Privacy Policy

3.1 Who we are; scope

This Privacy Policy describes how ThinkNirvana LLC handles information in connection with Plan Vector. Plan Vector is a business-to-business service for institutional subscribers; it is not directed to consumers or plan participants.

3.2 The dataset is built from public filings

The plan and sponsor information in the Service is derived from public U.S. Department of Labor Form 5500 filings and their schedules — records that pertain to employee benefit plans and their sponsoring employers (business entities) and that the government publishes. To the extent an individual's name appears in the analytics (for example, a plan-administrator contact listed in a public filing), it originates from those public government records. We do not assemble profiles of individual consumers, and the Service is not a consumer report.

3.3 Information we collect from subscribers

To operate the Service we collect: (a) account and access data — the authorized user's work email and organization, used for identity-verified sign-in and entitlement; (b) usage data — logs of queries, filters, and features used, for security, auditing, and Service operation; and (c) billing data — processed by our payment processor; we do not store full payment-card numbers.

3.4 How we use information

We use it to provide, secure, audit, support, and improve the Service; to administer subscriptions and billing; to enforce these Terms and our access controls; and to comply with law.

3.5 Separation from Fiduciary Shield

Plan Vector runs on separate systems from Fiduciary Shield. Plan Vector has no access to Shield users' entered data — inputs, queries, or session parameters — and is built solely from public Form 5500 filings. Information provided by plan sponsors to Fiduciary Shield is not used in, and is not shared with, Plan Vector. The two products maintain separate data stores and credentials.

3.6 How information is shared; subprocessors

We do not sell personal information, and we do not use advertising trackers. We share information only with service providers that help us run the Service, under contract and for these purposes: cloud hosting and storage [Google Cloud Platform]; access/identity and edge security [Cloudflare]; session/entitlement storage [Upstash]; email delivery for sign-in [Resend]; payment processing [Stripe]; and AI-assisted playbook generation [Anthropic]. AI-assisted generation operates on the public filing data and the request context; the AI provider does not train on this data. We may also disclose information if required by law or to protect rights and safety.

3.7 Retention

We retain account, usage, and audit data for as long as needed to operate the Service, meet legal and security obligations, and maintain the audit trail, then delete or de-identify it.

3.8 Security

We use technical and organizational measures appropriate to the data, including identity-verified access, allowlisting, transport encryption, and least-privilege credentials scoped to the Service's own resources. No system is perfectly secure.

3.9 Your choices; rights

Authorized users may request access to, correction of, or deletion of their account information by contacting us. Requests that concern data in a public government filing may need to be directed to the source agency, as we present that public record rather than originate it. To the extent applicable privacy laws grant rights, we will honor them; [state-specific rights language to be finalized: [●]].

3.10 Changes; contact

We may update this Policy; material changes will be notified. Questions or requests: legal@thinknirvana.org.