Privacy Policy

Summary. This policy explains what personal information FinlyWealth collects, why, who receives it, how long we keep it, and your choices. We collect what you give us, such as your account details and anything you add to Finly Money, and what your devices send us when you use the site. If you connect a bank or brokerage account, we receive your accounts, balances, and transactions through a connection provider, read-only, and we never see your bank password. We use AI services from Google and Anthropic to read statements and receipts, categorize transactions, and power Fin, our assistant, and they do not train their models on your data. We never send your Finly Money financial data to advertising networks, and we do not sell personal information. You can delete your financial data or your whole account from your Profile at any time.

1. About this policy

Your privacy and trust matter to FinlyWealth. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the choices you have.

Who we are

"FinlyWealth," "we," "us," and "our" mean Finly Technology Corp., a British Columbia corporation. We operate finlywealth.com, its subdomains and subpages (the "Website"), and Finly Money, our personal finance app at finlywealth.com/money (together with the Website, our "Services").

Our Privacy Officer is accountable for how we handle personal information. You can reach them at admin@finlywealth.com (see section 11).

What this policy covers

This policy applies to personal information we collect through:

• the Website, including our comparison pages, reviews, articles, and credit card rewards calculators
• Finly Money
• our cash-back, rebate, and referral programs
• our affiliate program and partner pages on FinlyWealth subdomains
• our emails, text messages, support tools, AI assistant, consulting bookings, and careers page

It covers:

1. About this policy
2. Information we collect
3. Connecting your financial accounts
4. Statements, receipts, and artificial intelligence
5. How we use your information
6. How we disclose your information
7. Cookies, device fingerprinting, and analytics
8. Security and where your information is stored
9. How long we keep your information, and deleting it
10. Your rights and choices
11. Contacting our Privacy Officer
12. Complaints
13. Children
14. Changes to this policy

This policy continues to apply for as long as we hold your information, including after you close your account or stop using a Service.

Consent

We collect, use, and disclose personal information with your consent, or as the law otherwise permits or requires. By using our Services or giving us personal information, you consent to the practices described in this policy.

For sensitive information, we ask for your express consent separately, at the time we collect it. This includes:

• information from financial accounts you connect
• statements and receipts you upload
• your financial profile, such as your income band and credit-score band
• your mobile number for text messages
• marketing emails
• for visitors in Quebec, cookies and similar technologies that are not necessary for the Services (section 7)

You can withdraw consent at any time, subject to legal and contractual limits (see section 10).

Laws that apply

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and other privacy laws that apply to you, such as Alberta's Personal Information Protection Act.

2. Information we collect

What we collect depends on which Services you use. You can browse most of the Website without telling us who you are. We collect information directly from you, automatically from the devices you use, and from third parties described below.

Your account

• Sign-up and sign-in: your name and email address, and either a password (stored only in hashed form) or Google sign-in. If you sign in with Google, we receive your name and email address from Google.
• Phone number: your mobile number, which we verify with a code sent by text message.
• Security settings: whether you use two-step verification, and a "remember this device" setting if you choose it.
• Session information: details of each signed-in session, including your IP address and browser.
• Device signals: a device fingerprint hash and a random device identifier (see section 7).

Your financial profile

All of this is optional. You choose what to provide: your province, goals, marital status, dependants, home, vehicle, work status, birth year, income band, and credit-score band.

We also ask how you heard about us during sign-up. If you join the waitlist for our mobile app, we collect your mobile number.

Credit card calculators

• Manual entry: the spending amounts you enter are saved in a cookie on your device. When you update your results, we also save those amounts on our servers, together with your credit-score band and income band if you gave them. This record is linked to a random identifier stored in a cookie, not to your name or email.
• Statement upload: see section 4.
• Bank connection: see section 3.

Cash-back, rebates, referrals, and payouts

• Payout details: your first and last name, the email address you use for Interac e-Transfer, and an Interac security answer that we generate for you.
• Phone verification: before your first payout, we verify your mobile number and check what type of line it is. Each account can have one verified number, and disposable VoIP numbers are blocked.
• Rebate claims: files you upload to verify a rebate (for example, an approval email), the details our claim form asks for, and, if you claim for a family member, the label you give them (for example, "Dad").
• Activity records: the products you click on, apply for, and are approved for; rebates earned; payouts made; your referral code; and the people who signed up through it.
• From partner networks: click and conversion information about the offers you clicked through to.

Finly Money

If you use Finly Money, we also collect:

• Connected accounts: see section 3.
• Uploaded statements: see section 4.
• Receipts and attachments: see section 4.
• What you enter: transactions you add by hand, notes, tags, categories, rules, budgets, dashboards, net worth items, reward settings, and whether an account is personal or business.
• Fin conversations: the questions you ask Fin in the app or by text, its answers, the information it looked up to answer, and any charts it draws.
• Fin's insights: if you turn them on, the observations Fin produces for you.
• Reminders: which reminders and alerts you turn on, and a history of what we sent and when.
• Subscription: your plan, its status, trial details, and the identifiers Stripe uses for your customer record and subscription. Stripe collects your card and billing address directly. We do not receive or store your card number.
• Demo data: if you choose to explore with sample data, that data is made up and stored separately from your own.

Information about other people that you give us

• Household partner: if you invite a partner to your household, we collect their email address. We email them the invitation, and later a notice when they join or are removed.
• Shared bills: if you split costs with people, you can record their name and, if you like, their email address. These people do not have an account, can't see anything, and are never contacted by us.
• Rebate claims: a label for a family member, as described above.

If you give us information about someone else, you confirm that you have a reasonable basis to do so. Upload only statements and receipts for accounts you hold or are authorized to use.

When you contact us or apply for a job

• Support: messages and attachments you send through our support widget or by email.
• Newsletter: your email address. Addresses entered in our newsletter pop-up are checked by an email verification service.
• Consulting bookings: the details you give our scheduling provider, Calendly, when you book a session.
• Surveys and research: your answers, if you take part.
• Careers: your name, email address, phone number, LinkedIn profile, résumé, and anything else you include in an application.

Collected automatically

When you use the Services, we and our service providers automatically collect:

• your IP address and approximate location derived from it
• your device type, operating system, and browser
• pages you view, links you click, and how you move through the Website
• the page that referred you, campaign tags, and advertising click identifiers
• a device fingerprint hash and device identifier

Section 7 explains the cookies and similar technologies we use, and the choices you have.

From third parties

• Financial account connection providers: information from accounts you connect (section 3).
• Affiliate networks and financial institutions: whether an application you started through us was approved, pending, or declined, and the related commission or rebate.
• Stripe: the status of your subscription and payments.
• Our payout provider: the status of your payouts.
• Our text message provider: whether your number is valid, what type of line it is, and whether our texts were delivered.
• Google: your name and email if you sign in with Google.

3. Connecting your financial accounts

Finly Money lets you connect your bank, credit card, and brokerage accounts. You can then see your finances in one place, categorize and budget your spending, track your net worth and holdings, and compare how credit cards would reward your real spending.

Connecting accounts is always optional. You can add statements or transactions by hand instead, and you can disconnect any account at any time.

We never receive your banking credentials

When you connect an account, you sign in to your bank on the connection provider's own screen. FinlyWealth never receives, sees, or stores your bank password. For each connection, we store an encrypted token that lets us retrieve your data.

Connections are read-only. We cannot move money, make payments, or place trades.

Our connection providers

Which provider we use depends on your institution and account type. The provider is shown in the connection flow before you begin.

• Flinks. We use Flinks Technology Inc. by default to connect bank and credit card accounts at supported institutions. Flinks' privacy policy is available at https://www.flinks.com/privacy-policy.
• Plaid. We use Plaid Inc. as a backup to connect bank and credit card accounts, and to connect some investment accounts. Plaid processes your information for its own purposes as well as ours, and maintains its own end user privacy policy. By connecting an account through Plaid, you acknowledge and agree that your information will be treated in accordance with Plaid's privacy policy, available at https://plaid.com/legal. We encourage you to read it. Plaid also offers a portal where you can review and revoke the connections you have made through Plaid across every app you use.
• SnapTrade. We use SnapTrade, operated by Passiv Inc., a Canadian company, to connect brokerage accounts. You authorize the connection through SnapTrade's Connection Portal, usually by signing in at your brokerage directly. SnapTrade's privacy policy is available at https://snaptrade.com/privacy-policy and its end user terms at https://snaptrade.com/terms-and-conditions.
• MX. Some older connections use MX Technologies, Inc. When MX processes information about you, it does so as our service provider, under contract and on our instructions. MX's privacy statement is available at https://www.mx.com/privacy/.

By connecting an account, you authorize the connection provider to access and transmit information from your financial institution on your behalf, under that provider's terms and privacy policy.

We identify you to each provider with a random identifier. We do not send them your name or email address.

What we receive from your connected accounts

We ask only for your accounts and transactions. We do not request identity verification or account-holder details, such as the name, address, or phone number your bank holds for you.

We keep only the last 4 digits of account numbers.

Connected accounts update automatically in the background while your Finly Money access is active.

We also keep technical records of each connection, such as its status, error codes, and timing, to troubleshoot problems. These records do not contain your transactions or balances. If you report a connection problem, we keep your description with those records.

How we use connected account information

We use it to:

• display your accounts, balances, and transactions
• categorize transactions, identify recurring charges and subscriptions, and track budgets
• calculate your net worth and show your holdings
• answer your questions through Fin (section 4)
• send reminders and alerts you turn on
• work out the rewards your credit cards earned, and compare how other cards would reward your spending

We also use it to select which financial products to show you. FinlyWealth earns referral commissions when you open a financial product through us, and we may show you, for example, a credit card whose reward categories match where you spend. This selection is done on our own systems.

Some processing, such as categorizing merchants or answering Fin questions, is carried out for us by the service providers named in section 6. They act on our behalf and may not use the information for their own purposes.

What we do not do with connected account information

• We do not send it to advertising networks. No Finly Money financial data, including transactions, balances, and accounts, is ever sent to an advertising network, in identifiable, pseudonymized, or aggregated form. We do not use it to build, upload, or seed advertising audiences.
• We do not disclose it to financial institutions or affiliate networks. A partner learns that a referral came from us, not what is in your accounts.
• We do not sell it, rent it, or trade it.

Connecting a bank from the credit card calculator

You can connect a bank once, free, for 14 days from our public credit card calculator. We use only your credit card accounts for the comparison. The connection works like any Finly Money connection, as described above.

If you don't start a paid Finly Money plan by the end of the 14 days, we remove the connection at the provider and delete the data we retrieved through it. You can disconnect sooner at any time from the calculator, which also deletes it.

We keep your comparison results for up to one day to avoid recalculating them. We keep a record of your trial (when it started, ended, and how it ended) until you delete your account, so the trial can be used only once.

Disconnecting an account

You can disconnect any connected account at any time from your settings. When you do:

• we always remove the connection at the provider, so we stop retrieving information from that account
• you choose whether to delete the history we imported for that account or keep it. Delete is selected by default.

If you keep the history, it stays in your account until you delete it or your account. You can also revoke access directly with your financial institution or, for Plaid connections, through Plaid's portal.

When your Finly Money access ends

If your Finly Money access ends, because you cancelled, a free period ended, or a payment wasn't made, background syncs pause. After a 30-day grace period, we disconnect all of your bank and brokerage connections at the provider. We email you 7 days before we do. We keep your Finly Money data so you can come back unless explicitly requested to be deleted.

4. Statements, receipts, and artificial intelligence

Our AI providers and what they process

We use AI models from Google (Gemini) and Anthropic (Claude), both based in the United States.

No training on your data. We use Google and Anthropic under paid business terms, under which neither trains its models on our data. Under those terms, the providers may keep data for a short time to monitor for abuse.

Statement uploads in Finly Money

• What happens to the file: AI reads the file you upload, and you review the results before importing them. We then delete the file right after reading it, and always within 48 hours.
• What the AI provider sees: statements can show your name, address, and account numbers, so the AI provider sees those details while reading the file.
• What we keep: the transactions and balances you import, and the file name and a hash of the file, so we can spot a duplicate upload.

Statement uploads in the credit card calculator

You can upload credit card statements (PDF or CSV) to the calculator without creating an account.

• Storage: files go to private storage, only for processing, and are encrypted at rest. Files are deleted from our AI provider's temporary storage once read. All uploaded files are automatically and permanently deleted from our storage within 48 hours of upload.
• What we extract: each transaction's date, amount, merchant, category, and description, and any foreign currency. We do not store your name, address, or account number in our database.
• Linked to your device, not your name: the extracted transactions are stored with your device identifier (section 7), so the calculator can recognize your browser and keep your results. They are not linked to your FinlyWealth account.
• Reused results: if the same file is uploaded again within 48 hours, we reuse the earlier result instead of reading it again.
• On your device: your analysis, including merchant names, is saved in your browser until you reset it.
• Abuse protection: to prevent automated misuse, we check each upload with Google reCAPTCHA and limit the number of analyses per day.

We use the extracted transactions to calculate your average monthly spending in each reward category, rank which credit cards give you the most value, write a spending summary, and study spending trends in aggregate, de-identified form. We keep these transactions indefinitely, linked to your device identifier rather than to your name or account.

Receipts and attachments

• What you can add: receipts and documents attached to transactions, in JPG, PNG, WebP, HEIC, or PDF format.
• AI reading: on the Thrive plan, AI reads your receipts, and you review the result before saving it.
• Scanning with your phone: on a computer, you can scan a receipt with your phone through a one-time QR code link. The link expires after 15 minutes and doesn't require you to sign in on the phone.
• How long we keep them: until you delete them or the transaction they are attached to. Scans you never attach to a transaction are deleted after 24 hours. Images that aren't receipts are deleted immediately.

Fin, our AI assistant

Fin answers questions about your own money in Finly Money, on the Thrive and Family plans. Fin can look up your information but cannot change it.

To answer a question, Fin can look up and send to Anthropic:

• your Finly Money data: transactions (including the first 80 characters of any note), balances, budgets, recurring charges, investments, and rewards
• your FinlyWealth account: cash-back, referrals, offers you clicked, financial profile answers, and your plan
• in a household, only what your partner has chosen to share with you

Your conversations, including what Fin looked up and how it answered, are kept with the conversation so we can provide support. They are kept until you delete them, your financial data, or your account. You can also text Fin (see "Mobile numbers and text messages" in section 5).

Internal tools

Our staff use an internal AI tool (Anthropic Claude) with read-only access to site data for business reporting, such as rebates, clicks, and sign-ups. Results can include account details such as email addresses. The tool is technically blocked from your Finly Money financial data and your Fin conversations. From Finly Money, it can see only subscription facts: your plan, its status, and trials.

Our affiliate partners have an AI analysis tool too. It works only with the aggregated and de-identified information they already see (section 6).

How AI output is used

AI output can be wrong. That is why you review statement and receipt results before saving them, and why you can correct categories and card identification. Nothing in our Services is financial, investment, tax, or legal advice.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, including AI. Fraud screening is based on rules, and bans are reviewed by staff. If that changes, we will tell you, explain the reasoning involved, and give you a way to ask for a human review.

When we classify a merchant for rewards purposes, we store the answer by merchant name only for up to 90 days and reuse it for other members. That stored answer contains no information about you.

5. How we use your information

We use personal information to:

• Provide our Services: run your account, calculators, Finly Money, Fin, households, and shared bills.
• Recommend products: select and rank the financial products we show you on the Website, based on what you have told us and how you use the Website.
• Run cash-back and referrals: track eligibility, verify rebate claims, credit referrals, and pay you.
• Bill you: manage your Finly Money subscription, free trials, and taxes through Stripe.
• Communicate with you: send account, security, subscription, and household emails, answer support requests, and send the reminders and texts you asked for.
• Market to you: with your consent, send emails about offers, products, and news.
• Prevent fraud and keep the Services secure: see "Fraud prevention" below.
• Measure and improve: understand how people use the Services, test changes, fix problems, and measure our advertising.
• Study trends: produce aggregate, de-identified reports on spending and product use.
• Meet legal obligations: keep tax and financial records, respond to lawful requests, and enforce our Terms & Conditions.

We use your information for a new purpose only with your consent, unless the law permits otherwise.

Fraud prevention

Our cash-back, referral, and free-trial programs have real value, so we take steps to stop duplicate accounts, ban evasion, and other abuse:

• At sign-up: we block disposable email domains, and we check your email address against existing accounts.
• Device checks: we check a device blocklist when you sign up and sign in.
• Linked accounts: we link accounts that share an email address, payout email, device fingerprint, or device cookie. Shared IP addresses and names are used as extra signals.
• Referral screening: we screen referral visits that carry advertising click identifiers or paid campaign tags. When we block one, we log the IP address, browser, referring page, country, and device identifier.
• Returning people: after an account is deleted, we keep a one-way hash of its email address and phone number, so a suspended person can't evade a ban and once-per-person trials and offers can't be claimed twice (section 9).

Bans are reviewed by staff. If we find a breach of our Terms & Conditions, we may suspend or close the account, as the Terms describe.

Marketing communications

We send marketing emails only if you have agreed to receive them. The newsletter box at sign-up is optional and unticked. We keep a record of when you agreed and the wording you agreed to.

Our email marketing provider, Customer.io, sends our marketing emails and newsletters. They may also receive your email address, first name, sign-up details, financial profile, and activity with us, including your cash-back balance. Customer.io does not receive information from your connected financial accounts.

You can unsubscribe using the link in any marketing email, or by writing to admin@finlywealth.com. You will still receive emails about your account, security, payouts, subscription, and household.

We do not send marketing text messages or push notifications.

Reviews

When a rebate arrives, the email we send you is also sent to Trustpilot, so that Trustpilot can invite you to review us. Trustpilot receives your email address and handles it under its own privacy policy.

Mobile numbers and text messages

What we collect. If you give us your mobile number, we collect:

• the number and whether you have verified it
• its line type, which our text message provider looks up
• when you signed up for texts, and when you stopped them
• the texts you send to Fin and Fin's replies, which are kept in your Fin conversation history, where you can see them in the app
• delivery records from our text message provider, such as message IDs and delivery status

How we use it. We use this information to:

• verify your number with one-time codes, which is required before your first payout
• send the texts you asked for: reminders, alerts, and answers from Fin
• answer the questions you text to Fin
• act on STOP, START, and HELP replies
• keep a record of your consent and opt-outs

Texting needs the Thrive or Family plan, a verified number, and your explicit opt-in. Texts are off until you turn them on.

Who processes it. Our text message provider (Twilio) delivers our texts and verifies numbers. Incoming texts pass through our background job provider (Inngest) on their way to Fin. To answer the questions you text Fin, the text of each question and the account information needed to answer it are processed by our AI service provider (Anthropic). Fin's text replies never include account numbers. These providers act on our behalf, and only to provide these services.

No sharing for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors who support our services, such as customer service and message delivery. All of the categories above exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties.

How long we keep it. Your Fin text conversations are kept with your other Fin conversations. Delivery records and consent and opt-out records are kept unless explicitly requested to be deleted. Our text message provider keeps its own delivery records under its own retention schedule.

Your choices. Reply STOP to any text to stop all Finly Money texts, or turn texts off in the app. You need a verified number to receive payouts.

6. How we disclose your information

We do not sell your personal information. We disclose it only as described below.

Service providers

We use service providers to run the Services. They may process your information only on our instructions, for the purposes we set, under contracts that require appropriate security and confidentiality. We remain accountable for your information while they handle it.

Third parties that also use information for their own purposes

Some third parties receive information from us or from your browser and also use it under their own privacy policies:

• Plaid, as described in section 3.
• Advertising providers (Google Ads, Meta, Microsoft Ads, and Reddit), described below.
• Trustpilot, which shows our reviews widget and receives your email address to invite you to review us (section 5).
• Calendly and YouTube, when you use their embedded tools or videos on our Website.

Advertising providers

We advertise online, and we measure which ads bring people to FinlyWealth.

On our public pages. Advertising tags from Meta, Microsoft Ads, and Reddit, and Google's tag and analytics tools, run on our public pages and on the Finly Money sign-up and trial-invitation pages. Section 7 explains these tags and your choices.

Not inside Finly Money. No advertising tag runs inside the signed-in Finly Money app, such as your transactions, accounts, or budgets, and no page view from inside the app is sent to an advertising network.

Finly Money conversions. When you start a Finly Money free trial or your first paid month, our servers report it to Meta (through its Conversions API), Google (through Google Analytics, imported into Google Ads), Microsoft Ads, and Reddit. The report includes:

• the event, your plan, and its monthly price
• your email address, name, and our internal ID for you, each in hashed form
• the advertising click and analytics identifiers from your browser
• your IP address and browser type
• the page address, without its query string

We capture the click identifiers, IP address, and browser type at checkout, and store them with your subscription at Stripe until the conversion happens.

Rebate approvals. When a partner reports that you were approved for a product you clicked through to from our Website, we report it to Meta, Microsoft Ads, and Google. The report includes the advertising and analytics identifiers from your click, your IP address and browser type, your email address and name in hashed form, the product, and our commission value.

What we never report. We never send Finly Money financial data, such as transactions, balances, or accounts, to an advertising network. We do not report account sign-ups to advertising networks from our servers.

Quebec visitors who decline. If you are in Quebec and decline cookies (section 7), we report nothing about your visits to advertising networks. Your rebate clicks are recorded without any advertising or analytics identifiers, and they still count for your rebate.

[DECISION NEEDED A7: whether we use Meta or Google custom audiences or retargeting, and if so, with what information.]

Financial institutions and affiliate networks

We earn commissions when you apply for or open a product through us.

• When you click through to a partner: we pass the affiliate network or institution a numeric reference. We do not send your name or email address.
• When you apply: you complete the application on the institution's own site, under its privacy policy.
• Afterwards: the network or institution tells us whether the application led to a commission or rebate, so we can credit you. We delete affiliate tracking identifiers after 365 days.

Our affiliate partners

People and companies in our affiliate program earn commissions on visitors they send us. They see aggregated statistics about their audience, such as visits, referring sites, devices, and time of day. They also see a record of each resulting transaction: the product, amounts, dates, status, and a reference number the institution assigns. They do not see your name or email address.

Partner pages

Some partners have their own pages on a FinlyWealth subdomain (for example, partner.finlywealth.com). Those pages run the partner's own analytics tags, which collect information about your visit for the partner under the partner's privacy policy. This policy covers everything else on those pages. Your FinlyWealth sign-in works across our subdomains.

Household partners

If you share a Finly Money household, your partner can see only what you choose to share, by area and by account. Nothing is shared by default. Your partner can view shared information but cannot change it, and Fin uses only what the other person has shared. Either of you can change what you share, or leave the household, at any time.

People you split bills with

We never contact the people you record in shared bills, and they cannot see anything in Finly Money.

Legal requirements and protection

We and our service providers may disclose personal information:

• in response to a search warrant or other legally valid inquiry or order
• to another organization to investigate a breach of an agreement or a contravention of law, or to detect, suppress, or prevent fraud
• as otherwise required or permitted by Canadian, US, or other law, which may include lawful access requests by courts, law enforcement, or government authorities
• where necessary to establish, exercise, or defend legal claims, or to investigate or prevent actual or suspected loss or harm to people or property

Business transactions

If we are involved in a proposed or completed merger, acquisition, financing, or sale of assets, we may disclose personal information to the other parties as the law permits. They must protect it and use it only for that transaction.

With your consent

We may disclose your information for other purposes if you ask us to or agree to it.

7. Cookies, device fingerprinting, and analytics

We and our service providers use cookies, browser storage, tags, and device fingerprinting on the Services. A cookie is a small file your browser stores so that a website can recognize it later.

Cookies we set

We also store some settings in your browser's local storage, such as Finly Money display preferences, unsaved drafts, and your calculator statement analysis. They stay on your device until you clear them.

Third-party tools on our public pages

These tools run on our public pages:

• Google Tag Manager and Google Analytics 4. We also send some Google Analytics events from our servers.
• Amplitude, for product analytics. It records sessions and page views, and receives our internal ID for you and your email address and name in hashed form.
• Meta Pixel, Microsoft Ads UET, and Reddit Pixel, to measure our advertising
• Google reCAPTCHA Enterprise, to stop bots
• the Trustpilot reviews widget
• Vercel Speed Insights, to measure page speed

Advertising tags also run on the Finly Money sign-up and trial-invitation pages, so we can measure the ads that bring people in. No advertising tag runs inside the signed-in Finly Money app.

Analytics inside Finly Money

Inside Finly Money, we send Amplitude only key actions, such as "connected a bank." We never send free text, such as merchant names, notes, searches, or file names. Amounts are sent only as ranges, and query strings are removed from Finly Money page addresses.

Device fingerprinting

Our fingerprinting provider, Thumbmark, reads characteristics of your browser and device. We store only a hash of the result. We use it on sign-in and sign-up attempts, affiliate clicks, and visits to partner subdomains, to detect duplicate accounts, ban evasion, and referral abuse. It's also used to limit statement analyses in the calculator and keep calculator results.

We keep device fingerprints and identifiers after an account is deleted, to prevent fraud (section 9).

Your choices

If you are in Quebec. If we can confidently locate you in Quebec from your IP address, you see a short banner, in French or English to match your browser, with equal Accept and Decline buttons. Until you accept, none of these run: Google Tag Manager, Google Analytics 4, the Meta, Microsoft, and Reddit tags, ad click ID cookies, Amplitude in your browser, and the Finly Money analytics events we send from our servers for your visits. You can change your answer at any time from "Cookie choices" in the footer of every page.

Everyone else. If you are outside Quebec, or we can't confidently locate you, these technologies run when you visit, and you can opt out:

• Browser settings: you can block or delete cookies in your browser. Some features, such as staying signed in, will not work without necessary cookies.
• Advertising: you can change your ad preferences with Google, Meta, Microsoft, and Reddit, and opt out of interest-based advertising through the Digital Advertising Alliance of Canada's AdChoices program (youradchoices.ca).
• Analytics: you can opt out of Google Analytics with Google's browser add-on.

Always on. These are necessary to provide the Services and run for everyone:

• sign-in and session cookies
• security and fraud prevention: the device ID, the browser fingerprint hash, and reCAPTCHA
• affiliate and referral attribution, which credits rebates and referrals
• preference cookies

8. Security and where your information is stored

How we protect your information

We use technical, administrative, and physical safeguards suited to the sensitivity of the information. These include:

• Encryption in transit: information sent to and from the Services is protected with TLS.
• Encrypted connection tokens: the tokens and secrets that let us reach your connected accounts are encrypted with AES-256-GCM.
• Encryption at rest: our database and file storage are encrypted at rest.
• No bank passwords: we never receive or store your bank password, and connections are read-only.
• Private file storage: uploaded files are kept in private storage and reached only through signed links that expire quickly.
• Signed webhooks: messages our providers send us are signed, so we can check they are genuine.
• Access controls: each member can reach only their own data, and their partner's data only as shared.
• Account protection: optional two-step verification, and limits on repeated sign-in and sign-up attempts.
• Test data: our developers work with copies of our database in which names, email addresses, phone numbers, IP addresses, merchant names, and other identifying details are replaced or removed.
• Security program: we maintain a documented information security program covering access control, data handling, incident response, secure development, vendor management, and data retention. Access to production systems requires multi-factor authentication and is reviewed regularly. All staff sign confidentiality obligations that continue after they leave.

You can help by using a strong, unique password, turning on two-step verification, and watching for phishing. We will never ask for your password in an unsolicited email, text, or call. Privacy mode in Finly Money only blurs amounts on your screen. It is not a security control.

No security system is perfect. We use commercially reasonable measures to protect your information, but we cannot guarantee its absolute security.

Staff access

Authorized staff can access member data when needed for support, security, or legal reasons, under internal access controls. This includes support tickets, rebate verification files, device signals, calculator statement transactions, and connection records. To troubleshoot problems, staff can view your cash-back pages as you see them, and view the affiliate hub as an affiliate partner sees it. Section 4 describes the limits on our staff AI tool.

Security breaches

If we learn of a breach of security safeguards involving your personal information, we will assess it promptly, take steps to limit any harm, and correct the cause.

Where a breach creates a real risk of significant harm to you, or a risk of serious injury under Quebec law, we will:

• notify you as soon as feasible, usually by email, explaining what happened, what information was involved, the possible consequences, and what you can do
• report it to the Office of the Privacy Commissioner of Canada
• report it to the Commission d'accès à l'information du Québec, where Quebec law requires it

We keep a record of every breach, as the law requires.

Where your information is stored

Our main database is hosted in Toronto, Canada. Most of our service providers are in the United States (section 6), so your personal information is also stored and processed in the United States, and possibly other countries.

Information held outside Canada is subject to the laws of that country. It may be accessed by its courts, law enforcement, and government authorities under those laws. We remain accountable for your information and use contracts to require a comparable level of protection.

Before we communicate personal information about Quebec residents outside Quebec, Quebec law requires us to assess whether it will be adequately protected.

9. How long we keep your information, and deleting it

We keep personal information only as long as we need it for the purposes in this policy, or as the law requires. In summary:

Information deleted from our live systems remains in backups until those backups expire on their normal schedule. We do not restore deleted information from backups into live service without re-applying deletions.

Deleting transactions

• Transactions you added by hand are deleted.
• Transactions from a statement are marked deleted, so uploading the same statement again can't bring them back.
• Transactions from a connected bank can be hidden. They are fully deleted when you remove that account together with its history, or when you delete your financial data.

Deleting your financial data

From your Finly Money Profile, you can choose Delete my financial data. We first remove every connection at the provider. If any provider refuses, nothing is deleted, and you can try again. We then delete all of your transactions, accounts, statement records, budgets, net worth, investments, rewards, shared bills, reminders, Fin conversations, insights, and stored files. Your account, plan, and settings stay.

Deleting your account

From your Profile, you can choose Delete my account, or ask our Privacy Officer to do it. This does everything above, and also deletes your remaining Finly Money settings, membership, household, financial profile, and the people you split bills with. We also ask Customer.io and Amplitude to delete your information. [DECISION NEEDED A11: whether deleting your account cancels an active Stripe subscription.]

What we keep, and why:

• Financial records: rebate and payout records, anonymized, for 7 years, to meet tax and books-and-records obligations.
• Connection logs: technical connection records, anonymized.
• A one-way hash of your email address and phone number, used only to recognize a returning person, so that a suspended person can't evade a ban and once-per-person trials and offers can't be claimed twice. The payout email hash and rebate totals are also kept.
• Device signals, to prevent fraud.
• Stripe's records: Stripe keeps its own customer and invoice records for tax purposes.

Other service providers keep what they already received under their own retention schedules. These include Google Analytics, advertising providers, and Twilio. To stop marketing emails right away, unsubscribe before deleting your account.

Transactions extracted from calculator statements are linked to your device, not your account, so deleting your account does not delete them.

10. Your rights and choices

Your rights

Subject to exceptions set by law, you have the right to:

• Access: ask for a copy of the personal information we hold about you, how we have used it, and to whom we have disclosed it.
• Correction: ask us to correct inaccurate or incomplete information. Information from your financial institution has to be corrected at the institution, since we show what it sends us. We will help you find out where a figure came from.
• Deletion: delete your financial data or your whole account yourself, or ask us to delete your information. We keep only the records described in section 9.
• Withdrawal of consent: withdraw your consent at any time, subject to legal and contractual limits and reasonable notice. Some features may stop working. For example, withdrawing consent for a connected account means disconnecting it.
• Portability: ask for information you gave us in a structured, commonly used format. On the Grow plan and above, you can also export your Finly Money data as a CSV file from the app.
• Automated processing: ask about the information and reasoning behind any decision made about you by automated means.

If you live in Quebec, you also have the right to be told about any technology we use that can identify, locate, or profile you. These are described in section 7: device fingerprinting, the device ID cookie, and analytics and advertising tags. You may also ask us to stop disseminating your personal information or to de-index any link to it, where the law allows, and you can make a complaint to the Commission d'accès à l'information du Québec (section 12).

We will respond within 30 days. If we need longer, we will tell you within 30 days why and how long it will take. We may need to verify your identity first, and we will not ask for more information than we need to do so.

Your choices

• Connected accounts: disconnect them at any time (section 3).
• Household sharing: change what you share, or leave the household, at any time.
• Reminders and texts: turn them off in the app, or reply STOP.
• Marketing emails: unsubscribe from any marketing email.
• Cookies: use "Cookie choices" in the footer if you are in Quebec, or the options in section 7.
• Fin conversations: delete them in the app.
• Your financial data or your account: delete them from your Profile (section 9).

11. Contacting our Privacy Officer

Our Privacy Officer is accountable for our compliance with this policy and with privacy law. To make a request, ask a question, or raise a concern, contact:

Privacy Officer (Chief Technology Officer), Finly Technology Corp.

Email: admin@finlywealth.com

Mail: 806-2024 Fullerton Avenue, North Vancouver, BC V7P 3G4, Canada

We will acknowledge your request promptly and respond in full within 30 days.

12. Complaints

If you have a concern, please contact our Privacy Officer first so we can try to resolve it. If you are not satisfied, you may contact the privacy regulator where you live:

• Office of the Privacy Commissioner of Canada (priv.gc.ca)
• Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca)
• Commission d'accès à l'information du Québec (cai.gouv.qc.ca)
• Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca)

13. Children

Our Services are not for minors. You must have reached the age of majority where you live to create an account, use Finly Money, connect a financial account, or join our cash-back program. That age is 19 in British Columbia, Nova Scotia, New Brunswick, Newfoundland and Labrador, the Northwest Territories, Nunavut, and Yukon, and 18 elsewhere in Canada.

We do not knowingly collect personal information from minors. If you believe a minor has given us personal information, contact our Privacy Officer and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes to our practices or the law. The date at the top shows when it was last updated. Changes take effect when we post them.

For material changes, we will notify you by email or in the Services before the change takes effect. Examples include a new purpose for using information from your connected accounts, or a new category of recipient for it. Where the law requires, we will ask for your consent again rather than rely on your continued use.