Privacy at Bank Spree

Effective September 10, 2026. Bank Spree is operated by Dork Duty Studios, LLC. This policy explains how Bank Spree handles personal and connected financial data at bankspree.com.

Information Bank Spree handles

Bank Spree handles account identity and profile information, the offers and Sprees you choose to track, financial-institution and account metadata, normalized transaction activity needed to evaluate requirements and detect rewards, the latest balance you explicitly request, consent and connection status, confirmed Earnings, billing enrollment, and payment outcomes. Bank Spree does not collect or store online-banking usernames or passwords, and Stripe—not Bank Spree—stores full payment-card details.

Sources and purposes

Information comes from you, your use of Bank Spree, Plaid and the financial institutions you authorize, and service providers involved in authentication, billing, security, and delivery. It is used to authenticate you, connect accounts with consent, track frozen promotional requirements, explain progress, identify rewards, provide billing, prevent abuse, support the service, and meet legal obligations. Bank Spree does not use AI to decide financial qualification.

Disclosure and sale

Bank Spree discloses information to service providers only as needed to operate the service, follow your instructions, secure the platform, process billing, or comply with law. Bank Spree does not sell personal or financial information and does not share it for cross-context behavioral advertising. Financial institutions independently control offer eligibility, qualification, and payout decisions.

Security

Bank Spree uses encrypted transport, managed encryption at rest, server-only provider credentials, multi-factor authentication for critical systems, least-privilege access, row-level owner isolation, signed provider webhooks, dependency review, and tested authorization boundaries. No internet service can guarantee absolute security.

Your choices and rights

Connecting an account is optional and requires explicit consent. You can decline connection, inspect tracked activity, disconnect a provider connection, and request access, correction, portability, or deletion where applicable. Bank Spree verifies request ownership and responds promptly, generally within 30 days. If a request is denied, you may reply to appeal the decision.

Service providers

Bank Spree currently relies on these subprocessors and operational providers. Their role is limited to providing the stated service.

Plaid: Connects financial institutions and supplies consented account, transaction, and on-demand balance data.
Supabase: Provides authentication, database, and encrypted managed storage.
Vercel: Hosts and delivers the Bank Spree web application.
Stripe: Processes subscriptions, PAYG billing, and payment credentials.
Resend: Delivers service and operational email.
Squarespace and Google: Provide domain, forwarding, and monitored privacy-request email services.

Retention schedule

Connected financial data

While consent is active and needed for tracking. After a verified deletion request, provider access is revoked first and unnecessary accounts, balances, transactions, evidence, and incomplete tracking are deleted promptly and no later than 30 days.

Confirmed Earnings and billing records

A minimized record of amount, currency, date, offer context, and payment outcome is retained for seven years for accounting, tax, refund, dispute, and fraud-prevention obligations.

Consent and deletion records

Revoked consent records and pseudonymous deletion-completion receipts are retained for three years to demonstrate that requests and revocation were honored.

Security and operational records

Minimized security, webhook, and operational records are retained for up to 12 months unless a specific incident or legal obligation requires a documented hold.

Account and profile

Retained while the account is open. A verified full-account deletion request is completed promptly and no later than 30 days, subject to the limited legal records described above.

Encrypted backups

Deleted database data may remain inaccessible in encrypted recovery backups until the configured backup window expires, never longer than 30 days. It is not used for ordinary operations and is re-deleted if a backup is restored.

Deletion process

A signed-in user can request financial-data deletion from Settings. Bank Spree first asks Plaid to remove each Item, stops future ingestion, and deletes the encrypted access token. It then deletes provider-derived data and records a pseudonymous completion receipt. Confirmed Earnings and required billing records are detached from the deleted provider evidence and retained only under the schedule above.

Policy changes

Material changes will be posted here with a new effective date. When required, Bank Spree will provide additional notice or request renewed consent before a new use takes effect.

Contact and requests

Email privacy@bankspree.com for privacy questions or a verified full-account request. You can also use the authenticated financial-data deletion control in Bank Spree Settings. Do not email bank credentials, account numbers, or payment-card details.