Chart

Data collection and usage practices represent critical aspects of modern software applications, particularly when handling sensitive personal information. This article examines Chart's data collection methods, the types of information gathered, and how this data is managed and shared. We'll explore the technical mechanisms Chart uses for data collection, the types of information that falls under their purview, and the policies governing how this data is used and protected. Additionally, we'll examine Chart's approach to third-party data sharing, user rights and controls, and their protocols for detecting and responding to fraudulent activities. Through an analysis of their API integration requirements and authentication process, we'll gain insights into how Chart implements these data management practices in their technical architecture.

Data Collection Channels and Types

Chart collects personal data through various channels including account creation, direct provision by users, and automatic collection methods. The company gathers data from multiple sources, including user account creations, direct provision by users, voluntary data submissions through free-form text boxes, and email communications. Automatic collection methods include the use of cookies and API tokens, location data from location-enabled browsers, and device information from downloaded applications.

Data Types Collected

The personal data collected by Chart covers a wide range of categories. Profile or contact data includes names, email addresses, phone numbers, and unique identifiers such as usernames and passwords. Payment data encompasses payment card types, last four digits of payment cards, and billing account information. Commercial data comprises purchase histories and other financial transactions.

Collection Sources

Data is gathered directly from users through account creation and service usage, as well as through voluntary submissions in free-form text boxes. The company also collects data automatically through web analytics, professional or employment-related information, and other identifying data found in emails or letters.

Usage and Sharing

Chart processes collected data for various purposes including account management, order processing, customer support, and service improvement. The company shares personal data with third-party service providers, customer support vendors, and lead generation partners. All data sharing activities are governed by the company's FCRA policy, which outlines permissible uses and consumer rights regarding data disclosure and correction.

Data Sharing and Third-Party Services

The company shares user data with third parties for various business purposes, including analysis, customer support, and lead generation. According to their FCRA policy, Chart shares personal data with service providers for hosting, technology, communication, security, and fraud prevention needs. Customer support vendors and product fulfillment providers also receive shared data. Third parties involved in payment processing include Stripe, Inc. and Bill.com LLC.

Chart collaborates with analytics partners to track user traffic and interactions, while businesses Offering joint promotional opportunities may receive shared data. Personal data is transferred to third parties in accordance with legal requirements, including fulfilling lawful obligations and responding to security incidents. All data handled by third parties remains subject to Chart's privacy policies and legal constraints.

Sharing Categories

The types of third parties receiving shared data include hosting providers, technology vendors, communication service providers, security consultants, and support vendors. Product fulfillment and payment processing partners, including Stripe and Bill.com, also receive specific payment-related information. Tracking and analytics services receive data about how users found or interacted with the company's services.

Business Transfers

The company maintains that all personal data, regardless of origin, is processed in the United States. User information is hosted on U.S. servers, and data may also be transferred to other countries. When conducting business transfers, Chart ensures all parties maintain appropriate data protection standards and comply with relevant legal frameworks.

Data Sharing Governance

Chart processes personal data based on several legal grounds, including contractual necessity, legitimate interest, and explicit consent from users. The company maintains that it does not engage in data sales, though it has partnered with third parties to track certain user activities for business purposes. Users retain rights to access, rectify, and request deletion of their personal data, subject to specific conditions and verification requirements.

User Rights and Data Controls

Data Subject Rights

Chart provides users with multiple rights under their privacy policy, including access to their data, requests for correction, and the ability to withdraw consent. Users have the right to request more information about the personal data held and to obtain a copy of their data. They can also request corrections or supplements to their data if it is incorrect or incomplete.

Rights and Processes

Users may request erasure of their personal data under certain conditions, though complete deletion is not always possible due to legal and operational requirements. They have the right to withdraw consent for processing based on consent, but may need to provide case-by-case re-consent for specific uses. Additional rights include portability, allowing users to request their data in machine-readable format for transmission to another controller. Users also have the right to object to further use or disclosure of their personal data for specific purposes and can request restrictions on further processing of their data.

Compliance and Implementation

The company implements these rights in accordance with its FCRA policy requirements. Users have the right to file complaints with supervisory authorities in their country or EU Member State if they believe their rights are not being respected. All data handling procedures are subject to ongoing review and update, with mandatory annual reviews or updates required in response to significant changes in IT environment, product/services, or compliance requirements.

Fraud Control and Monitoring

All accounts and transactions are monitored for fraudulent activity, with multiple layers of security in place to protect consumer information:

Monitoring Criteria

The system watches for specific patterns indicative of potential fraud:

• Volume: Multiple requests for the same information daily trigger an alarm

• Velocity: Rapid login requests generate alerts

• Timing: High-volume and high-velocity API requests during nighttime hours are expected

• Activity: Human-based interactions between 12:00-5:00 AM Eastern Time trigger immediate alerts

Identity Theft Notification

If suspicious activity is detected, the IRS blocks affected taxpayer records and notifies Chart's Chief Information Security Officer (CISO). The company then takes several steps to protect the affected account:

• Blocks account from further disclosure

• Resets account credentials

• Purges all associated data

• Revokes all consumer consents

Compliance and Reporting

When triggered, these alerts result in a comprehensive fraud investigation process managed by the CISO. All investigation results require client notification, ensuring complete transparency in the security response.

The company's commitment to maintaining the highest standards of data security is reflected in its comprehensive approach to fraud detection and prevention, with all actions taken under strict IRS authorization and consent processes.

API Integration and Authentication

Chart's API requires registration to obtain a sandbox application client_id and client_secret, which are valid only for simulated data. Real provider testing with live data requires developer keys, obtained from developers@trychart.com.

The authentication process initiates with setting up a redirect URI in the Chart Dashboard. In production environments, developers must use their own application URLs for Redirect URIs, removing any test URLs.

Authorization begins by navigating to:

https://connect.trychart.com? client_id=<your_client_id> &redirect_uri=https://example.com

After successful login through Chart Connect, the browser redirects to the specified URI with a code query parameter. Exchanging this code for an access token requires:

curl -X POST https://api.trychart.com/oauth/token \

-d "grant_type=authorization_code&code=<your_code>&redirect_uri=https://example.com"

The response provides the access token needed for subsequent API calls. All requests must include this token and follow strict OAuth 2.0 standards for secure API usage.