Legal
Privacy Policy
Effective May 24, 2026
The short version
- We collect the minimum we need to run the apps you use.
- We don't sell your data to anyone, ever.
- We don't run third-party advertising or analytics trackers.
- You can ask for a copy of your data, or to delete it, any time.
This is the privacy policy for Esposito Holdings and all of our micro-apps — the ones listed on our apps page. It's written in plain English because that's how policies should be.
What we collect
If you don't have an account: when you visit espositoholdings.com or any of our apps, our hosting provider (Amazon Web Services) records your IP address, the page you requested, and your browser's user-agent in access logs. These are kept for 90 days for security and debugging, then deleted.
If you create an account: we store your email address, your name (whatever you typed in the signup form), and a salted hash of your password. We never see your raw password.
If you subscribe to a paid plan: we manage your subscription, plan, and what you have access to through VellumCharter, our own billing and entitlements platform. Card payments are handled by our payment processor (Stripe) — we never see your card number, only the last four digits, the brand, and an opaque customer ID used to look up your subscription.
Inside the apps: each app stores whatever data you put into it (transactions in CashFlower, documents in SimpleDocs, etc.). That data is yours. We don't analyze it for any purpose other than running the app for you.
Cookies
We only set cookies that are essential to making the service work: a session cookie when you're logged in, and CSRF protection. We don't use cookies for analytics, advertising, or anything else.
Third parties we share data with
- Amazon Web Services — hosting, storage, transactional email, and AI inference via AWS Bedrock. When you use an AI-powered feature (like AI-suggested classification tags in SimpleDocs), the relevant content is sent to a foundation model on Bedrock, processed, and returned. AWS does not retain prompts or completions or use them for model training, per the AWS Bedrock service terms.
- Stripe — payment processing for paid plans.
We don't share your data with anyone else. We're not in the business of selling user information and we never will be.
Your rights
You can:
- See what we have about you — email us and we'll send you a copy.
- Delete your account and all associated data — from
/account/, or by emailing us. - Correct anything that's wrong — same email.
- Get a copy of your data from any app — email us and we'll send you an export.
We aim to respond within 14 days. There's no fee.
How long we keep things
- Account data and app data: as long as your account exists. Deleted within 30 days of account deletion.
- Payment records: kept for 7 years for tax and legal reasons, even after account deletion.
- Server logs: 90 days.
Children
Our services aren't intended for anyone under 13. If you think we have data about a child, email us and we'll delete it.
Changes to this policy
If we make material changes, we'll email registered users and update the effective date at the top. The current version always lives at this URL.
Contact
Questions? hello@espositoholdings.com.
Esposito Holdings is a limited liability company organized under the laws of Illinois, located in DuPage County, Illinois, USA.