Privacy Policy

Effective Date: 02/13/26

Last Updated: 07/25/26

CodeWright LLC ("CodeWright," "we," "us," or "our") operates the FiSTWorks platform (the "Service"). This Privacy Policy explains how we collect, use, store, protect, and delete your personal information when you use the Service. By using the Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

When you create an account and use the Service, we collect:

1.2 Information Collected Automatically

When you access the Service, we automatically collect:

• Authentication data — Identity tokens and session information from Clerk.
• Usage data — Features used, files generated, pages visited, and timestamps.
• Device and browser data — IP address, browser type, and operating system (collected by our hosting infrastructure).
• Log data — Server logs including request URLs, response codes, and error information.
• Anonymous validator rate-limit data — If you use the ACH file validator without creating an account, we briefly record your IP address (and set a short-lived cookie) so we can apply a monthly free-use limit. This data is used only to prevent abuse, is retained for 30 days, and is then automatically deleted. Legal basis under GDPR is our legitimate interest in preventing abuse of a free service (Article 6(1)(f)).

1.3 Information from Third Parties

If you connect third-party services, we receive:

• QuickBooks Online — Company name, vendor and customer names, email addresses, bill and invoice details. We do not receive bank account information from QuickBooks.
• Clerk — Your identity claims (name, email, unique identifier) used for authentication.
• Stripe — Subscription status and payment confirmations. We do not receive or store your full credit card number.

2. How We Use Your Information

We use your information only to provide and operate the Service:

We do not:

• Sell your personal information to third parties.
• Use your data for advertising or marketing purposes beyond our own service communications.
• Share your banking or financial data with anyone except as described in Section 4.
• Train AI models on your data.

2.1 Email Communications

We send two categories of email to your account email address:

Transactional emails — file notifications, password-reset codes, security alerts, billing receipts, invitation acceptances, and admin actions. These are necessary to operate your account and are always sent. You cannot opt out of transactional email while your account is active.

Non-transactional emails — product engagement communications including usage tips, feature announcements, and re-engagement messages for accounts that have been inactive. The legal basis under US CAN-SPAM is accurate-header commercial email with a functional opt-out mechanism; under GDPR it is our legitimate interest (Article 6(1)(f)) in helping you get value from a service you have signed up for. You can unsubscribe at any time via the one-click link in any non-transactional email or from your account profile settings. We honor opt-outs immediately (well within CAN-SPAM's ten-business-day requirement).

3. How We Protect Your Information

We implement multiple layers of security to protect your data:

3.1 Encryption

• In transit — All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• At rest — Sensitive fields including bank account numbers, SFTP credentials, and authentication tokens are encrypted in the database using column-level encryption. Encrypted data cannot be read by database administrators or in the event of a database breach.

3.2 Data Masking

• Recipient banking information is protected with data masking so that partial account details are never exposed in application logs, error messages, or support interactions.

3.3 Access Controls

• The Service uses a multi-tenant architecture where each organization's data is strictly isolated.
• User authentication is handled by Clerk with one-time verification codes (passwordless).
• Role-based access controls restrict administrative functions to organization administrators.

3.4 Infrastructure

• The Service is hosted on Microsoft Azure with data stored in Azure SQL Database.
• Our infrastructure benefits from Azure's SOC 1, SOC 2, and ISO 27001 certifications.
• Database backups are encrypted and retained per Azure's standard backup policies.

4. When We Share Your Information

We share your information only in these limited circumstances:

4.1 Service Providers

We use the following third-party services to operate the platform:

These providers process data on our behalf under contractual obligations to protect it. Azure Communication Services operates under a service-provider agreement and does not sell or share email addresses for cross-context behavioral advertising.

4.2 Your SFTP Endpoints

When you transmit ACH files via SFTP, the generated file is delivered to the server you configure. We do not control or monitor your bank's SFTP server.

4.3 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

If CodeWright LLC is acquired, merged, or sells substantially all its assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Retention

5.1 Active Accounts

We retain your data for as long as your account is active and your organization exists, with two exceptions that are cleaned up automatically:

• Activity history: audit trail entries older than 2 years are automatically deleted.
• Stored ACH file contents: the contents of a generated ACH file are automatically removed 1 year after the file was generated. The draft itself remains, and you can clone it to generate a fresh copy whenever you need one.
• Closed accounts: 30 days after you close your individual account, we permanently remove your email address, name, and sign-in identity from our systems (including from our sign-in service). Records of actions you took in an organization are kept for that organization's audit history, but they no longer identify you — they simply show "Deleted User".
• Recipient invitations: invitation records (the recipient's name and email address) are deleted 90 days after the invitation is used or expires.
• Team invitations: when you invite someone to your organization by email, their email address is removed from the invitation record as soon as they accept. Invitations that are never accepted are deleted 90 days after they expire.

Banking rules (the NACHA Operating Rules) may require your business to keep copies of ACH records — typically for six years. That obligation applies to your business as the originator of the payments, so please download and keep your own copies of any files you need for your records.

5.2 Account Closure

When you close your individual account, your profile is immediately removed from active views and your organization memberships are revoked. 30 days later, your email address, name, and sign-in identity are permanently removed, and your past activity is relabeled "Deleted User". See our Account Closure & Data Deletion page for details.

5.3 Organization Closure

When your organization is closed, all organization data enters a 30-day grace period, after which it is permanently and irreversibly deleted. This includes ACH files, recipient records, bank configurations, SFTP profiles, templates, scheduled transmissions, and audit logs. Any connection to your accounting software is also disconnected and its access revoked. See our Account Closure & Data Deletion page for the complete list.

5.4 Billing Records

Subscription and payment records maintained by Stripe are retained independently by Stripe per their data retention policies and applicable tax and legal requirements.

5.5 Server Logs

Infrastructure and application logs are retained for up to 90 days for security and debugging purposes, after which they are automatically deleted.

5.6 Anonymous Validator Rate-Limit Data

If you use the ACH file validator without an account, the IP address you connect from is recorded briefly to enforce a monthly free-use limit (5 files per month). These records are automatically purged 30 days after they are created. No other information from your visit is retained from the anonymous validator — your uploaded ACH files themselves are validated in memory and are never stored, whether you use the validator anonymously or while signed in.

5.7 Email Campaign Send Records

For each non-transactional email we send you, we retain a send record (campaign identifier, date, delivery status) indefinitely as a suppression list so we can honor the "at most once per campaign per recipient" rule and so you do not receive repeat re-engagement messages. If you exercise a right to erasure under Section 6, your user identifier on these records is anonymized; the suppression record itself (hashed email, campaign, date) is retained under legitimate interest to continue honoring your opt-out preferences.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

6.1 Access

You can view your profile information, organization details, and data at any time through the Service.

6.2 Correction

You can update your display name through your Profile settings. To correct other account information, contact us via our Contact page.

6.3 Deletion

You can delete your account and/or organization at any time through the Service. See Account Closure & Data Deletion for the process and timeline.

6.4 Data Portability

You can download a copy of your personal data at any time from your account profile page ("Download my data"). The export is provided immediately as a structured JSON file and includes your profile details, organization memberships, account activity history, consent and email preferences, and the record of marketing emails we have sent you.

The export covers your personal data. It does not include your organization's business records — such as the ACH files, recipients, and bank details created within an organization — because those belong to the organization rather than to you as an individual. Organization administrators can review and export that organization activity separately from the organization's history page. You can also download individual ACH files from the ACH Drafter before closing your account.

To limit exposure of sensitive information, the export does not contain bank account or routing numbers.

6.5 Opt-Out

You may disconnect third-party integrations (such as QuickBooks) at any time from your Organization settings. You may also opt out of non-transactional email at any time via the one-click unsubscribe link in any campaign message or via the Email Preferences card on your account profile settings; transactional email continues regardless of your choice (see Section 2.1).

6.6 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know — You may request details about the categories and specific pieces of personal information we have collected.
• Right to delete — You may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights.
• No sale of personal information — We do not sell personal information as defined by the CCPA.

To exercise any of these rights, contact us via our Contact page.

7. Cookies and Tracking

7.1 Essential Cookies

The Service uses only essential cookies required for the application to function. These cookies cannot be disabled without breaking core functionality.

7.2 Browser Storage

The Service uses browser localStorage (not cookies) for user preferences. This data never leaves your browser and is not transmitted to our servers.

7.3 Advertising Cookies (Opt-In Only)

If you click "Accept All" on our cookie consent banner, we load Google Ads conversion tracking. This allows us to measure whether our ads lead to sign-ups. The following cookies may be set by Google:

What is shared with Google: An anonymous conversion signal indicating that a sign-up occurred. No personally identifiable information (name, email, financial data) is shared.

How to opt out: Click "Essential Only" on the cookie consent banner. If you previously accepted all cookies, clear your browser's localStorage for this site to reset your choice. You can also use your browser's built-in cookie controls to block third-party cookies from googletagmanager.com.

If you click "Essential Only" or have not yet made a choice, no Google scripts are loaded and no advertising cookies are set. All fonts and icons are self-hosted — no requests are made to external CDNs (Google Fonts, jsDelivr, etc.) that could track your IP address.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.

9. International Data Transfers

The Service is hosted in the United States (Microsoft Azure, Central US region). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last Updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

CodeWright LLC PO Box 2264, Centennial, CO 80161 Email: support@fistworks.com Website: Contact Us