Privacy
Updated August 17, 2026 · Written in plain language; it may be revised as the product grows.
Steward is an AI agent for financial tasks. It may read bills, accounts, and portal details to do the job you give it, so the deal is simple: your data is used to work for you, never against you, and never sold.
What Steward collects
- Your account: name, email, and sign-in credentials (handled by our authentication provider; Steward never stores your password in readable form).
- Documents you send: bills, statements, EOBs, receipts, denials, and notices you upload or forward to your private Steward email address.
- Transactions you connect: balances and transactions from bank and card accounts you link, through a read-only connection with our banking data partner. Steward cannot move money.
- Portal logins you save: credentials for billing and insurance portals you connect, encrypted in a vault. They are used to sign in on your behalf and are never shown to the AI or to us in plain text.
- Your conversations with Steward: the messages, instructions, questions, and results in your sessions.
- First-party acquisition data: the public page and call-to-action used to reach Steward, plus standard campaign fields such as source, medium, and campaign when they are present. The public-site beacon uses no marketing cookie or browser fingerprint and respects Do Not Track. If you sign in, those limited fields can be attached to your account so we can understand which pages lead to product use.
- Public-site analytics: on the production marketing site, Google Analytics helps us understand aggregate page use. Advertising signals and ad personalization are disabled, and the analytics script does not load when your browser sends a Do Not Track signal.
- Newsletter signups: the optional Moving Parts form on some public pages is provided by Substack. When the form loads, your browser connects directly to Substack and sends ordinary request information such as your IP address, browser details, the Steward site as the referrer, and the source label for that form. Substack may use its own browser storage under its terms and privacy notices. If you submit the form, Substack also receives the email address you enter. This does not create a Steward account, and Steward does not send your financial or product data to Substack.
How it is used
To do the work you asked for: reviewing bills for errors or overcharges, finding unwanted charges, handling cancellations, filing disputes and requests, and recording observed outcomes. While work is active, Steward may sign in to the relevant portal on its own, on a schedule, to check for a reply or an update; those background sign-ins are read-only and pause for you when a portal needs a fresh verification code. Steward does not sell your data, does not share it with advertisers, and does not use it for anything unrelated to working on your finances.
AI processing
Steward uses AI models to read documents and reason about your cases. Under our agreements, our AI providers process your data to provide the service and do not use it to train their models. Portal passwords are never part of what any model sees: they are filled into sign-in forms by reference from the encrypted vault.
Who at Steward can see your data
Access is limited to doing the work you asked for. Authorized Stitch Inc. personnel may access your account to operate, support, secure, and debug the service; that access is logged, and staff viewing an account cannot take outward actions on your behalf.
Health information
Medical bills and EOBs contain health information. Steward is not a HIPAA-covered health provider or insurer, but we handle this data with safeguards aligned to what HIPAA requires of health systems: encrypted in transit and at rest, access limited to doing the work you asked for, and never used for marketing.
Sharing
Data is shared only with the service providers needed to run Steward (hosting, document processing, banking data, browser infrastructure for portal sign-ins), each bound to use it only to provide their service, and with a biller, insurer, bank, or merchant when that is needed to carry out the job you instructed Steward to handle (for example, a dispute that attaches your EOB).
Deleting your data
You can request deletion of your account and everything in it from your account settings. To guard against accidental or unauthorized requests, deletion takes effect after a short grace period (currently 7 days), during which you can cancel it. After that, we permanently erase your documents, findings, sessions, connections, vaulted credentials, and the activity record we keep, retaining only what the law requires.
Questions
Email support@heysteward.ai for privacy or account questions.