Legal Agreements & Information

Legal information and agreements related to the use of Understatement. Last updated 2026-09-25.

Definitions
Disputes
Terms of Service
Privacy Policy
Cookies
Security and data handling policies
- Data retention and deletion
Copyright
Contact

Definitions

Key terms used in these legal agreements and information.

"Understatement", "we", "us", and "our" mean Micah R Ledbetter and Hannah Lindsley, doing business as Understatement.
"Service" means the Understatement website, application, and related services.
"Understatement profile" means you ruser profile with the service, including your login credentials, subscription, preferences, linked bank accounts, personal information, and other data.
"You", "your", and "user" mean the person using the service and when applicable the organization on whose behalf that person acts.

Disputes

Please contact us directly before initiating a dispute with your payment provider.
We will work to resolve any issues and process refunds when appropriate.
If you file a chargeback with your payment provider, we will respond only through the chargeback dispute process, and we will not be able to issue refunds outside of that dispute process.

Terms of Service

By using Understatement, you agree to these terms. If you do not agree with any of these terms, you are prohibited from using Understatement.

You must own or control the bank accounts you connect to Understatement, or be explicitly authorized to connect them by the owner or controller.
You authorize the service to retrieve information from the bank accounts you connect, including but not limited to account numbers, routing numbers, information about the bank, and official bank statements. You grant the service limited permission necessary to retrieve, copy, store, and deliver this information. You retain ownership of your documents and your data.
You must be at least 18, legally capable of agreeing, and located in the United States.
You may not assign these Terms without our written consent. We may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of the Service or substantially all related assets.
This service operates under Texas law, and disputes will be resolved in Travis County, Texas unless otherwise agreed to in writing.
You are responsible for the security of your Understatement profile credentials and any activity that occurs under your Understatement profile.
You agree not to abuse the service, or use the service to abuse or harm others, or engage in any illegal activity. Unauthorized access, scraping, and interference with legitimate use is prohibited.
You have the right to access, correct, and delete your personal information stored by Understatement, subject to verification and applicable law.
You acknowledge that the bank or API provider may return inaccurate or incomplete information, and you agree not to hold Understatement liable for this.
Either you or Understatement can cancel a subscription at any time for any reason. Cancelled subscriptions do not entitle you to a refund, except where refunds are required by law.
Your Understatement profile may be immediately terminated for violations of these terms.
When service is canceled by either party for a user in good standing, the service continues until the end of the current billing period. When service is canceled by either party for an Understatement profile not in good standing, including overdue payments, violations of the terms, or abuse, the service may be terminated immediately.
Disconnecting a bank account prevents Understatement from retrieving new bank statements from that account, but may not delete previously retrieved statements or other data. Disconnecting a bank account, or all bank accounts, does not delete your Understatement profile.
Service is offered on an as-is basis. You assumes all risk of connecting bank accounts, making payments, storing bank statements and PII, and retrieving bank statements to the maximum extent permitted by law. Understatement offers no warranty, even implied.
Understatement is not a bank or accounting service, and does not provide financial advice.
Understatement's liability is limited to a refund of one month's subscription fee or $10, whichever is greater, to the maximum extend permitted by law.
Recurring subscriptions are billed monthly.
Price changes will be announced with 30 days of notice to existing customers.
We provide security incident notifications as required by applicable law.
You acknowledge and agree to the privacy policy below
These (including the privacy policy) are the entire service terms. If any are unenforceable, the rest will remain.
Our failure to enforce any provision of these Terms is not a waiver of our right to enforce it later.
These terms can be changed at any time for any reason. Users with active subscriptions will be notified of material changes.
We may provide notices through the Service or by email to the address associated with your Understatement profile. You may send legal notices to support@understatement.app

Privacy Policy

We collect information from you during Understatement profile sign up, including your name, email address, and any other information you provide during the registration process.
We receive information about you and your bank accounts from our vendors and service providers including Plaid and Stripe, including but not limited to: your name and other identifying information; bank account information such as institution names and identifiers, account numbers, routing numbers, and account types; official bank statements which include full account numbers, detailed transaction history, and balances; identifiers that connect you to your data and activity such as customer identifiers; and payment information such as checkout session details, subscription identifiers and status, cancellation information, invoice and payment status details.
Our vendors and service providers may also collect and process information about you and your bank accounts as described in their respective privacy policies.
We store tokens that allow Understatement to retrieve information from your connected banks. These are encrypted at rest.
We store pseudonymous identifiers (salted cryptographic hashes) of account and routing numbers to uniquely identify bank accounts. These unique identifiers allow us to recognize accounts across different connections without storing the raw numbers for this purpose.
We store official bank statements encrypted at rest. These are official bank statements that include whatever personal and financial information is contained in those documents, which may include full account numbers (separate from our hashed identifiers), balances, transaction history including identity of payers and payees, and other sensitive information. We do not modify these documents in any way before encryption.
We receive and store logs of notifications from our third-party services, including notification about bank connections, errors, consent expiration, availability of new data, payment status, billing names, email addresses, physical addresses, phone numbers, and other relevant events. These logs may be retained indefinitely or deleted at any time, at our discretion.
We store analytics and logs related to user activity and system events, which may include user identifiers, IP addresses, browser information, and timestamps. These logs may be retained indefinitely or deleted at any time, at our discretion.
We use transport encryption to protect information in transit.
We disclose information to law enforcement as required by law, and may cooperate with legal requests and investigations to the extent permitted by law.
We retain data for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. For Understatement profiles with no active subscription, data may be deleted at any time. To request data deletion, email support@understatement.app.
When your Understatement profile is deleted, and/or if you request data deletion, we will remove your data except where retention is required by law or for legitimate business purposes. Backup copies kept for recovery are not edited to remove individual users, so your data may remain in those backups after deletion from the live service.
We do not sell personal information or use it for targeted advertising.
We use the data we collect to authenticate users; connect and maintain bank accounts; discover, retrieve, store, and provide bank statements; administer subscriptions; provide support; prevent fraude and abuse; and comply with the law.
We may disclose personal information to third parties as necessary to provide our services, comply with legal obligations, or protect our rights and the rights of others.
We provide your information to Plaid to authenticate users, connect bank accounts, retrieve bank statements, and comply with our obligations to them.
We provide your information to Stripe to process payments, manage subscriptions, collect unpaid invoices, and comply with our obligations to them.
We provide your information to analytics providers to help us understand how our services are used and to improve them, and to comply with our obligations to them.
We may provide your information to professional advisors, such as lawyers and accountants, as necessary to provide our services, comply with legal obligations, or protect our rights and the rights of others.
We use third party infrastructure services, including cloud hosting providers, to store and process your information. These providers may have access to your information as necessary to provide their services.

Cookies

We use cookies for authentication, session management, and analytics.

Security and data handling policies

These policies cover Understatement and the systems used to run it. The maintainers own them.

Information security

We identify security risks through reports, code and dependency review, and operational checks. We track significant risks in private issues, decide how to reduce them based on likely impact, and follow up on the work. Our controls include application access checks, encrypted statements, and backups. We review the program at least annually and adjust it when we learn about new risks.

Access control

We give people access to application administration, infrastructure, source code, and secrets only when needed for their work, with the least privilege practical. We remove access when it is no longer needed. We review who has access and this policy at least annually and when someone's role changes.

Vulnerabilities and unsupported software

We review reported vulnerabilities and check whether production dependencies and operating systems are still supported at least quarterly. For identified vulnerabilities affecting production, we patch critical or high severity issues within 30 days and other issues within 90 days when a fix is available. If no fix is available or a deadline cannot be met, we document the reason and a mitigation in a private issue, and revisit it until resolved. We replace unsupported software or document how we will limit the resulting risk.

Data retention and deletion

Understatement keeps customer profiles, connected-bank information, and statements while needed to provide the service. We may also retain data to meet legal obligations, resolve disputes, prevent abuse, or enforce agreements; notification and activity logs may be kept indefinitely. We may delete data for profiles without an active subscription at any time. Disconnecting a bank stops new retrieval but does not delete stored data. To request deletion, email support@understatement.app. After verifying a request, we remove the person's data from the live service except what we need for the purposes above. Backups kept for recovery are not edited to remove individual users and currently have no automatic expiry, so copies may remain after live data is deleted. We review this policy at least annually.

Copyright

Contact

support@understatement.app