New2024 Savings Report: Level up your workplace benefits package. Learn more
Skip to content

Privacy Policy

Vestwell Privacy Policy

Vestwell Holdings Inc. and our subsidiaries (referred to as "Vestwell") are committed to protecting the privacy of individuals who visit, access, or use our websites, the Vestwell platform, or the Gradifi Powered by Vestwell platform (collectively, our “Sites”). This Privacy Policy explains what information we collect, why we collect it, how we use that information, and the choices we offer relating to the information we collect from or about you. Some of the information we may collect from you constitutes non-public “personal information.” Our collection, sharing, and use of non-public personal information is governed by the privacy notice that we deliver to you pursuant to applicable state or federal law. When you visit our Sites or register for a Vestwell account, you agree to the terms of this Privacy Policy as well as any other agreements you accept when registering for a Vestwell account. We will review and update this Privacy Policy so please review it periodically to be sure you are still comfortable with its terms.


1. What Information We Collect About You

We collect information about you in various ways. Some of this information may be considered “personal information” under applicable law. The personal information that you provide and that we collect or receive from you depends on the context of your interaction with us and our Sites, the choices you make when you use our Site, and the services that you receive from us.

Plan Sponsors, Participants, Beneficiaries, and Alternate Payees who use Vestwell’s recordkeeping and other services to support their workplace retirement plans

In order to perform our contractual responsibilities, Vestwell receives information from you or someone acting on your behalf, such as your employer, a Third Party Administrator, or your employer’s payroll provider. This includes but is not limited to:

  • Full legal name
  • Contact information, such as your mailing address, telephone and/or mobile phone numbers, and email address
  • Demographic information, such as your date of birth, marital status, or gender
  • Social Security Number, Tax Identification Number, or Employer Identification Number
  • Employment-related records, such as the name of your employer, job title, compensation, and date of hire

Individuals who visit our Sites

Anytime you visit our Sites, we collect information about you automatically using various technologies. This information may not identify you personally, but it is linked to your computer or device. When you visit our Sites, we utilize browser storage mechanisms and information-gathering tools such as cookies, internet tags, web beacons, website analytics, and navigational data collection. This includes device-specific information (such as whether you are accessing the Sites from a mobile phone or laptop), the website URL that directed you to the Sites, your location and Internet Protocol address, the browser and/or operating system of your device, the date and time of access to the Sites, and the pages that you access and how long you accessed them while using the Sites. Our use of that information is not restricted under this Privacy Policy and we may combine it with other information we collect about you on our Sites or through other sources.

Individuals who register for or attend one of our events

We collect and receive information from you directly when you register for or attend one of our events, including your name and contact details, the marketing channel by which you learned about Vestwell, and any communication delivery preferences We use this information to provide future communications relating to the event or our services unless and until you opt out of such communications. If we conduct our event with a partner, that third party may also receive and use your information.

Individuals who interact with our social media pages

We collect and receive information from you when you interact with our social media pages, accounts, or via posts you make on social media and other third-party platforms (“Social Media Platforms”). You may choose to engage with us on Social Media Platforms. If you choose to make any of your activities or other content available through a Social Media Platform, including on our pages, or you engage in other activities in connection with a Social Media Platform, your friends and followers on those Social Media Platforms that you have enabled, and potentially the general public, will be able to view those contributions and activities. Please remember that the manner in which Social Media Platforms use, store, and disclose your information is governed by the policies of such third parties. We are not responsible for the privacy practices or other actions of any Social Media Platform through which we may engage with you. This may include demographic information about users who “follow” our pages or information regarding how you engage with us, such as when you “like” our content.


2. How We Use the Information

We may use the information we collect from you in a variety of ways, including:

  • To present our Site and its contents to you and to operate our Sites.
  • To deliver the information, products, or services that you or your employer requested from us.
  • To register your account and deliver access to your accounts to you.
  • To reach out to you about and market or promote new information, products, or services to you. that we believe you may be interested in.
  • To communicate with you, including notifying you about changes to our Sites or services.
  • To help us improve our Sites and deliver a more personalized experience. This includes enabling us to store information about your preferences, speed up your searches, and recognize you when you return to our Sites.
  • To carry out our obligations and enforce our rights arising from any contracts entered into with you. This includes for billing and collection and as we believe is necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Sites, our employees, agents, or other users or to comply with applicable law.
  • In any other way we may describe when you provide the information, or otherwise at your direction or with your consent.
  • As permitted by law or as we may notify you.


3. How We Share Information

We may share the information that we collect pursuant to this policy as follows:

  • With our affiliates.
  • With our service providers, business partners, and vendors. These parties may include companies that host our Sites, provide web analytics, perform data processing, distribute emails to you, or help us communicate with you.
  • With retirement plan sponsors, employers, payroll providers, investment advisors, third-party administrators, mutual fund providers, or other service providers associated with your retirement plan or account with us.
  • When you request any of our products or services. We will share your information to the extent necessary or appropriate to fulfill your request.
  • When required to do so by law. For example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement agency’s request.

Vestwell may also share aggregated, anonymized, or de-identified information with third parties, such as about the demographics of users of our services. In addition, if Vestwell or any of our subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of, or dissolved, including through merger, consolidation, sale, or divestiture of assets, the relevant customer database, including personal information we may possess about you, and information collected pursuant to this policy, may, in whole or in part, be sold, transferred, or otherwise disclosed as part of that transaction or proceeding.


4. Cookies and Tracking Technologies


We and the third-party partners we engage may use cookies (small text files that are stored on your browser, computer, or mobile device), web beacons, pixel tags, browser analysis tools, server logs, and other tracking technologies to automatically collect information, including personal information such as your IP address, from your browser. Our Sites use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be accessed every time you use our Sites.

Our Sites use cookies and other tracking technologies for a variety of purposes, including functional, analytics, and advertising purposes. For example, we, our service providers, and other partners we engage use cookies and other tracking technologies:

  • For functional purposes, such as to provide the Sites and their content to you.
  • For analytics purposes, such as to provide us with information about what web pages a user visits and how much time a user spends on each page.
  • To personalize your experience on our Sites (e.g., to recognize you by name when you return to our site, to save your password in password-protected areas, or to tailor content, product, or service offerings to you).

Some browsers allow you to modify browser settings to decline cookies and/or "opt-out" of tracking technologies. As each browser is different, it is solely your responsibility to determine whether to activate or deactivate those tracking technologies. Disabling those features may impair some of the functionality of the Sites and/or our services.

Our Sites may use Google Analytics, a web analytics service offered by Google. You may learn more about Google’s practices with Google Analytics by visiting Google’s privacy policy at http://www.google.com/policies/privacy/partners.

We also utilize Facebook pixels to gather information about visitors to the Sites. Meta’s Privacy Policy explains how to change your device settings to opt out of Facebook tracking technologies.

Our Sites may reference or provide links to third-party websites, including social media bookmarking buttons that enable or require you to share certain content on or communicate with our Sites. Some of these sites may be co-branded with a Vestwell logo even though they are not operated or maintained by Vestwell. You may be directed through links to those sites while visiting our Sites. This Policy only applies to Vestwell’s privacy practices. Vestwell is not responsible for any activities of third-party websites. We do not control, nor are we responsible for, the privacy policies, operation, data collection, information practices, or use of third parties or their websites. When you use third-party links, these third parties may collect Personal Information about you or your online activities.


5. Your Choices

Cookie preferences

You can generally manage your cookie preferences through your web browser. Most web browsers will tell you how to stop accepting new cookies and how to disable existing cookies. For more information regarding how to manage your preferences, please consult the information made available by your particular browser or visit www.allaboutcookies.org. Please note that if you choose not to accept cookies, you may be unable to use certain features of our Sites.


Google Analytics

With respect to Google Analytics, you can also view Google’s currently available opt-out options at https://tools.google.com/dlpage/gaoptout to opt-out of being tracked by Google Analytics.

Tracking technologies

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites, web applications, and services that you do not want them to track your online activities. Our Sites do not currently support Do Not Track requests at this time.

Opting out of marketing communications

Except where “opt-in” consent is required by law, we will provide you an “opt-out” or unsubscribe option that clearly and conspicuously describes your right to opt out of future marketing communications from us. If you would like us to remove your name and information from marketing communications, please email us at Legal@vestwell.com. It may take up to 30 days to complete your request.

6. How Does Vestwell Protect My Personal Information

Your privacy matters to Vestwell and we work hard to protect it. We protect your personal information by physical, electronic, and procedural safeguards. However, as with all online service providers, the security of your information depends in part on the security of your computer, device, internet service provider, and your activities, all of which are beyond Vestwell’s control. Your use of our Sites is also governed by our Platform Terms of Use, which are incorporated herein by reference. Vestwell does not send unsolicited communications asking for account information, such as your password.


7. How Long Does Vestwell Keep My Personal Information

Vestwell retains personal information for as long as necessary to provide our services, carry out the purposes described in this Privacy Policy, or as required to comply with applicable law.


8. Children

Vestwell’s services and our Sites are not targeted or directed at children under the age of 13, and we do not intend to or knowingly collect or solicit personal information from children under the age of 13. Vestwell does process personal information about children if necessary to perform our services. For example, if you have a savings account supported by Vestwell, we may collect information relating to the beneficiaries of that account, which may include children under age 13. Personal information about individuals under age 13 will be treated the same as personal information described in this Policy.


9. International Use Statement

Vestwell is based in the United States and our services and Sites are provided and targeted only to residents of the United States. Personal information provided to us may be transferred to or controlled and processed in the United States, but in certain circumstances, service providers or business partners may process data in or outside of the United States. By providing Vestwell with personal information and by using the Sites or the Vestwell Platform, you consent to this transfer and acknowledge that personal information stored or processed in the United States will be subject to the laws of the United States, including the ability of governments, courts, law enforcement, and/or regulatory agencies of the United States that have valid jurisdiction over Vestwell to obtain disclosure of your personal information. You also understand and agree that your personal information may be transferred to and processed in the United States and other countries that may not provide the same level of data protection and privacy as the United States or the country of your residence, and may have been deemed to have inadequate data protection and privacy laws. If you access the Sites from a location outside of the United States, you agree that your use of our Sites is subject to the terms of this Privacy Policy.


10. Additional Information for Residents of Virginia, Colorado, Connecticut, and certain other states that have enacted data protection laws

Several states, including Virginia, Colorado, Connecticut, New Jersey, and Oregon, have enacted consumer data privacy laws that require commercial websites or online services to post a privacy policy that describes the types of personal information collected, what information is shared with third parties, and how consumers can request changes to certain information. This section of our Policy may apply to you if you reside in one of those states.

Right to Opt In

If you are a resident of the Commonwealth of Virginia, or the State of Colorado or Connecticut, applicable law requires us to receive your consent before processing certain Sensitive Personal Information, including (1) personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (2) the processing of genetic or biometric data to uniquely identify a natural person; (3) personal information collected from a known child; or (4) precise geolocation data. We do not collect or process Sensitive Personal Information in connection with our Services.

Right to Know

You have the right to know and confirm that we are processing your personal information and see what personal information we have collected about you. To the extent feasible, you may request a copy of your personal information that you or someone on your behalf provided to us.

Right to Correct

You have the right to request us to correct any inaccuracies in the personal information we have collected from you.

Right to Delete

You may have the right to request that we delete the personal information we have collected from you and direct our service providers to do the same. There are several exceptions when we cannot or are not obligated to delete your personal information, such as when the information is necessary for us or a third party to do any of the following:

  • Comply with federal, state, or local laws, rules, regulations, or other legal obligations.
  • Investigate, establish, exercise, prepare for, or defend any legal claims.
  • Provide you a good or service,
  • Perform a contract between us and you.
  • Protecting an interest that is essential for your or another natural person’s life or physical safety.
  • Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; or prosecute those responsible for any such action.
  • Preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action.
  • Protect the free speech rights of you or other users.
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws.
  • Conduct internal research to develop, improve, or repair our products, services, or technology.

Exercising Your Rights

If you want to access, review, update, or correct inaccuracies in your personal information, or delete your personal information in accordance with this Privacy Policy, you can contact us at help@vestwell.com or call us at (917) 979-5358. You also have the right to view and correct information we collect about you, such as your name, phone number, email address(es), business information, and mailing address, from your Vestwell portal or by contacting us at help@vestwell.com. Device Identifiable Information cannot be viewed or changed, except for persistent cookies which can be blocked by changing the settings on your website browser. Upon receiving your communication, we will take appropriate steps to update or correct such information in our possession, or to remove you from our mailing list. Your preferences may depend on the services we provide you, and may include, if applicable, your profile information, any payment and account information, or whether you want to receive communications from us. We may request certain personal information to verify the identity of the individual seeking access to their personal information records.

Response Timing and Format

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another forty-five (45) days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why and provide you with an estimate. The “Right to Appeal” below describes how you can appeal our refusal to take action on a request to exercise your rights.

Right to Appeal

If we refuse to take action on your request to exercise your rights, you may appeal our refusal. To appeal a refusal, please submit a copy of your request for an appeal and the original request to us as indicated in this Policy. Unless otherwise indicated in this policy, within sixty (60) days of our receipt of your request for an appeal, we will inform you, in writing, of any action taken or not taken in response to your appeal. We will include a written explanation of the reasons for the decisions. If we deny your appeal, you may contact your local privacy enforcement authority to submit a complaint based on the below information.

Complaint Procedure

If you are a resident of the Commonwealth of Virginia, you can file a complaint with the Consumer Protection Section of the Office of the Attorney General of Virginia at 202 North Ninth Street, Richmond, VA 23219, by phone at (800) 552-9963, by fax at (804) 225-4378, or online at https://www.oag.state.va.us/consumercomplaintform/form/start

If you are a resident of Colorado, we will inform you, in writing, of any action taken or not taken in response to your appeal within forty-five (45) days of receipt of your appeal. If we require more time (up to another sixty (60) days), we will inform you of the reason and extension period in writing. If we deny your appeal, you can file a complaint with the Office of the Attorney General of Colorado at: Ralph L. Carr Judicial Building, 1300 Broadway, 10th Floor, Denver, CO 80203, by phone at (720) 508-6000, or online at https://coag.gov/file-complaint/

If you are a resident of Connecticut, you can file a complaint with the Office of the Attorney General of Connecticut at: 165 Capitol Avenue, Hartford, CT 06106, by phone at (860) 808-5420, or online at https://www.dir.ct.gov/ag/complaint/

11. Additional Information for California Residents

The California Consumer Privacy Act (“CCPA”) provides California residents privacy rights with respect to certain personal information. If you are a California resident, please visit our California Privacy Notice for more information. The California Privacy Notice supplements and should be read in conjunction with this Privacy Policy.

12. How to Contact Vestwell

Privacy matters to Vestwell. If you have reason to believe that we have not adhered to this Privacy Policy, or any other questions or complaints relating to our privacy practices, please contact Vestwell by email at help@vestwell.com or by mail at Vestwell Holdings Inc., Legal Department, 360 Madison Avenue, 15th Floor, New York, New York 10017 (917) 979-5358. All complaints are recorded, reviewed, and handled by the Vestwell Legal Department, which can also be reached at Legal@vestwell.com.