additional rights, including the right to:

These rights may be subject to identity verification, legal exceptions, record-retention obligations, and limitations under applicable law. We will not unlawfully discriminate against you for exercising a privacy right.

8. Data Security

We use reasonable technical and organizational measures designed to protect personal information from unauthorized access, alteration, disclosure, or destruction.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You should protect access to your email account, devices, and active sessions.

9. Children’s Privacy

Spring is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected such information, we will take reasonable steps to delete it.

10. International Processing

Spring and its service providers may process information in the United States and other countries where they operate. Those countries may have data-protection laws that differ from the laws where you live. Where required, we use appropriate safeguards for international transfers.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes to Spring, our practices, or applicable law. If a change is material, we will provide reasonable notice through the service, by email, or by another appropriate method.

The effective date at the top identifies the current version.

12. Contact

To submit a privacy request or ask a question about this policy, use Spring’s Contact page or email support@springfinance.io.