Legal
Privacy Notice
Effective date: September 14, 2026 · Version 1.0
Who we are
ValuePilot is operated by ICP Systems LLC (“ValuePilot,” “we,” “us”), the business responsible for the personal information described in this Notice. You can reach us, including for data protection inquiries, through the ValuePilot Legal Center.
About this Notice
This Notice explains how we collect, use, disclose, protect, and retain personal information across the ValuePilot website, customer and administrative portals, ValuePilot applications (including ExecutePilot, FutureCircle, GrubBudget, and PriceDropMonitor-AI), mobile applications, APIs, support, and billing services that link to it. Supplemental notices may apply to a specific product, feature, jurisdiction, or information category.
Information we collect
Depending on the service and your permissions, we may collect: identity and contact details, which includes name, address, phone number, and email; account and security information, including usernames, passwords, and security questions; commercial and subscription information, including service subscriptions, and purchase information; payment-related information; information your applications supply; FutureCircle community information; technical and device information, including IP addresses, browser types, and device identifiers; usage information, specifically interaction with our services, and features used; approximate location based on device settings; AI-interaction information, specifically, data related to your interactions with AI features; support communications; and information from authorized third parties. We do not collect every category from every user, and we obtain your explicit consent when required, especially for sensitive information.
Categories, sources, and purposes
For residents of states that require a notice at collection, we make available the categories of personal information collected, the sources, the business or commercial purposes for each, and the categories of recipients.
The categories we collect, and how we handle them, are set out below. We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, in any of the categories listed. Retention for each category is described under “Retention” below.
| Category | Examples | Sources | Business or commercial purposes | Categories of recipients |
|---|---|---|---|---|
| Identifiers | Name, email, phone, postal address, username/account name, IP address, device and online identifiers. | You; your devices; applications you connect; authorized third parties. | Create and secure accounts; deliver and support the services; communicate with you; detect and prevent fraud or misuse; comply with law. | Service providers/processors; authentication and security providers; legal or government authorities where required. |
| Customer records (Cal. Civ. Code §1798.80(e)) | Name, address, telephone number, and payment-related or financial-account information. | You; your payment processor. | Process and reconcile subscriptions, invoices, payments, refunds, and disputes; provide support. | Payment/billing processors (e.g., Stripe); service providers; authorities where required. |
| Commercial information | Subscriptions and services purchased, purchase history, and entitlements. | You; your use of the services. | Process and synchronize subscriptions and entitlements; billing; authorized alerts and decision support. | Payment/billing processors; service providers. |
| Internet or other electronic network activity | Interactions with the services, features used, AI-interaction data, FutureCircle community activity, browser type. | Automatically from your use of the services; your devices. | Operate, secure, and improve the services; generate alerts and decision support; operate community features; reliability. | Hosting, analytics, and security providers; other users (for content you choose to share publicly). |
| Geolocation data (approximate) | Approximate location derived from device settings or IP address (not precise geolocation). | Your device. | Provide location-relevant features; security and fraud prevention. | Mapping and service providers. |
| Inferences | Preferences and characteristics derived from AI features and usage to generate recommendations, alerts, scores, and summaries. | Derived by us from the categories above. | Decision support and personalization of alerts; service reliability and improvement. | Service providers (e.g., AI and hosting providers). |
| Sensitive personal information | Account log-in credentials (username in combination with a password or security answers). | You. | Authentication and account security only; used solely to perform the service and to prevent fraud, not to infer characteristics. | Authentication and security providers. |
We do not collect biometric information, characteristics of protected classifications, professional or employment information, or education information. Because we use Sensitive Personal Information only for authentication and security, we do not use or disclose it for purposes that would require offering the “Limit the Use of My Sensitive Personal Information” right; where that determination changes, the corresponding control is provided.
How we use information
We use information to create and secure accounts; deliver products and support; process and reconcile subscriptions, invoices, payments, refunds, credits, and disputes; maintain product and entitlement synchronization; generate authorized alerts and decision support; operate FutureCircle; communicate with you; detect and prevent misuse; maintain consent and audit evidence; improve service reliability; and comply with law.
AI and automated outputs
Some features use AI, statistical, rules-based, and automated systems that may generate recommendations, alerts, predictions, scores, summaries, suggested actions, or synthetic content. Outputs may contain errors and are not guarantees or professional advice, and material decisions should be independently reviewed. Where we use your information to improve or train AI models, and where you may request human review of an automated decision, we describe this in our AI Transparency Notice.
Model improvement and training
We may use de-identified or aggregated information, and the content of your AI interactions, to improve and train our AI models; where required we obtain your consent or offer a choice, as described in our AI Transparency Notice.
Automated decisions
Where an automated decision produces a legal or similarly significant effect concerning you, you may request human review, an explanation of the decision, and an opportunity to contest it by contacting the ValuePilot Legal Center.
Cookies and similar technologies
Essential technologies support authentication, security, preferences, performance, and operation. Analytics, personalization, and advertising technologies are governed by our Cookie & Tracking Notice and the applicable consent controls.
Third-party services
Authorized providers may support payment, hosting, email, authentication, analytics, communications, mapping, retail information, AI, and security. Stripe may process payment methods, billing addresses, subscriptions, and automatic payments. Plaid is not the customer payment portal; any internal vendor-cost use remains outside the customer billing experience unless separately disclosed and authorized.
How we disclose information
We may disclose information to authorized processors acting on our instructions; to an administering organization under its permissions; at your direction; to prevent harm or fraud; to comply with law; or in a governed business transaction. We do not sell personal information for money. Where a disclosure meets a legal definition of sale, sharing, or targeted advertising, we provide the applicable notice and opt-out.
Your privacy choices — sale, sharing, and targeted advertising
Where applicable, you may exercise Do Not Sell or Share My Personal Information and, where we process sensitive personal information, Limit the Use of My Sensitive Personal Information. We recognize the Global Privacy Control (GPC) and equivalent opt-out preference signals as a valid opt-out request where required.
Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption, access control, multifactor authentication, monitoring, audit logging, secure development, backup, and incident response. No system can be guaranteed completely secure.
Retention
We retain information only as long as reasonably necessary for service delivery, security, contractual and legal obligations, disputes, audit evidence, and legitimate operations, according to a governed retention schedule by data class. Closing your account does not require immediate deletion of records subject to financial, fraud, security, litigation-hold, contractual, audit, or legal requirements.
Our governed retention baseline by data class is set out below. Where a record falls into more than one class, the longest applicable period controls.
| Data class | Retention period |
|---|---|
| Account and profile information | Duration of your account; deleted or de-identified within ninety (90) days of closure, unless a longer period is required by law or an active legal hold. |
| Authentication and security credentials | Duration of your account; invalidated upon closure. |
| Transaction, billing, and payment records | Seven (7) years, to meet tax, accounting, audit, and financial-recordkeeping obligations. |
| Subscription and entitlement records | Duration of the subscription, then retained for the financial-records period above. |
| Support communications | Twenty-four (24) to thirty-six (36) months after resolution. |
| Technical, device, and usage logs | Twelve (12) to twenty-four (24) months. |
| Security, audit, and consent-evidence records | Twenty-four (24) months to seven (7) years, per the governed retention schedule and legal-hold requirements. |
| FutureCircle community content | Until you delete it or your account is closed, subject to backup cycles and legal holds. |
| AI-interaction data | Twelve (12) to twenty-four (24) months, or as described in the AI Transparency Notice. |
| Marketing and communication preferences | Until you opt out; suppression records are retained to honor your opt-out. |
| Backups | Rolling thirty-five (35) days, after which data ages out of routine backups. |
Your rights and choices
Depending on your jurisdiction, you may request access, correction, deletion, portability, disclosure of processing, withdrawal of consent, restriction, objection, or opt-out. We may verify your identity and authority, honor authorized-agent requests where required, and apply lawful exemptions.
If you are a resident of certain U.S. states with comprehensive privacy laws (such as California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others), you have specific rights regarding how your requests are handled:
Authorized Agents: You can designate an authorized agent to submit requests on your behalf. To protect your data, we require the agent to provide written, signed permission from you confirming their authority. We may also ask you to verify your own identity directly with us or confirm that you provided the agent permission.
Right to Appeal:If we deny your privacy request, you have the right to appeal our decision. You must submit your appeal within 60 days of receiving our denial notice. We will review your request and respond in writing within the timeframe required by your state’s law (typically 45 to 60 days), explaining the reasons for our decision. If your appeal is denied, we will provide you with a mechanism to contact your state’s Attorney General.
How to exercise your rights
Submit requests through the ValuePilot Legal Center or the privacy channels identified there. We will respond within the timeframes required by applicable law and will not discriminate against you for exercising your rights.
Communications
You may opt out of eligible promotional messages; transactional, security, billing, legal, and service communications may continue. Changing your ValuePilot email address requires verification and governed synchronization and does not automatically change independently maintained third-party records.
Children
The ValuePilot ecosystem is intended for adults age 18 or older, unless a specific service expressly provides a legally compliant alternative. We will address information collected from a child in violation of applicable requirements.
International users
ValuePilot is operated from the United States, and availability varies by jurisdiction. If you are located outside the United States, please be aware that the information we collect will be transferred to, processed, and stored in the United States. Where information is transferred from a jurisdiction that restricts outbound transfers (such as the European Economic Area, the United Kingdom, or Switzerland), we ensure a valid legal basis for the transfer. Specifically, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and/or Standard Contractual Clauses approved by the European Commission (and the relevant equivalent mechanisms for the UK and Switzerland) to provide appropriate safeguards for your personal data. We also provide jurisdiction-specific notices or rights where required by applicable law.
Changes to this Notice
The current Notice shows its effective date and version above. Material changes will be accompanied by additional notice or renewed consent where required. Prior versions and consent evidence remain governed records.
Contact and Legal Center
Questions, rights requests, policy versions, accessibility, security information, and opt-out choices are handled through the ValuePilot Legal Center and counsel-approved privacy contact channels.