Privacy Policy

1 · Effective Date

This Privacy Policy is effective as of August 31, 2026. It explains how Dough (“Dough,” “we,” “us,” or “our”) collects, uses, shares, and protects your information when you use the Dough mobile app, website, and related services (together, the “Service”).

2 · Information We Collect

We collect the following types of information to power your recommendations and rewards analytics:

• Account information — your verified phone number and the profile information you provide. Twilio delivers and verifies sign-in codes; Dough manages your sessions.
• Transaction history — purchase dates, amounts, merchants, and categories from the financial accounts you choose to link, retrieved on a read-only basis through Plaid.
• Credit card account information — connected credit-card accounts, including issuer, Plaid account identifier, product match, account name, and last four digits.
• Rewards, perks, and spending information — estimated points or cash back, category spending, reward outcomes, lineup calculations, benefit periods, perk status choices, and automatic perk-match suggestions produced by Dough.
• Service and diagnostic information — request identifiers, request paths, response status, timing, and other information needed to operate and secure the Service. We do not include raw merchant descriptions or provider secrets in application logs.
• Waitlist information — the email address you submit on the Dough website if you request early access.

We do not collect or store your bank login credentials. See the next section for how account connections work.

3 · Financial Account Connections Through Plaid

Dough uses Plaid Technologies, Inc. (“Plaid”) to connect to your financial accounts. When you link an account, you authorize Dough and Plaid to access selected account and transaction information from the financial institution you choose.

You enter your bank login details directly with Plaid — never with Dough. Dough does not receive, see, or store your bank login credentials. Access is read-only, which means Dough and Plaid cannot move money or make transactions on your accounts.

Plaid collects and handles your information under its own privacy policy. We encourage you to review it here: Plaid Privacy Policy.

4 · How We Use Information

We use the information we collect solely to:

• recommend a connected credit card when you search for or select a merchant;
• optimize your rewards and surface points you may be leaving behind;
• provide spending analytics and insights;
• identify transactions that may correspond to an available card perk and ask you to confirm whether the perk was used through Automatic suggestions, which are enabled by default and can be disabled in Settings;
• operate, maintain, and improve the Service;
• provide customer support and respond to your requests.

We do not use your financial data for advertising, and we do not sell it.

5 · Data Sharing and Disclosure

We do not sell your personal information. We share information only with the service providers who help us run Dough, and only as needed to provide the Service:

• Plaid — to connect and refresh your linked financial accounts.
• Twilio — to deliver and verify sign-in codes to your phone number.
• Map and places providers — to find merchant places while Nearby is open or when you search. Precise coordinates are not stored in your Dough account.
• OpenAI (automatic perk matching) — to classify whether a transaction may correspond to one of your card perks. Automatic suggestions are enabled by default after you accept this disclosure and can be disabled at any time in Settings. Dough sends a sanitized merchant descriptor, Plaid category labels, reviewed perk terms, and one-time opaque candidate tokens. Dough does not send your name, email, account or card identifiers, card number or mask, balances, location, transaction amount or exact date, or full transaction history. Requests use the Responses API with storage disabled and are permitted only through an OpenAI project approved and configured for Zero Data Retention. Dough never marks a perk Used automatically.
• OpenAI (Ask Dough) — when you ask a question, Dough sends your message, recent conversation turns, and the relevant card rules, benefit terms or status, and purchase reward estimates needed to answer. Your own message may contain personal information. Selected evidence may include merchant descriptions, purchase amounts or dates, and card product names; Dough does not send account credentials or full card numbers. Requests use storage-disabled API calls. Conversation history stays in memory for the current app session and clears on sign-out. Dough retains the final structured answer and a request hash for reliable retries and usage accounting until account deletion. Ask Dough does not change transactions or redeem benefits.
• Cloud hosting providers — to store and process application data.

These providers are bound by contracts that limit their use of your information to providing services to us. We may also disclose information when required by law, to comply with legal process, or to protect the rights, safety, and security of our users or the Service. If Dough is ever involved in a merger, acquisition, or sale of assets, we will notify you before your information becomes subject to a different privacy policy.

6 · Data Retention

We keep your information only as long as we need it to provide the Service and for the purposes described in this policy. Linked account and transaction data is retained while your account is active so we can deliver recommendations and analytics.

Current perk periods and your confirmed status history are retained while your account is active. Unresolved or rejected matching evidence and bounded provider metadata are removed no later than 90 days after the relevant benefit period ends. For automatic perk matching, Dough does not store OpenAI prompt or response bodies. Ask Dough retains structured answer receipts as described above.

If you disconnect an institution, Dough revokes the Plaid connection and removes its locally stored cards, transactions, and derived reward results. When you delete your account, Dough revokes connected Plaid items, revokes every active session and removes local account data. Short-lived hashed abuse counters and verification receipts may be retained to protect sign-in; limited records may also be retained where required by law.

7 · Data Security

We use encrypted transport, access controls, and encrypted storage for Plaid access tokens. Access to personal and financial data is limited to authorized systems and personnel who need it to operate the Service. No method of transmission or storage can be guaranteed completely secure.

8 · User Rights and Choices

You have control over your information. Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• request a copy of your data in a portable format;
• delete your information;
• object to or restrict certain processing.

Automatic perk suggestions are enabled by default after you accept this disclosure. You can turn them off at any time in the Dough app’s You tab under Settings and later correct a perk status. Turning suggestions off prevents new automated classifications and removes unconfirmed Pending suggestions from your account.

You can exercise these rights from within the app or by emailing us at hello@autocard.dev. We will not discriminate against you for exercising your privacy rights.

9 · Disconnecting Linked Accounts

You can disconnect any linked financial institution at any time. In the app, open the You tab, choose Connected cards, and disconnect the institution. Disconnecting revokes Dough's access through that Plaid Item.

You can also revoke access directly through Plaid at my.plaid.com. After you disconnect, we stop retrieving new data and handle previously collected data as described in Data Retention.

10 · Data Deletion Requests

You can request deletion of your personal information at any time. Use Delete account from the app's You tab, or email us at hello@autocard.dev. In-app deletion revokes linked Plaid Items, revokes active sessions and deletes local account data, apart from the short-lived security record and records we are legally required to retain.

11 · Children's Privacy

Dough is not intended for anyone under the age of 18, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@autocard.dev.

12 · Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect, and we will update the Effective Date at the top of this policy. Your continued use of the Service after an update means you accept the revised policy.

13 · Contact Information

If you have questions, concerns, or requests about this Privacy Policy or your information, please reach out:

• Dough Privacy Team
• Email: hello@autocard.dev

We aim to respond to all privacy inquiries within 30 days. For general questions, email us at hello@autocard.dev.