CEO Hero

Privacy Policy — Investments

Applies to investments.ceohero.com · Version 1.0 · 3 August 2026

This policy covers the CEO Hero Investments application, where you connect your business bank accounts so we can deliver bookkeeping and financial reporting. It sits alongside CEO Hero's general privacy policy and takes precedence for anything concerning bank data.

The short version. We retrieve your business bank transactions and balances to do your bookkeeping and show you your numbers. We never see or store your bank credentials. We do not sell your data or share it with anyone outside the providers listed below. You can disconnect and have your data deleted at any time.

1. Bank data we collect

When you connect an account, we retrieve from your financial institution through Plaid:

Transaction date, description, merchant name and amount
Account name, type and last four digits
Current and available balances
The institution's name

We retrieve up to 24 months of history when you first connect, and new transactions afterwards.

2. What we never receive

Your bank username and password are never seen, transmitted or stored by this application. You enter them inside Plaid's own secure window, which communicates directly with your bank. We receive only an access token that permits reading the data listed above. We cannot move money, initiate payments, or make any change to your accounts — the access is read-only.

3. How we use it

To categorise your income and expenses as part of your bookkeeping
To produce your reporting: revenue by month, spending by vendor, cash position and profitability
To answer your questions about your own figures

We do not use your data for lending, credit or underwriting decisions, for marketing, for training machine-learning models, or for any purpose other than delivering your bookkeeping service.

4. Consent

We record your explicit consent before any bank connection can begin. The wording you agreed to, and the date, are stored so both of us have a record. You can withdraw consent at any time in the application, which immediately prevents any new account being connected.

5. Who we share it with

We do not sell your data, and we do not share it for advertising. It is handled only by the providers required to run the service:

Provider	Purpose	What they handle
Plaid Inc.	Bank connectivity	Your bank authentication and the transaction data retrieved. See Plaid's privacy policy.
Cloudflare, Inc.	Hosting, database, security	Stores the application data, encrypted at rest.

We will disclose data if legally compelled, and will tell you unless prohibited from doing so.

6. Security

Encrypted in transit (TLS 1.3) and at rest
Two-factor authentication on accounts with access to bank data
Access tokens held server-side only, never sent to your browser
Every access to financial data recorded in an audit log

7. How long we keep it

While you are a client, and for up to seven years afterwards where required for accounting records. Where you request deletion and no legal obligation requires us to keep it, we delete it on request instead.

8. Your rights

Disconnect any bank at any time, in the application.
Deletion — we revoke the connection at Plaid and delete your stored transactions and balances. Actioned within 30 days, normally the same day.
Access — request a copy of what we hold about you.
Correction — ask us to fix anything inaccurate.

When you delete, we retain only the record that consent was given and later revoked. That contains no transaction data, and exists so we can demonstrate we handled your data lawfully.

9. Changes

If we change how bank data is used, we will ask for your consent again rather than relying on the consent you gave to earlier wording.

10. Contact

Questions, access requests or deletion requests: support@ceohero.com.