Privacy policy

Crossmarc Steward is a private family-office platform operated by Crossmarc, LLC, a Colorado limited liability company ("Crossmarc," "we," "us," or "our"). This policy describes how we collect, use, store, and protect personal and financial information when you use the Steward platform at steward.crossmarc.com and the associated web application.

If you have questions about this policy, contact us at privacy@steward.crossmarc.com.

We collect information in two ways: information you provide directly, and information collected automatically.

Information you provide: name, email address, and any content you upload or enter, including document files, entity descriptions, account labels, and notes. We also collect billing information when you subscribe, processed through a third-party payment provider (Stripe).

Information collected automatically: data from financial institutions you connect through Plaid, such as balances, holdings, and liability details (see Section 4); authentication tokens; and access logs (IP address, browser type, timestamp), kept for a limited time for security purposes.

We do not collect sensitive personal information beyond what is necessary to provide the service (e.g., social security numbers, passport numbers). If you choose to store such information in your document vault, it is encrypted and access-controlled as described in Section 5.

We use the information we collect solely to:

• Provide, maintain, and improve the Steward platform;
• Authenticate you and enforce the access controls you configure;
• Aggregate and display your financial data in your net-worth dashboard;
• Answer questions and perform tasks requested of the optional in-app AI assistant by you or someone you have authorized to access your workspace (see Section 4);
• Send transactional communications (e.g., account verification, security alerts);
• Process billing and subscription management;
• Investigate security incidents and enforce our terms of service.

We do not use your data for advertising or profiling, and neither we nor our AI provider use it to train machine-learning models. We do not sell, rent, or share your personal or financial data with any third party for their marketing purposes.

To operate Steward we rely on a small number of service providers that process data on our behalf, for example cloud hosting and infrastructure, payment processing, financial-account aggregation, and property valuation. We share only the data each provider needs to perform its function, under contracts that restrict them to that purpose, and not for their own marketing. A current, named list of these sub-processors, including what each does and what data it receives, is maintained at steward.crossmarc.com/subprocessors.

Financial-account connections (Plaid). If you choose to connect financial institutions, we use Plaid Technologies, Inc. to establish and maintain those connections, which may include retrieval of account information such as balances, holdings, and transactions. Plaid acts as a data processor on our behalf and is subject to its own End User Privacy Policy. The connection is read-only: neither Plaid nor Steward can initiate transactions or modify your accounts.

Your bank credentials are entered directly on a Plaid-hosted interface and are not transmitted to, accessed by, or stored by Crossmarc. Plaid holds SOC 2 Type II certification and maintains data-access agreements directly with financial institutions.

You can disconnect any institution at any time within Steward. We then revoke the corresponding Plaid access token and stop requesting data from that institution.

Property valuations. If you enable automated valuation for a real-estate asset, the property address you enter is sent to our property-valuation provider to retrieve an estimated market value. Only the property address is shared, not your account balances, holdings, documents, or other financial information. This is optional: real-estate assets set to a stated or appraised value do not transmit an address to the valuation provider.

Address suggestions. When you type a property address, what you have typed so far is sent to our address-lookup provider, Amazon Location Service, so it can offer matching suggestions. This happens as you type, for any real-estate asset, whichever valuation method you have chosen. If you pick a suggestion, we retrieve the full address and store it with the property. Nothing else about the property or your finances is sent. Typing the address yourself always works, and if you ignore the suggestions nothing is sent at all. Amazon Location Service draws on third-party mapping providers, and some requests may be processed outside the United States.

AI assistant. Steward includes an optional AI assistant that can answer questions about your workspace. When you ask it a question, details from your workspace such as names, balances, and document titles are provided to a third-party AI model as context for that answer. Credential-vault secrets are not included. The model runs on our cloud provider's AI service, under our own account: your data is not shared with the model's developer, is not retained by the model service after the response is generated, and is not used to train AI models. The current AI model provider is listed on our Sub-processors page. The assistant processes your data only when you, or someone you have authorized to access your workspace, ask it a question or direct it to perform a task. Conversations are kept for a limited time, as described in Section 6.

Except as required by law or as necessary to defend legal claims, we do not share your personal or financial data with any third party for their own purposes. We do not sell it.

Your data is encrypted in transit and at rest, and secrets in the credential vault receive an additional layer of encryption.

Access to your data is restricted to the members you explicitly invite, and Steward uses multi-factor authentication to protect it. Crossmarc staff do not access the contents of your workspace or document vault without your authorization, except where necessary to investigate a security incident, to resolve a problem, or to comply with the law.

If you connect an advisory firm, their access is read-only unless you ask for more. You may choose to let a firm add and update documents in the one folder you share with them; they still cannot delete or move anything, and they cannot change anything else in your workspace. You can turn that off, or end the connection entirely, at any time.

For more on how we protect your data, see our security overview.

We retain your account data and documents for as long as your subscription is active. Access logs are kept for a limited time for security purposes and then deleted.

When your subscription ends, your account is suspended. If you do not reactivate your subscription, we may mark your account and all its data for permanent deletion after a period of suspension. You may request permanent deletion of your account data at any time (during or after cancellation), and we will remove it from our active production systems promptly. Once your data is deleted, copies may remain for a short time in encrypted, access-controlled backups until they are cycled out; backups are used only for disaster recovery.

Conversations with the optional AI assistant are deleted automatically after a period without activity. You can also delete any conversation yourself in the app.

You have the right to access, correct, export, or delete your personal information at any time. To exercise these rights, contact us at privacy@steward.crossmarc.com. We will respond within 30 days. We will never deny you service, charge a different price, or provide a different level of service because you exercised any of these rights.

California residents (CCPA / CPRA). Regardless of whether we meet the statutory thresholds, we honor the rights California law provides: the right to know what personal information we hold, to access and port it, to correct it, and to request its deletion. We do not "sell" or "share" your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising.

EEA / UK residents (GDPR / UK GDPR). Our legal bases for processing are: performance of a contract (to deliver the platform you subscribe to); legitimate interests (to secure and operate the service, including access logging); consent (to connect a financial institution through Plaid, which you may withdraw at any time by disconnecting that institution; and to process your workspace data through the AI assistant when you, or someone you have authorized to access your workspace, ask it a question or direct it to perform a task, which you may withdraw at any time by ceasing to use the assistant, deleting your conversations, and removing access for anyone you have authorized); and legal obligation where applicable. You also have the right to object to or restrict processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority.

This marketing site does not use tracking cookies or third-party analytics. The Steward application uses session cookies strictly necessary for authentication. We do not use advertising cookies.

We may update this policy from time to time. Material changes will be communicated to active subscribers by email at least 30 days before taking effect. Continued use of Steward after that date constitutes acceptance of the revised policy.

Crossmarc, LLC
privacy@steward.crossmarc.com

For general inquiries: steward.crossmarc.com/contact