Privacy Policy

1. Introduction

FEEDUCIARY LLC (“FEEDUCIARY,” “we,” “our,” or “us”) operates the website at 401kfeeduciary.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Full name, work email address, password
• Plan information: 401(k) plan name, Employer Identification Number (EIN), your role (plan sponsor, administrator, advisor, etc.)
• Fee data: Total plan assets, number of participants, annual fees, and fee breakdowns you enter to generate benchmark reports
• Documents you upload: 408(b)(2) fee disclosures, Form 5500 filings, service agreements, fund lineup reports, and spreadsheets you submit for analysis
• RFP data: Provider names, quoted fees, service terms, and notes you enter into the RFP comparison tool
• Organization data (Enterprise): Organization name and type, and the plans you add to a multi-plan book of business
• Billing information: Processed via Stripe; we do not store credit card numbers on our servers
• Communications: Messages you send us via email or the contact form, including enterprise inquiries
• Phone number: Collected only if you request an introduction to an advisor (Section 5) or submit an enterprise inquiry. It is never required to create an account, generate a report, or otherwise use the Service.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, clicks
• Device data: IP address, browser type and version, operating system
• Cookies: Authentication tokens and session cookies required for the Service to function; analytics cookies (see Section 8)

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Generate 401(k) fee benchmark reports for your plan
• Process payments and manage your subscription through Stripe
• Send transactional emails (account confirmation, password reset, billing receipts)
• Respond to your support requests
• Monitor and analyze usage to improve the Service
• Detect and prevent fraud or misuse
• Comply with applicable laws and regulations
• Contact you about our own products and services — including offers to perform a more in-depth fee benchmarking review, assist with a formal Request for Proposal (RFP) process, or discuss other FEEDUCIARY services. See Section 4.

We do not sell, rent, or license your personal information or your plan data to anyone. We do not share it with third-party advertisers, data brokers, or advertising networks, and we do not use it to target you with third-party advertising. The only circumstance in which your information goes to an outside firm for that firm's own use is an advisor introduction you specifically request, for which we receive no payment of any kind — see Section 5.

4. Marketing and Business Communications

When you create an account, request a benchmark report, use the RFP tool, or submit an inquiry, you provide us with information about you and your plan. We may use that information — including your name, email address, role, company, and the plan details and fee figures you enter — to contact you about FEEDUCIARY's own products and services. This may include:

• Offering to conduct a more in-depth or independently reviewed fee benchmarking analysis
• Offering to assist with a formal recordkeeper Request for Proposal (RFP) process
• Telling you about new features, tools, pricing, or educational content
• Following up on a report you generated, a document you uploaded, or an inquiry you submitted

These messages may reference the plan information you provided — for example, we may contact you because your benchmark results indicated fees above the market range. We do not provide your information to any third party for that third party's own marketing purposes. The one situation in which we share your information with an outside firm is when you ask us to connect you with an independent advisor — described in Section 5, and only with your authorization.

Your choice. Every marketing email includes an unsubscribe link, and you may opt out at any time by using that link or by emailing help@401kfeeduciary.com. Opting out is free and takes effect promptly. If you opt out, we will still send you transactional messages that are necessary to operate your account — such as account confirmations, password resets, security notices, and billing receipts — because these are not marketing messages.

5. Referrals to Independent Advisors

FEEDUCIARY provides benchmarking and RFP tools. We are not an investment adviser and we do not provide advisory services. If you tell us you want hands-on help that goes beyond what our tools do — for example, running a full recordkeeper search, renegotiating with an incumbent provider, or reviewing a fund lineup — we can introduce you to an independent third-party advisor team.

We share your information for this purpose only when you ask us to and authorize it. We do not pass your information to an advisor because your benchmark results looked unfavorable, because you fit a profile, or on any other basis of our own choosing. If you never request an introduction, your information is never shared for this purpose.

You make this request through the “Speak With an Advisor About Your Plan” form in your dashboard. That form asks you to confirm, in a separate checkbox, that you authorize the sharing described here. We record the exact wording you agreed to and the date and time you agreed to it, so that both you and we have a clear record of what was authorized.

When you do authorize an introduction, we may share the information relevant to the help you asked for. Depending on the request, that can include your name, email address, phone number, role, and company; your plan name, EIN, asset and participant figures; the fee data and benchmark results you generated; and documents you uploaded, such as a 408(b)(2) disclosure or Form 5500.

An introduction requires a phone number. Because the point of an introduction is a conversation, requesting one means providing a phone number and agreeing that we and the advisor team may contact you there, including by call or text, about your retirement plan. This permission applies only to this request; it is never required to create an account, generate a report, or use any other part of the Service, and it is not a condition of any purchase. You can stop contact at any time by telling the caller or emailing help@401kfeeduciary.com. If you would rather not be called, simply don't request an introduction — nothing else about your account changes.

What happens next is outside our control. Once we make the introduction, the advisor team handles your information as an independent business under its own privacy policy and its own legal and regulatory obligations. They may contact you directly. They are not our agent or subcontractor, and we are not responsible for how they use or retain your information. We encourage you to review their privacy policy and their Form ADV before engaging them.

We receive no compensation for these referrals. FEEDUCIARY does not charge a referral fee, accept a revenue share, or receive any other consideration for introducing you to an advisor. We are not compensated based on whether you engage them or what you pay them.

Your choice. Requesting an introduction is entirely optional and declining has no effect on your access to the Service or your subscription. If you change your mind before we make an introduction, contact us at help@401kfeeduciary.com and we will not share your information. After an introduction has been made, you will need to contact the advisor team directly regarding data they already hold.

6. Sensitive Data — Plan EIN

Your Employer Identification Number (EIN) is used solely to match your plan to publicly available Form 5500 filing data. It is stored encrypted in our database, never displayed in browser URLs, and never logged to application logs.

When you use a Form 5500 lookup feature, your EIN is transmitted to the U.S. Department of Labor's public EFAST2 filing search service in order to retrieve your plan's own publicly filed data. Apart from that lookup, the service providers listed in Section 7 who process data on our behalf, and any advisor introduction you request under Section 5, we do not share your EIN with third parties except as required by law.

7. How We Share Your Information

We may share your information with:

• Supabase: Our database and authentication provider. Data is stored on servers in the United States.
• Stripe: Payment processor. Subject to Stripe's own Privacy Policy.
• Vercel: Hosting provider for our web application.
• Resend: Transactional and marketing email delivery.
• Anthropic: When you upload a document or spreadsheet for automated analysis, the extracted text is sent to Anthropic's API so that fee figures and data columns can be identified. Anthropic processes this data on our behalf and does not use it to train its models.
• U.S. Department of Labor (EFAST2): Your plan's EIN is submitted to the DOL's public Form 5500 search service when you use a plan lookup feature.
• Analytics providers: Aggregated, anonymized usage data only.
• Independent advisor teams — only if you ask: If you request an introduction to an advisor for hands-on help, we share the relevant information with them. This happens only with your authorization, never automatically, and we receive no compensation for it. See Section 5.

We require all third-party service providers to maintain appropriate security measures and prohibit them from using your information for any purpose other than providing services to us. Apart from an advisor introduction you request under Section 5, we do not share your information with any third party for that third party's own marketing purposes.

We will disclose your information if required by law, court order, or governmental authority.

8. Cookies and Analytics

We use strictly necessary cookies for authentication and session management. We also use privacy-friendly analytics (Vercel Analytics) that do not track individuals across websites and do not require cookie consent under most jurisdictions.

You may disable cookies in your browser settings; however, doing so will prevent you from logging in to the Service.

9. Data Retention

We retain your account and plan data for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or compliance purposes.

Stripe may retain billing records for longer periods as required by financial regulations.

10. Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• Row-Level Security (RLS) policies ensuring users can only access their own data
• Encrypted storage for sensitive fields
• Private storage buckets for uploaded documents
• Regular security reviews

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update inaccurate information via your Profile page or by contacting us
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format
• Opt out of marketing: Unsubscribe from marketing and sales emails at any time, using the link in any such email or by contacting us. This does not affect your access to the Service. See Section 4.
• Decline advisor referrals: We never share your information with an outside advisor unless you ask us to. Declining has no effect on your access to the Service. See Section 5.

To exercise these rights, contact us at help@401kfeeduciary.com.

12. Children's Privacy

The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 14 days before the change takes effect. Continued use of the Service after that date constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: