Legal
Privacy Policy
This policy explains what information Nori Capital LLC, doing business as Nori Cap ("Nori Cap," "we," "us"), collects through heytilo.ai and the Tilo app at app.heytilo.ai (together, "Tilo"), how we use it, who helps us process it, and the choices you have. Questions go to pa@noricap.com.
What we collect
Your account
- Your name, email address and password. We store passwords only as a one-way hash; we can't see them.
- When you sign in, and the companies you belong to and your role in each.
Your company's financial data
- Files you upload, such as a Profit and Loss Detail report, an A/R aging report or a balance sheet. We read each file once and store the transactions and balances in it (dates, accounts, customer and vendor names, memos, reference numbers and amounts). We don't keep the original file.
- Connected accounting systems. If you connect QuickBooks® Online or Xero, Tilo reads the same kinds of records directly, with your permission: your chart of accounts, transactions, invoices and bills, customer and vendor names, receivables, unpaid bills, the balances of your bank accounts and your balance sheet (assets, liabilities such as loans and credit cards, and equity). Tilo never changes anything in your accounting system. The access keys are stored encrypted, and disconnecting from the Upload page removes them and revokes Tilo's access.
- Company details you enter, such as the company name, industry and the minimum cash you want to keep.
- Funding and planning details you enter or confirm: your debts (lender, balance, interest rate, monthly payment and maturity date), earnings add-backs, a loan request (amount, purpose and terms), a short business overview, and monthly budgets.
- What you create in Tilo: questions you ask Tilo and its answers, decisions you record, the status of issues Tilo flags, monthly report commentary, and lender share links you create.
Billing
If you subscribe, Stripe collects your card details and billing address on its own secure page. We never see or store your full card number. We keep a reference to your Stripe customer and subscription and its status, such as trial, active or cancelled.
Forms on heytilo.ai
When you send us a question, a partner request or a funding request, or subscribe to the Tilo newsletter (on the website or when you create a Tilo account), we collect what you enter (such as your email, name, firm, what you're planning and a rough amount) and how you found us (the referring site or campaign tags in the link you followed). The free calculators on heytilo.ai run in your browser; the numbers you type into them are not sent to us.
Usage and technical information
- Our hosting providers record standard server logs, such as IP address, browser type and pages requested, for security and reliability.
- We count how many questions each person and company asks Tilo, and record the size and cost of each AI request (not its content), to apply fair-use limits and manage costs.
- The app uses one essential cookie to keep you signed in. The marketing site uses Google Analytics; see "Cookies and analytics" below.
How we use it
- To run Tilo: compute your figures, flag issues, write reports and answer your questions.
- To let the people you invite see your company's data, as you choose.
- To prepare your lender package, and to show it to anyone you give a lender share link.
- To send the weekly Monday summary of your numbers to the people in your company.
- To bill your subscription and send you trial, receipt and payment notices.
- To reply to your questions, partner requests and funding requests.
- To keep Tilo secure, prevent abuse, fix problems and meet legal obligations.
- To understand which channels bring visitors to the website and improve it.
We don't use your company's financial data to advertise to you, and we don't sell it.
How Tilo's AI works with your data
Tilo's answers and report commentary are written by Claude, an AI model provided by Anthropic. When you ask Tilo a question, the relevant figures and transactions from your company's data are sent to Anthropic to produce the answer. Your figures themselves are calculated by our own software, not by the AI.
- Under Anthropic's commercial terms, Anthropic may not train its models on the content we send.
- Anthropic may keep that content for a limited time for safety and abuse monitoring, as described in its policies, and then deletes it.
- Only data from the company you're working in is sent, and only for your question or the text you asked Tilo to draft (such as a business overview for a lender).
Who we share it with
We use a small number of service providers. They may use your information only to provide their service to us.
- Render hosts the Tilo app and its database in the United States.
- Anthropic provides the AI model behind Tilo's answers and commentary.
- Netlify hosts heytilo.ai and receives the forms on it.
- Google provides website analytics and our email.
- Intuit (QuickBooks) and Xero, if you choose to connect them, provide your records to Tilo under your authorization.
- Stripe processes subscription payments and keeps billing records.
- Resend delivers Tilo's account emails, such as password resets and billing notices.
- Beehiiv sends the Tilo newsletter to people who subscribe, and stores their email address for that purpose.
Lender share links
On the Funding page, a company owner can create a private link to the company's lender package and give it to a lender, investor or advisor. Anyone who has the link can view the package, without signing in, until the link expires (30 days after it is created) or the owner turns it off, whichever comes first. The package shows the figures in it: earnings, the balance sheet, debts, coverage, a 12-month projection, revenue history, top customers and receivables. It doesn't give access to anything else in Tilo. Share a link only with people you trust, since they can pass it on. Turning a link off stops it working at once. We record when a link is created, turned off and last viewed.
We don't share your information with lenders, investors or other third parties without your permission, including if you send us a funding request. A lender share link is that permission, limited to the package and to the time the link is active. We may disclose information if required by law or to protect our rights or the safety of others, or as part of a merger, financing or sale of our business, in which case this policy will continue to apply.
What we don't do
- We don't sell your personal information or your financial data.
- We don't share one company's data with another company or customer.
- We don't connect to your bank, move money, post or change accounting entries, or file anything on your behalf. We connect to your accounting system only if you choose to, and only to read.
Retention and deletion
We keep your data for as long as your account is open. You can delete it yourself at any time:
- Settings → Your data deletes a company's uploads, transactions, balance sheets, debts, add-backs, loan requests, budgets, reports, chats, decisions and lender share links, or the whole company.
- Funding lets the owner turn off a lender share link at any time.
- Settings → Delete your account deletes your sign-in, your chats, and every company you own.
Deletion removes the data from our live database right away. Copies in our hosting provider's backups are removed as those backups expire. Billing records, such as invoices and payments, are kept by us and Stripe for as long as tax and accounting laws require, even after you delete your account. Form submissions are kept until you ask us to delete them; email pa@noricap.com.
Security
All traffic uses encryption in transit (HTTPS). Passwords are stored as hashes, each company's data is kept separate and checked on every request, and access to production systems is limited to the people who need it. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a breach that affects your data, we'll tell you without undue delay.
Cookies and analytics
The Tilo app uses one essential cookie to keep you signed in; it is not used for tracking. The marketing site at heytilo.ai uses Google Analytics to understand how visitors find and use it. Google Analytics sets cookies and collects information such as pages viewed, approximate location and device type. You can block or delete cookies in your browser settings, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
Your rights
Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, and to opt out of certain uses. Most of this you can do yourself in Settings. For anything else, email us and we'll respond within a reasonable time.
Children
Tilo is a business service and is not directed to anyone under 18.
Changes
If we change this policy, we'll update the date at the top. If a change materially affects how we handle data you've already given us, we'll tell you in the app or by email before it takes effect.