Privacy Notice

1. Information we collect and why

• Account and institution information: name, email, authentication information, user identifiers, institution, role and membership, used for accounts, sign-in and access management. Authentication is handled through our authentication provider; never send passwords in support messages.
• Voice and work: microphone audio during enabled sessions, transcripts, prompts, AI responses, mission inputs, plans, summaries, reports and call participation, used for voice interaction, collaboration, modeling, AI summaries, saved work and conversation recovery.
• Applications, bookings and support: contact details, role, pilot goals, dates, questions and communications, used to respond, arrange sessions, deliver requested reports and support you.
• Usage, device and security information: voice duration and allowances, session identifiers, preview milestones, browser/device information, IP addresses and access or diagnostic logs where collected by hosting and service providers, used for operation, product improvement, preview measurement, troubleshooting, limits and abuse prevention.
• Purchase and governance records: subscription references, plan, seats, status, billing periods, consent versions, approvals and audit events, used to manage access, demonstrate authorization and meet legal and security obligations.

Optional preview submissions and permission-based communications use the information and consent you provide. Essential information is needed for the corresponding feature. Do not submit identifiable banking customer records, credentials or payment-card information in prompts or conversations.

2. Legal bases

Where law requires a legal basis, we rely on contract performance for requested accounts, voice, saved work, bookings and subscription access; legitimate interests for security, support, abuse prevention and understanding usage, balanced against your rights; legal obligations for required compliance records; and consent where required for microphone processing, optional communications or non-essential tracking.

Withdraw consent for future processing by ending voice capture, changing browser permissions or contacting us. Withdrawal does not affect prior lawful processing or records retained on another lawful basis.

3. Voice and AI processing

Live audio and conversation content are transmitted through our service and Lovable's AI gateway to AI providers, including OpenAI models, for responses and requested tasks. Group calls share audio and participation information with participants. Some experiences use browser-provided speech recognition; the browser or its provider may process audio under its own privacy terms.

Transcripts and mission text may be processed to generate summaries, reports and dashboards. Signed-in work can be saved to your account; browser storage can retain drafts and interrupted-conversation transcripts for recovery. Processing is not solely local or confined to your institution. Provider processing and retention follow applicable provider terms; we do not promise zero retention or that providers never use information for model improvement.

3-D supports human decisions and is not intended to make automated decisions producing legal or similarly significant effects about individuals.

4. Recipients

• Service providers: hosting, database and authentication through Lovable Cloud; AI gateway and model providers; email delivery, diagnostics and support tooling. Social sign-in providers process information when selected. Google Fonts supplies fonts and may receive ordinary connection details.
• Authorized collaborators: invited participants and institution members or administrators, according to the shared feature and their permissions.
• Paddle: our Merchant of Record, for sales, subscription management, payments, tax compliance and invoicing. Payment information is handled under Paddle's Privacy Policy. We keep transaction and subscription references, not the full card number entered into Paddle checkout.
• Professional advisers and authorities: legal and accounting advisers, regulators, courts or public authorities where legally required or necessary to protect lawful rights and security.

We do not sell personal information or share it for cross-context behavioral advertising. A lawful business transfer may involve records transferred to a successor subject to appropriate safeguards and notice.

5. Retention and deletion

Account and saved-work information is kept while your account is active and needed to provide the service, or until deletion is requested, subject to lawful exceptions. Applications, bookings and support records are kept while needed for the request and follow-up. Usage and diagnostic information is retained for service operation, security and billing or access questions.

Subscription, consent and audit records may be kept longer for accounting, legal compliance, security, fraud prevention or disputes. Retention depends on purpose, sensitivity, applicable law and limitation periods; no single fixed period covers all categories. Information is deleted or anonymized when no longer needed for these purposes.

Available saved-work controls delete individual items. Contact us for account-wide deletion or retention questions. Deleting an item does not necessarily immediately remove backups, emailed reports, local checkpoints or provider-held records. Clearing site data removes browser-stored drafts and checkpoints, but may sign you out and delete unsaved work.

6. Cookies and browser storage

3-D uses browser storage and, where used by authentication or hosting providers, essential cookies for sign-in, security, preferences, drafts and recovery. Anonymous preview milestones help understand walkthrough completion; they are not advertising cookies.

The app does not currently implement advertising cookies or a general third-party analytics-cookie tool. Paddle checkout, social sign-in and other third-party services have their own cookie policies. If we introduce non-essential analytics or marketing cookies, we will provide notice and preference controls and obtain consent where required before use.

Manage cookies and site storage in browser settings, and microphone access in browser or device permissions. Blocking essential storage may prevent sign-in or recovery. End the call or revoke microphone permission to stop voice capture.

7. Security and international processing

We are committed to appropriate technical and organizational measures, including encrypted transport, authentication, scoped access controls and authorization checks. No service can guarantee absolute security; notify us of suspected unauthorized access. We do not claim voice is end-to-end encrypted between participants and AI providers.

We operate from Arizona, United States. Providers may process information in the United States and other countries with different privacy laws. Where UK or EEA transfer rules apply, transfers must use appropriate safeguards, such as adequacy decisions or standard contractual clauses, as applicable. Contact us for the safeguards applicable to your data.

8. Privacy rights

Depending on your location and law, you may request access, correction, deletion, restriction or a portable copy of your information, object to certain processing and withdraw consent. Applicable opt-out rights for sale, sharing or targeted advertising remain available, though we do not currently conduct those activities. We do not discriminate for exercising privacy rights.

Email elijah@ainativebankinglab.ai. We may verify identity and authority without asking for your password. We respond within the applicable legal deadline; GDPR requests are normally answered within one month, with any permitted extension explained within that month.

UK and EEA individuals may complain to their local data-protection supervisory authority; others may contact their relevant privacy regulator. For information controlled by your institution, we may direct a request to its authorized administrator where appropriate.

9. Children and updates

3-D is a business service for adults, not directed to children under 18. Contact us if a child has submitted information so we can investigate and address it.

We may update this notice as the service or law changes. The effective date appears above; material changes receive notice where required.