Privacy Policy
Last updated: 2026-09-23
1. Introduction
Chimo AI Inc. ("Chimo AI," "we," "us," or "our") is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, disclose, and secure your information when you use our services to file unclaimed property requests with state agencies and file class action claims, or when you visit our website (https://chimo.ai). By accessing or using our services, you agree to the terms of this Privacy Policy.
2. Contact Information
Mailing Address: 17331 Palmetto Pass Lane, Punta Gorda, FL 33982, USA
Privacy Officer: Evan Waters
3. Information We Collect
3.1 Categories of Personal Information
We collect the following categories of personal information as necessary to provide our unclaimed property and class action claim filing services:
Identifiers: Name, email address, phone number, mailing address, IP address, device identifiers
Government-Issued Identifiers: Social Security Number (SSN), Tax Identification Number (necessary for state unclaimed property claims)
Financial Information: Credit card information (processed directly by Stripe; we do not store or access full credit card numbers)
Demographic Information: Date of birth
Commercial Information: Services purchased, claim history
Internet Activity: Browsing history, search history, and information regarding interactions with our website
Geolocation Data: General location based on IP address
Professional Information: Employment history (when relevant to certain class action claims)
Inferences: Information derived from other personal information that could create a profile about preferences, characteristics, behavior, etc.
Claim-Specific Information: Documentation and information specific to your unclaimed property or class action claims, which may include purchase records, proof of residence, or other qualifying information
We do not collect:
- Bank account information
- Biometric information
- Health information (unless specifically relevant and provided voluntarily for certain class action claims)
3.2 Sources of Personal Information
We collect personal information from:
- Direct interactions with you when you register for our services, submit claims, or contact customer support
- Automated technologies such as cookies, server logs, and similar technologies
- Third parties such as class action settlement administrators (with your consent)
- Publicly available sources, such as state unclaimed property databases
3.3 Signing In with a Google or Facebook Account
You can create a Chimo account using your Google or Facebook account instead of choosing a password. This is optional. You can register with an email address and a password instead, and nothing about the service changes if you do.
If you sign in with Google, Google sends us three things:
- Your email address
- Whether Google has confirmed that the email address belongs to you
- An identification number that Google uses to refer to your account
That is the whole list. We never receive your Google password. We do not ask Google for access to Gmail, Google Drive, Google Contacts, your calendar, your photos, or any other Google service, and we cannot see any of them. Signing in with Facebook works the same way and gives us the same three things.
4. How We Use Your Information
We use your personal information for the following purposes:
4.1 Service Provision and Contract Fulfillment
- To establish and maintain your account
- To verify your identity and eligibility for unclaimed property and class action claims
- To prepare, submit, and track your claims with state agencies and class action administrators
- To process payments for our services (via Stripe)
- To provide customer service and respond to your inquiries
4.2 Legitimate Business Interests
- To improve our services and develop new features
- For fraud detection and prevention
- To maintain the security of our systems and services
- For analytics to understand user behavior and optimize our website
4.3 Marketing and Communications
- To send service updates and notifications regarding your claims
- To provide marketing communications about our services (where permitted by law)
- To conduct surveys and collect feedback
4.4 Legal Compliance
- To comply with legal and regulatory obligations
- To respond to legal processes or government requests
- To establish, exercise, or defend legal claims
4.5 How We Use Information from Google Sign-In
This section covers the information described in Section 3.3. We use the email address and identification number that Google gives us only to:
- Create your Chimo account and sign you in
- Recognize you as the same person when you come back
- Send you messages about your claims, your account, and your membership
We do not sell this information, and we do not hand it to an advertising network to target advertising at you. We do not use it to train artificial intelligence models; Section 5 describes how we use AI, and signing in with Google adds nothing to it. We do not give it to Google AdSense, which is described in Section 6.2.
One related disclosure belongs here rather than buried in Section 8.5, which describes it in full. When you subscribe, we upload an irreversibly hashed version of the email address on your billing record to Google Ads, so that we can tell which advertising led to a subscription. If you signed in with Google and subscribed with that same address, it is the same address. We do not upload your name, address, claim details, Social Security number, or payment information.
You can disconnect Chimo from your Google account at any time at
https://myaccount.google.com/permissions. Disconnecting stops you from signing in that way again; it does not delete your Chimo account or the information we already hold. To delete those, follow Section 10.3.
5. Use of AI and Automated Processing
Chimo AI uses artificial intelligence (AI) technologies to enhance our claim filing services. Personal data you provide may be processed by AI systems for the following specific purposes:
- Identity verification
- Eligibility assessment for claims
- Document parsing and extraction
- Fraud detection
- Customer support automation
We implement safeguards to ensure that AI-based decisions that significantly affect you involve human oversight. We do not use your data to train AI models beyond what is necessary to operate our services, and we do not share your data with third-party AI platforms except as described in this policy.
You have the right to:
- Request human intervention for any decision made solely by automated means
- Express your point of view regarding automated decisions
- Contest any automated decision
6. Cookies, Tracking, and Analytics
6.1 Cookies and Similar Technologies
We use cookies and similar tracking technologies on our website. These technologies collect information about how you interact with our site and allow us to remember you. Cookies are small files placed on your device that help us provide and improve our services.
We use the following types of cookies:
Essential Cookies: Required for the operation of our website and services
Analytical/Performance Cookies: Allow us to recognize and count the number of visitors and see how visitors move around our website
Functionality Cookies: Enable us to personalize content for you
Targeting Cookies: Record your visit to our website, the pages you have visited, and the links you have followed
6.2 Analytics and Third-Party Tracking
We use analytics services, such as Google Analytics, to help us understand how users engage with our website. These services may use cookies and other tracking technologies to collect information about your use of our website.
We also show advertising from Google AdSense on our blog articles. To select and measure those ads, Google may use cookies and similar technologies to collect information such as your IP address, your device and browser, and the pages you view on our blog. We do not give Google AdSense your name, email address, claim information, or any other information you provide to us.
These ads are part of the Targeting category in our Cookie Preference Center. If you turn that category off, or your browser sends a Global Privacy Control signal, advertising cookies are not set. Ads are shown only on our blog. We do not show third-party advertising on our claim forms, checkout, or account pages.
6.3 Your Choices Regarding Cookies
You can control cookies through your browser settings. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer.
We provide a Cookie Preference Center on our website, linked from the footer of every page, where you can review each category and change your choices at any time. You can turn any non-essential category off, and your choice is remembered on that device.
We honor the Global Privacy Control (GPC) signal. When your browser sends it, we treat it as an instruction to disable all non-essential tracking, we do not ask you to reconsider, and that instruction cannot be overridden in the Cookie Preference Center. GPC has largely replaced the older "Do Not Track" signal, which browser vendors have retired and which we therefore no longer rely on.
7. Advertising and Targeting
7.1 Geographic Limitations
Our services are intended for users residing in the United States. We do not knowingly collect or target personal information from individuals outside the United States.
7.2 Age Restrictions
We do not knowingly collect or target personal information from individuals under 18 years of age, and we do not advertise to minors.
7.3 Online Advertising
We may use information collected about you to show you relevant ads on other websites. We work with third-party advertising networks that collect information about your visits to our website to provide more relevant advertising based on your interests.
Separately, we show ads from Google AdSense on our own blog articles. Google selects those ads and may use cookies and similar technologies to do so, as described in Section 6.2. Google's use of this information is governed by its own privacy policy, which you can read at
policies.google.com/technologies/partner-sites . You can turn these off at any time in our Cookie Preference Center, or by using the opt-out links below.
You can opt out of interest-based advertising from participating companies through:
8. Disclosure of Your Information
We may share your information with:
8.1 Service Providers
- Payment processors (Stripe)
- Cloud service providers (Amazon Web Services)
- Analytics providers (Google Analytics)
- Advertising providers (Google AdSense)
- Communication service providers
- Customer support software providers
- Claim processing partners (including state agencies and class action administrators)
8.2 Business Partners
- Class action settlement administrators (as necessary to process your claims)
- State unclaimed property offices (as necessary to process your claims)
8.3 Legal Compliance and Protections
- In response to a subpoena, court order, or other legal process
- To comply with laws, regulations, or legal obligations
- To establish, exercise, or defend our legal rights
- To prevent fraud, security issues, or technical issues
8.4 Business Transfers
- If Chimo AI is involved in a merger, acquisition, financing, or sale of assets
8.5 Sale and Sharing of Personal Information
We do not sell, rent, or lease your personal information to third parties for monetary consideration.
We do, however, share personal information for advertising purposes as California law defines that term. When you subscribe, we upload an irreversibly hashed (SHA-256) version of your email address to Google Ads so that we can measure which advertising led to a subscription. We do not upload your name, address, claim details, Social Security number, or payment information, and Google cannot recover your email address from the hash. Because this disclosure supports cross-context behavioral advertising, we treat it as "sharing" under the California Consumer Privacy Act as amended by the CPRA, and we disclose it here rather than rely on the argument that measurement alone is exempt.
We also allow advertising and analytics cookies to operate on our website, as described in Section 6, which may constitute sharing for the same reason.
You have the right to opt out of both, and we will not discriminate against you for exercising it. Use the Do Not Sell or Share My Personal Information link in the footer of every page, turn off the Targeting category in our Cookie Preference Center, or send a Global Privacy Control signal from your browser, which we honor automatically. We do not sell or share the personal information of consumers we know to be under 16.
One limitation worth stating plainly: the browser-based controls above stop advertising cookies on the device you are using, but the hashed email address we upload to Google Ads is sent from our servers and is not tied to any browser. We can only exclude you from that upload if we know which account is yours, so it is covered when you are signed in as you opt out. Section 10.3 explains what to do if you are not.
9. Data Retention
We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:
- Account information: Retained as long as you maintain an active account with us, plus a reasonable period thereafter
- Claim information: Retained for the duration of the claim processing plus a period necessary for legal compliance (generally 7 years)
- Transaction records: Retained for 7 years as required by tax and financial regulations
- Communication records: Retained for 2 years after your last interaction with us
- Marketing preferences: Retained until you opt out or request deletion
When personal information is no longer needed, we securely delete or anonymize it.
10. Your Rights and Choices
10.1 General Privacy Rights
You have the following rights regarding your personal information:
Access: Request access to the personal information we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your data (subject to legal or business record-keeping requirements)
Restriction: Request that we restrict the processing of your data
Portability: Request a copy of your data in a structured, machine-readable format
Objection: Object to the processing of your data for marketing or other purposes
Automated Decisions: Request human intervention for automated decisions
10.2 State-Specific Privacy Rights
California Residents
Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have additional rights:
- The right to know what personal information we collect, use, disclose, and sell
- The right to request deletion of personal information
- The right to correct inaccurate personal information
- The right to opt-out of the “sale” or “sharing” of personal information
- The right to limit the use of sensitive personal information
- The right to non-discrimination for exercising your rights
To designate an authorized agent to make a request on your behalf, please contact our Privacy Officer with written permission and verification of your identity.
Virginia, Colorado, Connecticut, Utah, and Other States with Comprehensive Privacy Laws
Residents of states with comprehensive privacy laws may have additional rights similar to those listed above. We will comply with applicable state privacy laws when processing your requests.
10.3 How to Exercise Your Rights
To exercise your privacy rights or submit a request:
To opt out of the sale or sharing of your personal information, use the Do Not Sell or Share My Personal Information link in the footer of every page. It takes effect immediately on the device you are using, with no account and no request to us, and it stops the advertising cookies described in Section 6.
The two kinds of sharing described in Section 8.5 are stopped by different means, so it is worth being precise. The footer link stops cookie-based sharing on that device. The irreversibly hashed email address we send to Google Ads is sent from our servers rather than your browser, so stopping it requires us to know which account is yours. If you are signed in when you use the link, we record the opt-out on your account and it covers that upload as well. If you are not signed in, the link still stops the cookie-based sharing and the confirmation will tell you it applied to that device only. To cover the upload too, sign in and use the link again, or email us and we will apply it for you.
To change which cookie categories are active, use the Cookie Preferences link in the footer of every page.
We will respond to verifiable consumer requests within 45 days, unless we need additional time, in which case we will notify you.
11. International Users
Chimo AI's services are intended for U.S. residents. If you are located outside the United States, please note:
- Your data will be transferred to and processed in the United States
- U.S. privacy laws may not be as comprehensive as those in your country
- Your data may be subject to access by U.S. law enforcement and regulatory authorities
By using our services, you consent to these transfers and processing. While we are primarily focused on compliance with U.S. privacy laws, we incorporate certain international privacy principles from frameworks such as the GDPR as best practices.
12. Data Security
We implement comprehensive technical, administrative, and physical safeguards to protect your personal information, including:
Encryption: All sensitive data is encrypted in transit and at rest using industry-standard encryption protocols (TLS 1.3 and AES-256)
Access Controls: Strict role-based access controls and multi-factor authentication for our systems
Vulnerability Management: Regular security assessments, vulnerability scanning, and penetration testing
Employee Training: Mandatory security and privacy training for all employees
Incident Response: Documented procedures for detecting, reporting, and responding to security incidents
Disaster Recovery: Regular backups and disaster recovery planning to ensure data resilience
Compliance: Adherence to NIST standards and security frameworks
Our data is hosted on secure infrastructure provided by Amazon Web Services (AWS), which maintains rigorous security certifications and controls.
Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information using commercially reasonable measures.
13. Data Breach Notification
In the event of a data breach involving your personal information, we will:
- Assess the nature and scope of the incident
- Take immediate steps to contain the breach and restore security
- Notify affected individuals without unreasonable delay, typically within 45-60 days
- Provide information about the incident, steps we’ve taken, and measures you can take to protect yourself
- Notify relevant authorities as required by applicable law
Notifications will be provided via email or, if email is not possible, via postal mail or telephone.
14. Subprocessors
We use the following key subprocessors to deliver our services:
Amazon Web Services (AWS): Cloud hosting and infrastructure
Google Analytics: Website analytics
Google AdSense: Advertising shown on our blog articles
Stripe: Payment processing
Amazon Simple Email Service (SES): Transactional and notification email
Klaviyo: Marketing email and customer messaging
Zoho Desk: Customer support ticketing
Zoho Sign: Electronic signature, including signed claim forms
PostGrid: Physical mail delivery of claim documents
Google Ads: Advertising measurement, using irreversibly hashed email addresses
A complete and up-to-date list of our subprocessors is available upon request.
15. Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect information from children under 18, and we do not advertise or target those under 18. If we discover that we have collected personal information from a child under 18, we will promptly delete such information.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Changes will be posted on this page with an updated effective date. For significant changes, we will provide a more prominent notice, which may include an email notification to the address associated with your account.
Your continued use of our services after any changes constitutes your acceptance of the revised policy. We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices
17. Dispute Resolution
If you have a privacy-related complaint or dispute, please contact our Privacy Officer first. If your issue is not resolved to your satisfaction, you may have the right to file a complaint with your state’s Attorney General’s office or other relevant privacy authority.
18. Contact Us
Privacy Officer: Evan Waters
Mail: 17331 Palmetto Pass Lane, Punta Gorda, FL 33982, USA
This policy is designed to provide transparency and comply with applicable U.S. privacy laws, with reference to best practices under frameworks such as the EU GDPR and state privacy laws including CCPA/CPRA.