Privacy Policy

Who we are

WhatIF Machine (“we,” “our,” or “us”) provides financial analysis, budgeting, forecasting, and reporting tools for nonprofit organizations. We are committed to protecting the privacy of the organizations and staff who use our platform. This Privacy Policy explains how we collect, use, safeguard, and delete your information.

Information we collect

We collect information you provide directly:

• Organization name, contact details, and account credentials;

• Financial documents you upload for analysis (income statements, balance sheets, budgets, Form 990s);

• Financial data synced from a connected accounting system, if you choose to connect one (see “QuickBooks Online data” below);

• Organization context and profile information you enter manually;

• Messages and questions you submit through Ask WhatIF.

We also collect usage data such as features accessed, actions taken within the platform, and technical information about your browser and device.

How we use your information

We use your information solely to provide the WhatIF Machine service:

• To analyze your financial documents and data and generate insights, health scores, forecasts, and projections;

• To power AI-assisted features including Ask WhatIF, Board Reports, Budget Builder, and Grant Writer;

• To send transactional emails (account notifications, document upload confirmations, report alerts);

• To improve the accuracy and reliability of our platform.

We do not sell your data to third parties. We do not use your financial documents or data for advertising.

AI processing

WhatIF Machine uses Anthropic’s Claude to extract data from your financial documents and to generate analysis, insights, and narratives. When documents or data are processed, their content is transmitted to Anthropic over encrypted connections. Anthropic is contractually prohibited from using API inputs and outputs to train or improve its models. Your financial data is never used to train AI models that are shared with other customers or companies. No human at Anthropic reviews your documents in the ordinary course of processing.

The underlying Base44 platform on which WhatIF Machine runs may use additional third-party subprocessors to operate its infrastructure. A current list of Base44’s subprocessors is available from Base44, and a Data Processing Agreement is available on request (see “Your rights”).

QuickBooks Online data

This section applies only if you choose to connect a QuickBooks Online account. Connecting is optional.

• Read-only access. When you connect QuickBooks Online, we access your accounting data on a read-only basis through Intuit’s official API. We never write to, modify, or delete anything in your QuickBooks account.

• What we access. We access financial data necessary for reporting and analysis — profit and loss data, balance sheet data, and associated account and transaction information. We do not access data that is unrelated to financial reporting.

• How we use it. QuickBooks-derived data is used only to populate your dashboard and to generate the reports, insights, and analysis you request within WhatIF Machine. It is subject to the same AI-processing terms and security protections as any other financial data you provide.

• Storage. QuickBooks-derived data is stored within your organization’s isolated, access-controlled records, described under “Data security” below.

• Disconnecting and deletion. You may disconnect QuickBooks Online at any time, which stops all further access. You may request deletion of QuickBooks-derived data as described under “Data retention and deletion.”

Data security

All financial documents and extracted data are encrypted at rest using AES-256 encryption and in transit using TLS (TLS 1.2 minimum, TLS 1.3 preferred). Uploaded documents are stored in private, access-controlled cloud storage and are never publicly accessible.

Access to your organization’s financial data is enforced by row-level security at the database layer: financial records are scoped to your organization, and a query from one organization cannot access records belonging to another. Within your organization, access is limited to the organization owner, active invited members, and administrators.

Our underlying infrastructure is provided by Base44, whose platform is independently certified to SOC 2 Type II and ISO 27001 standards and is subject to regular penetration testing. Base44’s certifications describe the security of the underlying platform; they are not certifications held by WhatIF Machine directly.

Data storage location

All data is stored on servers located in the United States. If you have legal or regulatory requirements to store data outside the United States, please review your needs carefully before using the Service.

Data retention and deletion

You may delete your organization’s records at any time from within the Service. Deleting a record removes it from your organization’s data within the platform.

Uploaded source files (for example, the original PDF or spreadsheet you uploaded) are held in underlying storage and are removed on request. To have your uploaded source files and QuickBooks-derived data permanently deleted from storage, contact us at support@whatifmachine.ai and we will process the deletion. We do not automatically purge your data on a fixed timeline — you remain in control of when it is removed. Self-serve file deletion is on our roadmap.

Your rights

You may request a copy of the personal data we hold about you, and you may request correction or deletion of your personal data, at any time. A Data Processing Agreement is available on request. To exercise these rights, contact us at the address below.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification before they take effect.

Contact

For privacy questions or data requests, contact us at support@whatifmachine.ai.